(file) Return to SSLContext.cpp CVS log (file) (dir) Up to [Pegasus] / pegasus / src / Pegasus / Common

Diff for /pegasus/src/Pegasus/Common/SSLContext.cpp between version 1.75 and 1.115

version 1.75, 2006/11/10 18:14:58 version 1.115, 2013/03/19 17:00:55
Line 1 
Line 1 
 //%2006////////////////////////////////////////////////////////////////////////  //%LICENSE////////////////////////////////////////////////////////////////
 // //
 // Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development  // Licensed to The Open Group (TOG) under one or more contributor license
 // Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.  // agreements.  Refer to the OpenPegasusNOTICE.txt file distributed with
 // Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L.P.;  // this work for additional information regarding copyright ownership.
 // IBM Corp.; EMC Corporation, The Open Group.  // Each contributor licenses this file to you under the OpenPegasus Open
 // Copyright (c) 2004 BMC Software; Hewlett-Packard Development Company, L.P.;  // Source License; you may not use this file except in compliance with the
 // IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.  // License.
 // Copyright (c) 2005 Hewlett-Packard Development Company, L.P.; IBM Corp.;  //
 // EMC Corporation; VERITAS Software Corporation; The Open Group.  // Permission is hereby granted, free of charge, to any person obtaining a
 // Copyright (c) 2006 Hewlett-Packard Development Company, L.P.; IBM Corp.;  // copy of this software and associated documentation files (the "Software"),
 // EMC Corporation; Symantec Corporation; The Open Group.  // to deal in the Software without restriction, including without limitation
 //  // the rights to use, copy, modify, merge, publish, distribute, sublicense,
 // Permission is hereby granted, free of charge, to any person obtaining a copy  // and/or sell copies of the Software, and to permit persons to whom the
 // of this software and associated documentation files (the "Software"), to  // Software is furnished to do so, subject to the following conditions:
 // deal in the Software without restriction, including without limitation the  //
 // rights to use, copy, modify, merge, publish, distribute, sublicense, and/or  // The above copyright notice and this permission notice shall be included
 // sell copies of the Software, and to permit persons to whom the Software is  // in all copies or substantial portions of the Software.
 // furnished to do so, subject to the following conditions:  //
 //  // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 // THE ABOVE COPYRIGHT NOTICE AND THIS PERMISSION NOTICE SHALL BE INCLUDED IN  // OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 // ALL COPIES OR SUBSTANTIAL PORTIONS OF THE SOFTWARE. THE SOFTWARE IS PROVIDED  // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 // "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT  // IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 // LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR  // CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 // PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT  // TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 // HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN  // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 // ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION  
 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.  
 // //
 //==============================================================================  //////////////////////////////////////////////////////////////////////////
 // //
 //%///////////////////////////////////////////////////////////////////////////// //%/////////////////////////////////////////////////////////////////////////////
  
 #ifdef PEGASUS_HAS_SSL #ifdef PEGASUS_HAS_SSL
   
 #include <Pegasus/Common/Config.h> #include <Pegasus/Common/Config.h>
   # include <Pegasus/Common/Executor.h>
 #include "Network.h"  # include <Pegasus/Common/Network.h>
   
 #define OPENSSL_NO_KRB5 1 #define OPENSSL_NO_KRB5 1
 #include <openssl/err.h> #include <openssl/err.h>
 #include <openssl/ssl.h> #include <openssl/ssl.h>
Line 44 
Line 40 
 #else #else
 #define SSL_CTX void #define SSL_CTX void
 #endif // end of PEGASUS_HAS_SSL #endif // end of PEGASUS_HAS_SSL
   
   #include <time.h>
 #include <Pegasus/Common/Socket.h> #include <Pegasus/Common/Socket.h>
 #include <Pegasus/Common/Tracer.h> #include <Pegasus/Common/Tracer.h>
 #include <Pegasus/Common/FileSystem.h> #include <Pegasus/Common/FileSystem.h>
 #include <time.h>  
 #include <Pegasus/Common/MessageLoader.h> #include <Pegasus/Common/MessageLoader.h>
 #include <Pegasus/Common/Formatter.h>  
  
 #include "SSLContext.h" #include "SSLContext.h"
 #include "SSLContextRep.h" #include "SSLContextRep.h"
  
 #ifdef PEGASUS_OS_OS400  #ifdef PEGASUS_OS_PASE
 #include "SSLWrapperOS400.h"  # include <ILEWrapper/ILEUtilities.h>
 #endif #endif
  
 //  
 // Typedef's for OpenSSL callback functions.  
 //  
 extern "C"  
 {  
     typedef void (* CRYPTO_SET_LOCKING_CALLBACK)(int, int, const char *, int);  
     typedef unsigned long (* CRYPTO_SET_ID_CALLBACK)(void);  
 };  
   
 typedef struct x509_store_ctx_st X509_STORE_CTX; typedef struct x509_store_ctx_st X509_STORE_CTX;
  
 typedef struct Timestamp  
 {  
     char year[4];  
     char month[2];  
     char day[2];  
     char hour[2];  
     char minutes[2];  
     char seconds[2];  
     char dot;  
     char microSeconds[6];  
     char plusOrMinus;  
     char utcOffset[3];  
     char padding[3];  
 } Timestamp_t;  
   
 PEGASUS_USING_STD; PEGASUS_USING_STD;
  
 PEGASUS_NAMESPACE_BEGIN PEGASUS_NAMESPACE_BEGIN
  
 const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0; const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0;
  
   class SSLCertificateInfoRep
   {
   public:
       String    subjectName;
       String    issuerName;
       Uint32    depth;
       Uint32    errorCode;
       Uint32    respCode;
       String    errorString;
       Uint32    versionNumber;
       long      serialNumber;
       CIMDateTime    notBefore;
       CIMDateTime    notAfter;
   #ifdef  PEGASUS_USE_EXPERIMENTAL_INTERFACES
       String    peerCertificate;
   #endif
   };
   
 // //
 // use the following definitions only if SSL is available // use the following definitions only if SSL is available
 // //
 #ifdef PEGASUS_HAS_SSL #ifdef PEGASUS_HAS_SSL
  
 // Mutex for SSL locks which will get initialized by AutoArrayPtr constructor.  AutoArrayPtr<Mutex> SSLEnvironmentInitializer::_sslLocks;
 AutoArrayPtr<Mutex> SSLContextRep::_sslLocks;  int SSLEnvironmentInitializer::_instanceCount = 0;
   Mutex SSLEnvironmentInitializer::_instanceCountMutex;
 // Mutex for _countRep.  
 Mutex SSLContextRep::_countRepMutex;  
   
 // Initialise _count for SSLContextRep objects.  
 int SSLContextRep::_countRep = 0;  
  
  
 // //
Line 112 
Line 97 
 { {
     struct tm time;     struct tm time;
     int offset;     int offset;
     Timestamp_t timeStamp;  
     char tempString[80];  
     char plusOrMinus = '+';     char plusOrMinus = '+';
     unsigned char* utcTimeData = utcTime->data;     unsigned char* utcTimeData = utcTime->data;
  
Line 160 
Line 143 
     }     }
 #undef g2 #undef g2
  
     memset((void *)&timeStamp, 0, sizeof(Timestamp_t));  
  
     // Format the date.      if (plusOrMinus == '-')
     sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d",      {
           offset = -offset;
       }
   
       CIMDateTime dateTime = CIMDateTime(
             time.tm_year,             time.tm_year,
             time.tm_mon + 1,             time.tm_mon + 1,
             time.tm_mday,             time.tm_mday,
Line 171 
Line 157 
             time.tm_min,             time.tm_min,
             time.tm_sec,             time.tm_sec,
             0,             0,
               6,
             offset);             offset);
  
     timeStamp.plusOrMinus = plusOrMinus;  
   
     CIMDateTime dateTime;  
   
     dateTime.clear();  
     strcpy(tempString, (char *)&timeStamp);  
     dateTime.set(tempString);  
   
     return dateTime;     return dateTime;
 } }
  
Line 207 
Line 186 
 // return 1 if revoked, 0 otherwise // return 1 if revoked, 0 otherwise
 // //
 int SSLCallback::verificationCRLCallback( int SSLCallback::verificationCRLCallback(
     int ok,      int,
     X509_STORE_CTX* ctx,     X509_STORE_CTX* ctx,
     X509_STORE* sslCRLStore)     X509_STORE* sslCRLStore)
 { {
Line 218 
Line 197 
     //check whether a CRL store was specified     //check whether a CRL store was specified
     if (sslCRLStore == NULL)     if (sslCRLStore == NULL)
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,          PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
             "---> SSL: CRL store is NULL");             "---> SSL: CRL store is NULL");
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         return 0;         return 0;
Line 238 
Line 217 
     //log certificate information     //log certificate information
     //this is information in the "public" key, so it does no harm to log it     //this is information in the "public" key, so it does no harm to log it
     X509_NAME_oneline(issuerName, buf, sizeof(buf));     X509_NAME_oneline(issuerName, buf, sizeof(buf));
     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,      PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
         "---> SSL: Certificate Data: Issuer/Subject");         "---> SSL: Certificate Data: Issuer/Subject");
     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, buf);      PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, buf);
     X509_NAME_oneline(subjectName, buf, sizeof(buf));     X509_NAME_oneline(subjectName, buf, sizeof(buf));
     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, buf);      PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, buf);
  
     //initialize the CRL store     //initialize the CRL store
     X509_STORE_CTX crlStoreCtx;     X509_STORE_CTX crlStoreCtx;
     X509_STORE_CTX_init(&crlStoreCtx, sslCRLStore, NULL, NULL);     X509_STORE_CTX_init(&crlStoreCtx, sslCRLStore, NULL, NULL);
  
     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,      PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
         "---> SSL: Initialized CRL store");         "---> SSL: Initialized CRL store");
  
     //attempt to get a CRL issued by the certificate's issuer     //attempt to get a CRL issued by the certificate's issuer
Line 256 
Line 235 
     if (X509_STORE_get_by_subject(     if (X509_STORE_get_by_subject(
             &crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0)             &crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0)
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,          X509_STORE_CTX_cleanup(&crlStoreCtx);
           PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
             "---> SSL: No CRL by that issuer");             "---> SSL: No CRL by that issuer");
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         return 0;         return 0;
Line 267 
Line 247 
     X509_CRL* crl = obj.data.crl;     X509_CRL* crl = obj.data.crl;
     if (crl == NULL)     if (crl == NULL)
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL is null");          PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL is null");
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         return 0;         return 0;
     }     }
     else     else
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,          PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
             "---> SSL: Found CRL by that issuer");             "---> SSL: Found CRL by that issuer");
     }     }
  
Line 281 
Line 261 
     STACK_OF(X509_REVOKED)* revokedCerts = NULL;     STACK_OF(X509_REVOKED)* revokedCerts = NULL;
     revokedCerts = X509_CRL_get_REVOKED(crl);     revokedCerts = X509_CRL_get_REVOKED(crl);
     int numRevoked = sk_X509_REVOKED_num(revokedCerts);     int numRevoked = sk_X509_REVOKED_num(revokedCerts);
     Tracer::trace(TRC_SSL, Tracer::LEVEL4,      PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
         "---> SSL: Number of certificates revoked by the issuer %d\n",         "---> SSL: Number of certificates revoked by the issuer %d\n",
         numRevoked);          numRevoked));
  
     //check whether the subject's certificate is revoked     //check whether the subject's certificate is revoked
     X509_REVOKED* revokedCert = NULL;     X509_REVOKED* revokedCert = NULL;
     for (int i = 0; i < sk_X509_REVOKED_num(revokedCerts); i++)      for (int i = 0; i < numRevoked; i++)
     {     {
         revokedCert = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i);          revokedCert = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i);
   
         //a matching serial number indicates revocation         //a matching serial number indicates revocation
         if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0)         if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0)
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2,
                 "---> SSL: Certificate is revoked");                 "---> SSL: Certificate is revoked");
             X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED);             X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED);
               X509_CRL_free(crl);
             PEG_METHOD_EXIT();             PEG_METHOD_EXIT();
             return 1;             return 1;
         }         }
     }     }
  
     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,      X509_CRL_free(crl);
   
       PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
         "---> SSL: Certificate is not revoked at this level");         "---> SSL: Certificate is not revoked at this level");
  
     PEG_METHOD_EXIT();     PEG_METHOD_EXIT();
Line 319 
Line 301 
 int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX* ctx) int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX* ctx)
 { {
     PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()");     PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()");
   
     char   buf[256];     char   buf[256];
     X509   *currentCert;     X509   *currentCert;
     SSL    *ssl;     SSL    *ssl;
     int    verifyError = X509_V_OK;  
     int    revoked = -1;     int    revoked = -1;
  
     Tracer::trace(TRC_SSL, Tracer::LEVEL4,      PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
         "--->SSL: Preverify Error %d", verifyError);          "--->SSL: Preverify result %d", preVerifyOk));
  
     //     //
     // get the verification callback info specific to each SSL connection     // get the verification callback info specific to each SSL connection
Line 345 
Line 325 
     {     {
         revoked = verificationCRLCallback(         revoked = verificationCRLCallback(
             preVerifyOk,ctx,exData->_rep->crlStore);             preVerifyOk,ctx,exData->_rep->crlStore);
         Tracer::trace(TRC_SSL, Tracer::LEVEL4,          PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
             "---> SSL: CRL callback returned %d", revoked);              "---> SSL: CRL callback returned %d", revoked));
  
         if (revoked) //with the SSL callbacks '0' indicates failure         if (revoked) //with the SSL callbacks '0' indicates failure
         {         {
Line 355 
Line 335 
         }         }
     }     }
  
     Tracer::trace(TRC_SSL, Tracer::LEVEL4,      PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
         "---> SSL: CRL callback returned %d", revoked);          "---> SSL: CRL callback returned %d", revoked));
 #endif #endif
  
     //     //
Line 407 
Line 387 
     //     //
     if (!preVerifyOk)     if (!preVerifyOk)
     {     {
         Tracer::trace(TRC_SSL, Tracer::LEVEL4,          PEG_TRACE((TRC_SSL, Tracer::LEVEL2,
             "---> SSL: certificate default verification error: %s",             "---> SSL: certificate default verification error: %s",
             (const char*)errorStr.getCString());              (const char*)errorStr.getCString()));
     }     }
  
     //     //
Line 424 
Line 404 
  
     // insert at the beginning of the array so that the peer certificate is     // insert at the beginning of the array so that the peer certificate is
     // first and the root CA is last     // first and the root CA is last
     exData->_rep->peerCertificate.insert(0, new SSLCertificateInfo(      SSLCertificateInfo *certInfo = new SSLCertificateInfo(
         subjectName, issuerName, version, serialNumber,          subjectName,
         notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk));          issuerName,
           version,
           serialNumber,
           notBefore,
           notAfter,
           depth,
           errorCode,
           errorStr,
           preVerifyOk);
   
       String peerCertificate;
   #ifdef  PEGASUS_USE_EXPERIMENTAL_INTERFACES
       //
       // Get Base64 encoded DER (PEM) certificate
       //
       char *data = 0;
       long length = 0;
   
       BIO *bio = BIO_new(BIO_s_mem());
       if (bio)
       {
           if (PEM_write_bio_X509(bio, currentCert) == 0)
           {
               PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1,
                   "PEM converion failed.");
           }
           else
           {
               length = BIO_get_mem_data(bio, &data);
               peerCertificate.assign(data, (Uint32)length);
           }
           BIO_free_all(bio);
       }
       certInfo->_rep->peerCertificate = peerCertificate;
   #endif
   
       exData->_rep->peerCertificate.insert(0, certInfo);
  
     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "Created SSLCertificateInfo");  
       PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, "Created SSLCertificateInfo");
  
     // NOT_YET_VALID checks do not work correctly on subsequent tries --     // NOT_YET_VALID checks do not work correctly on subsequent tries --
     // Bugzilla#4283     // Bugzilla#4283
Line 438 
Line 455 
         (CIMDateTime::getDifference(         (CIMDateTime::getDifference(
              CIMDateTime::getCurrentDateTime(), notBefore) > 0))              CIMDateTime::getCurrentDateTime(), notBefore) > 0))
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,          PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2,
             "Certificate was not yet valid.");             "Certificate was not yet valid.");
   
         X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_NOT_YET_VALID);         X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_NOT_YET_VALID);
     }     }
  
Line 451 
Line 469 
     // This is because OpenSSL retains the original default error in case     // This is because OpenSSL retains the original default error in case
     // we want to use it later.     // we want to use it later.
     // To set the error, we could use X509_STORE_CTX_set_error(ctx,     // To set the error, we could use X509_STORE_CTX_set_error(ctx,
     // verifyError); but there is no real benefit to doing that here.      // X509_V_OK); but there is no real benefit to doing that here.
     //     //
     if (exData->_rep->verifyCertificateCallback == NULL)     if (exData->_rep->verifyCertificateCallback == NULL)
     {     {
           PEG_METHOD_EXIT();
         return preVerifyOk;         return preVerifyOk;
   
     }     }
     else     else
     {     {
         if (exData->_rep->verifyCertificateCallback(         if (exData->_rep->verifyCertificateCallback(
                 *exData->_rep->peerCertificate[0]))                 *exData->_rep->peerCertificate[0]))
         {         {
             Tracer::trace(TRC_SSL, Tracer::LEVEL4,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
                 "--> SSL: _rep->verifyCertificateCallback() returned "                 "--> SSL: _rep->verifyCertificateCallback() returned "
                     "X509_V_OK");                     "X509_V_OK");
   
             PEG_METHOD_EXIT();             PEG_METHOD_EXIT();
             return 1;             return 1;
         }         }
         else // verification failed, handshake will be immediately terminated         else // verification failed, handshake will be immediately terminated
         {         {
             Tracer::trace(TRC_SSL, Tracer::LEVEL4,              PEG_TRACE((TRC_SSL, Tracer::LEVEL1,
                 "--> SSL: _rep->verifyCertificateCallback() returned error %d",                 "--> SSL: _rep->verifyCertificateCallback() returned error %d",
                 exData->_rep->peerCertificate[0]->getErrorCode());                  exData->_rep->peerCertificate[0]->getErrorCode()));
  
             PEG_METHOD_EXIT();             PEG_METHOD_EXIT();
             return 0;             return 0;
Line 494 
Line 511 
 } }
  
 // //
 // Implement OpenSSL locking callback.  
 //  
 void pegasus_locking_callback(  
     int mode,  
     int type,  
     const char* file,  
     int line)  
 {  
     // Check whether the mode is lock or unlock.  
   
     if ( mode & CRYPTO_LOCK )  
     {  
         /*Tracer::trace(TRC_SSL, Tracer::LEVEL4,  
                 "Now locking for %d", Threads::id());*/  
         SSLContextRep::_sslLocks.get()[type].lock( );  
     }  
     else  
     {  
         /*Tracer::trace(TRC_SSL, Tracer::LEVEL4,  
                 "Now unlocking for %d", Threads::id());*/  
         SSLContextRep::_sslLocks.get()[type].unlock( );  
     }  
 }  
   
 //  
 // Initialize OpenSSL Locking and id callbacks.  
 //  
 void SSLContextRep::init_ssl()  
 {  
      // Allocate Memory for _sslLocks. SSL locks needs to be able to handle  
      // up to CRYPTO_num_locks() different mutex locks.  
      PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,  
            "Initialized SSL callback.");  
   
 #ifdef PEGASUS_OS_OS400  
      // Load the OpenSSL library and get the exports  
      SSL_OS400_Init();  
 #endif  
   
      _sslLocks.reset(new Mutex[CRYPTO_num_locks()]);  
   
 #if defined(PEGASUS_HAVE_PTHREADS) && !defined(PEGASUS_OS_VMS)  
      // Set the ID callback. The ID callback returns a thread ID.  
      CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK) pthread_self);  
 #endif  
   
      // Set the locking callback to pegasus_locking_callback.  
   
      CRYPTO_set_locking_callback(  
          (CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback);  
   
 }  
   
 // Free OpenSSL Locking and id callbacks.  
 void SSLContextRep::free_ssl()  
 {  
     // Cleanup _sslLocks and set locking & id callback to NULL.  
   
     CRYPTO_set_locking_callback(NULL);  
     CRYPTO_set_id_callback     (NULL);  
     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,  
              "Freed SSL callback.");  
     _sslLocks.reset();  
 }  
   
   
 //  
 // SSL context area // SSL context area
 // //
 // For the OSs that don't have /dev/random device file, // For the OSs that don't have /dev/random device file,
Line 572 
Line 522 
     const String& keyPath,     const String& keyPath,
     const String& crlPath,     const String& crlPath,
     SSLCertificateVerifyFunction* verifyCert,     SSLCertificateVerifyFunction* verifyCert,
     const String& randomFile)      const String& randomFile,
       const String& cipherSuite)
 { {
     PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()");     PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()");
  
     _trustStore = trustStore;     _trustStore = trustStore;
   
     _certPath = certPath;     _certPath = certPath;
   
     _keyPath = keyPath;     _keyPath = keyPath;
   
     _crlPath = crlPath;     _crlPath = crlPath;
   
     _crlStore = NULL;  
   
     _certificateVerifyFunction = verifyCert;     _certificateVerifyFunction = verifyCert;
       _cipherSuite = cipherSuite;
  
     //     //
     // If a truststore and/or peer verification function is specified,     // If a truststore and/or peer verification function is specified,
     // enable peer verification     // enable peer verification
     //     //
     if (trustStore != String::EMPTY || verifyCert != NULL)      _verifyPeer = (trustStore != String::EMPTY || verifyCert != NULL);
     {  
         _verifyPeer = true;  
     }  
     else  
     {  
         _verifyPeer = false;  
     }  
   
     //  
     // Initialize SSL callbacks and increment the SSLContextRep object _counter.  
     //  
     {  
        AutoMutex autoMut(_countRepMutex);  
   
        Tracer::trace(TRC_SSL, Tracer::LEVEL4,  
                 "Value of Countrep in constructor %d", _countRep);  
         if ( _countRep == 0 )  
         {  
             init_ssl();  
   
             //  
             // load SSL library  
             //  
             Tracer::trace(TRC_SSL, Tracer::LEVEL4,  
                 "Before calling SSL_load_error_strings %d", Threads::id());  
   
             SSL_load_error_strings();  
   
             Tracer::trace(TRC_SSL, Tracer::LEVEL4,  
                 "After calling SSL_load_error_strings %d", Threads::id());  
   
             Tracer::trace(TRC_SSL, Tracer::LEVEL4,  
                 "Before calling SSL_library_init %d", Threads::id());  
   
             SSL_library_init();  
   
             Tracer::trace(TRC_SSL, Tracer::LEVEL4,  
                 "After calling SSL_library_init %d", Threads::id());  
         }  
   
         _countRep++;  
     }  // mutex unlocks here  
  
     _randomInit(randomFile);     _randomInit(randomFile);
  
Line 651 
Line 555 
     _certPath = sslContextRep._certPath;     _certPath = sslContextRep._certPath;
     _keyPath = sslContextRep._keyPath;     _keyPath = sslContextRep._keyPath;
     _crlPath = sslContextRep._crlPath;     _crlPath = sslContextRep._crlPath;
     _crlStore = sslContextRep._crlStore;  
     _verifyPeer = sslContextRep._verifyPeer;     _verifyPeer = sslContextRep._verifyPeer;
     _certificateVerifyFunction = sslContextRep._certificateVerifyFunction;     _certificateVerifyFunction = sslContextRep._certificateVerifyFunction;
     _randomFile = sslContextRep._randomFile;     _randomFile = sslContextRep._randomFile;
       _cipherSuite = sslContextRep._cipherSuite;
     // Initialize SSL callbacks and increment the SSLContextRep object _counter.  
     {  
         AutoMutex autoMut(_countRepMutex);  
         Tracer::trace(TRC_SSL, Tracer::LEVEL4,  
             "Value of Countrep in copy constructor %d", _countRep);  
         if ( _countRep == 0 )  
         {  
             init_ssl();  
         }  
   
         _countRep++;  
     }  // mutex unlocks here  
  
     _sslContext = _makeSSLContext();     _sslContext = _makeSSLContext();
   
     PEG_METHOD_EXIT();     PEG_METHOD_EXIT();
 } }
  
Line 683 
Line 575 
  
     SSL_CTX_free(_sslContext);     SSL_CTX_free(_sslContext);
  
     // Decrement the SSLContextRep object _counter.  
     {  
         AutoMutex autoMut(_countRepMutex);  
         _countRep--;  
         // Free SSL locks if no instances of SSLContextRep exist.  
   
         Tracer::trace(TRC_SSL, Tracer::LEVEL4,  
             "Value of Countrep in destructor %d", _countRep);  
         if ( _countRep == 0 )  
         {  
             free_ssl();  
         }  
   
     }  
     PEG_METHOD_EXIT();     PEG_METHOD_EXIT();
 } }
  
Line 707 
Line 585 
 { {
     PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_randomInit()");     PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_randomInit()");
  
     Boolean ret;  
     int retVal = 0;  
  
 #ifdef PEGASUS_SSL_RANDOMFILE  #if defined(PEGASUS_SSL_RANDOMFILE) && !defined(PEGASUS_OS_PASE)
     if ( RAND_status() == 0 )     if ( RAND_status() == 0 )
     {     {
         //         //
Line 718 
Line 594 
         //         //
         if ( randomFile == String::EMPTY )         if ( randomFile == String::EMPTY )
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1,
                 "Random seed file is required.");                 "Random seed file is required.");
             PEG_METHOD_EXIT();             PEG_METHOD_EXIT();
             MessageLoaderParms parms(             MessageLoaderParms parms(
Line 730 
Line 606 
         //         //
         // Try the given random seed file         // Try the given random seed file
         //         //
         ret = FileSystem::exists(randomFile);          Boolean ret = FileSystem::exists(randomFile);
         if (ret)         if (ret)
         {         {
             retVal = RAND_load_file(randomFile.getCString(), -1);              int retVal = RAND_load_file(randomFile.getCString(), -1);
             if ( retVal < 0 )             if ( retVal < 0 )
             {             {
                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,                  PEG_TRACE((TRC_SSL, Tracer::LEVEL1,
                     "Not enough seed data in seed file: " + randomFile);                      "Not enough seed data in seed file: %s",
                       (const char*)randomFile.getCString()));
                 PEG_METHOD_EXIT();                 PEG_METHOD_EXIT();
                 // do not put in $0 in default message, but pass in filename                 // do not put in $0 in default message, but pass in filename
                 // for bundle message                 // for bundle message
Line 750 
Line 627 
         }         }
         else         else
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,              PEG_TRACE((TRC_SSL, Tracer::LEVEL1,
                 "seed file - " + randomFile + " does not exist.");                  "Seed file \'%s\' does not exist.",
                   (const char*)randomFile.getCString()));
             PEG_METHOD_EXIT();             PEG_METHOD_EXIT();
             MessageLoaderParms parms(             MessageLoaderParms parms(
                 "Common.SSLContext.SEED_FILE_DOES_NOT_EXIST",                 "Common.SSLContext.SEED_FILE_DOES_NOT_EXIST",
Line 778 
Line 656 
             int  seedRet = RAND_status();             int  seedRet = RAND_status();
             if ( seedRet == 0 )             if ( seedRet == 0 )
             {             {
                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,                  PEG_TRACE((TRC_SSL, Tracer::LEVEL1,
                     "Not enough seed data in random seed file, RAND_status = " +                      "Not enough seed data in random seed file, "
                     seedRet);                          "RAND_status = %d",
                       seedRet));
                 PEG_METHOD_EXIT();                 PEG_METHOD_EXIT();
                 // do not put in $0 in default message, but pass in filename                 // do not put in $0 in default message, but pass in filename
                 // for bundle message                 // for bundle message
Line 794 
Line 673 
     }     }
 #endif  /* PEGASUS_SSL_RANDOMFILE */ #endif  /* PEGASUS_SSL_RANDOMFILE */
  
   #ifdef PEGASUS_OS_PASE
       if (RAND_status() == 0)
       {
           // generate random number for pase must use specify function
           unsigned char prn[1024];
           umeGenerateRandomNumber(prn, sizeof(prn));
           RAND_seed(prn, 1024);
       }
   #endif
   
     int seedRet = RAND_status();     int seedRet = RAND_status();
     if (seedRet == 0)     if (seedRet == 0)
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,          PEG_TRACE((TRC_SSL, Tracer::LEVEL1,
             "Not enough seed data , RAND_status = " + seedRet );              "Not enough seed data, RAND_status = %d",
               seedRet));
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         MessageLoaderParms parms(         MessageLoaderParms parms(
             "Common.SSLContext.NOT_ENOUGH_SEED_DATA",             "Common.SSLContext.NOT_ENOUGH_SEED_DATA",
Line 831 
Line 721 
 #ifdef PEGASUS_SSL_WEAKENCRYPTION #ifdef PEGASUS_SSL_WEAKENCRYPTION
     if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40)))     if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40)))
     {     {
           SSL_CTX_free(sslContext);
   
         MessageLoaderParms parms(         MessageLoaderParms parms(
             "Common.SSLContext.COULD_NOT_SET_CIPHER_LIST",             "Common.SSLContext.COULD_NOT_SET_CIPHER_LIST",
             "Could not set the cipher list");             "Could not set the cipher list");
Line 838 
Line 730 
     }     }
 #endif #endif
  
       if (_cipherSuite != String::EMPTY)
       {
           if (!(SSL_CTX_set_cipher_list(sslContext, _cipherSuite.getCString())))
           {
               SSL_CTX_free(sslContext);
   
               PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                   "---> SSL: Cipher Suite could not be specified");
               MessageLoaderParms parms(
                   "Common.SSLContext.COULD_NOT_SET_CIPHER_LIST",
                   "Could not set the cipher list");
               throw SSLException(parms);
           }
           else
           {
              PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
                   "---> SSL: Cipher suite set to %s",
                   (const char *)_cipherSuite.getCString()));
           }
       }
   
     //     //
     // set overall SSL Context flags     // set overall SSL Context flags
     //     //
Line 847 
Line 760 
     SSL_CTX_set_mode(sslContext, SSL_MODE_ENABLE_PARTIAL_WRITE);     SSL_CTX_set_mode(sslContext, SSL_MODE_ENABLE_PARTIAL_WRITE);
     SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF);     SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF);
  
   #ifdef SSL_MODE_RELEASE_BUFFERS
       // Keep memory usage as low as possible
       SSL_CTX_set_mode (sslContext, SSL_MODE_RELEASE_BUFFERS);
   #endif
   
     int options = SSL_OP_ALL;     int options = SSL_OP_ALL;
 #ifndef PEGASUS_ENABLE_SSLV2 //SSLv2 is disabled by default #ifndef PEGASUS_ENABLE_SSLV2 //SSLv2 is disabled by default
     options |= SSL_OP_NO_SSLv2;     options |= SSL_OP_NO_SSLv2;
Line 865 
Line 783 
  
         if (_certificateVerifyFunction != NULL)         if (_certificateVerifyFunction != NULL)
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                 "---> SSL: certificate verification callback specified");                 "---> SSL: certificate verification callback specified");
             SSL_CTX_set_verify(sslContext,             SSL_CTX_set_verify(sslContext,
                 SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback);                 SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback);
         }         }
         else         else
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                 "---> SSL: Trust Store specified");                 "---> SSL: Trust Store specified");
             SSL_CTX_set_verify(sslContext,             SSL_CTX_set_verify(sslContext,
                 SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE |                 SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE |
Line 882 
Line 800 
     }     }
     else     else
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,          PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
             "---> SSL: Trust Store and certificate verification callback "             "---> SSL: Trust Store and certificate verification callback "
                 "are NOT specified");                 "are NOT specified");
         SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL);         SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL);
Line 905 
Line 823 
         //         //
         if (FileSystem::isDirectory(_trustStore))         if (FileSystem::isDirectory(_trustStore))
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                             "---> SSL: Truststore is a directory");                             "---> SSL: Truststore is a directory");
             //             //
             // load certificates from the trust store             // load certificates from the trust store
             //             //
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,              PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
                 "---> SSL: Loading certificates from the trust store: " +                  "---> SSL: Loading certificates from the trust store: %s",
                     _trustStore);                  (const char*)_trustStore.getCString()));
  
             if ((!SSL_CTX_load_verify_locations(             if ((!SSL_CTX_load_verify_locations(
                      sslContext, NULL, _trustStore.getCString())) ||                      sslContext, NULL, _trustStore.getCString())) ||
                 (!SSL_CTX_set_default_verify_paths(sslContext)))                 (!SSL_CTX_set_default_verify_paths(sslContext)))
             {             {
                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,                  PEG_TRACE((TRC_SSL, Tracer::LEVEL1,
                     "---> SSL: Could not load certificates from the trust "                      "---> SSL: Could not load certificates from the "
                         "store: " + _trustStore);                      "trust store: %s ",(const char*)_trustStore.getCString()));
                 MessageLoaderParms parms(                 MessageLoaderParms parms(
                     "Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",                     "Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",
                     "Could not load certificates in to trust store.");                     "Could not load certificates in to trust store.");
Line 931 
Line 849 
         }         }
         else if (FileSystem::exists(_trustStore))         else if (FileSystem::exists(_trustStore))
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                 "---> SSL: Truststore is a file");                 "---> SSL: Truststore is a file");
             //             //
             // Get size of the trust store file:             // Get size of the trust store file:
Line 945 
Line 863 
                 //                 //
                 // load certificates from the trust store                 // load certificates from the trust store
                 //                 //
                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,                  PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
                     "---> SSL: Loading certificates from the trust store: " +                      "---> SSL: Loading certificates from the trust store: %s",
                         _trustStore);                      (const char*)_trustStore.getCString()));
  
                 if ((!SSL_CTX_load_verify_locations(                 if ((!SSL_CTX_load_verify_locations(
                          sslContext, _trustStore.getCString(), NULL)) ||                          sslContext, _trustStore.getCString(), NULL)) ||
                     (!SSL_CTX_set_default_verify_paths(sslContext)))                     (!SSL_CTX_set_default_verify_paths(sslContext)))
                 {                 {
                     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,                      PEG_TRACE((TRC_SSL, Tracer::LEVEL1,
                         "---> SSL: Could not load certificates from the "                         "---> SSL: Could not load certificates from the "
                             "trust store: " + _trustStore);                          "trust store: %s",
                           (const char*)_trustStore.getCString()));
                     MessageLoaderParms parms(                     MessageLoaderParms parms(
                         "Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",                         "Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",
                         "Could not load certificates in to trust store.");                         "Could not load certificates in to trust store.");
Line 968 
Line 887 
                 //                 //
                 // no certificates found in the trust store                 // no certificates found in the trust store
                 //                 //
                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,                  PEG_TRACE((TRC_SSL, Tracer::LEVEL2,
                     "---> SSL: No certificates to load from the trust "                      "---> SSL: No certificates to load from the "
                         "store: " + _trustStore);                      "trust store: %s",(const char*)_trustStore.getCString()));
             }             }
         }         }
     }     }
Line 981 
Line 900 
         // one CRL for cimserver?         // one CRL for cimserver?
         X509_LOOKUP* pLookup;         X509_LOOKUP* pLookup;
  
         _crlStore = X509_STORE_new();          _crlStore.reset(X509_STORE_new());
           if (_crlStore.get() == NULL)
           {
               PEG_METHOD_EXIT();
               throw PEGASUS_STD(bad_alloc)();
           }
  
         // the validity of the crlstore was checked in ConfigManager         // the validity of the crlstore was checked in ConfigManager
         // during server startup         // during server startup
         if (FileSystem::isDirectory(_crlPath))         if (FileSystem::isDirectory(_crlPath))
         {         {
             Tracer::trace(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
                 "---> SSL: CRL store is a directory in %s",                 "---> SSL: CRL store is a directory in %s",
                 (const char*)_crlPath.getCString());                  (const char*)_crlPath.getCString()));
  
             if ((pLookup = X509_STORE_add_lookup(             if ((pLookup = X509_STORE_add_lookup(
                      _crlStore, X509_LOOKUP_hash_dir())) == NULL)                       _crlStore.get(), X509_LOOKUP_hash_dir())) == NULL)
             {             {
                 MessageLoaderParms parms(                 MessageLoaderParms parms(
                     "Common.SSLContext.COULD_NOT_LOAD_CRLS",                     "Common.SSLContext.COULD_NOT_LOAD_CRLS",
                     "Could not load certificate revocation list.");                     "Could not load certificate revocation list.");
                 X509_STORE_free(_crlStore);                  _crlStore.reset();
                 PEG_METHOD_EXIT();                 PEG_METHOD_EXIT();
                 throw SSLException(parms);                 throw SSLException(parms);
             }             }
Line 1005 
Line 929 
             X509_LOOKUP_add_dir(             X509_LOOKUP_add_dir(
                 pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);                 pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);
  
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                 "---> SSL: Successfully configured CRL directory");                 "---> SSL: Successfully configured CRL directory");
         }         }
         else         else
         {         {
             Tracer::trace(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
                 "---> SSL: CRL store is the file %s",                 "---> SSL: CRL store is the file %s",
                 (const char*)_crlPath.getCString());                  (const char*)_crlPath.getCString()));
  
             if ((pLookup = X509_STORE_add_lookup(             if ((pLookup = X509_STORE_add_lookup(
                    _crlStore, X509_LOOKUP_file())) == NULL)                     _crlStore.get(), X509_LOOKUP_file())) == NULL)
             {             {
                 MessageLoaderParms parms(                 MessageLoaderParms parms(
                     "Common.SSLContext.COULD_NOT_LOAD_CRLS",                     "Common.SSLContext.COULD_NOT_LOAD_CRLS",
                     "Could not load certificate revocation list.");                     "Could not load certificate revocation list.");
                 X509_STORE_free(_crlStore);                  _crlStore.reset();
                 PEG_METHOD_EXIT();                 PEG_METHOD_EXIT();
                 throw SSLException(parms);                 throw SSLException(parms);
             }             }
Line 1028 
Line 952 
             X509_LOOKUP_load_file(             X509_LOOKUP_load_file(
                 pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);                 pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);
  
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                 "---> SSL: Successfully configured CRL file");                 "---> SSL: Successfully configured CRL file");
         }         }
     }     }
Line 1045 
Line 969 
         //         //
         // load the specified server certificates         // load the specified server certificates
         //         //
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,          PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
             "---> SSL: Loading server certificate from: " + _certPath);              "---> SSL: Loading server certificate from: %s",
               (const char*)_certPath.getCString()));
  
         if (SSL_CTX_use_certificate_file(sslContext,         if (SSL_CTX_use_certificate_file(sslContext,
             _certPath.getCString(), SSL_FILETYPE_PEM) <=0)             _certPath.getCString(), SSL_FILETYPE_PEM) <=0)
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,              PEG_TRACE((TRC_SSL, Tracer::LEVEL1,
                 "---> SSL: No server certificate found in " + _certPath);                  "---> SSL: No server certificate found in %s",
                   (const char*)_certPath.getCString()));
             MessageLoaderParms parms(             MessageLoaderParms parms(
                 "Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE",                  "Common.SSLContext.COULD_NOT_ACCESS_SERVER_CERTIFICATE",
                 "Could not get server certificate.");                  "Could not access server certificate in $0.",
                   (const char*)_certPath.getCString());
             PEG_METHOD_EXIT();             PEG_METHOD_EXIT();
             throw SSLException(parms);             throw SSLException(parms);
         }         }
Line 1069 
Line 996 
         //         //
         if (_keyPath == String::EMPTY)         if (_keyPath == String::EMPTY)
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,              PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
                 "---> SSL: loading private key from: " + _certPath);                  "---> SSL: Key file empty, loading private key from "
                   "certificate file: %s",(const char*)_certPath.getCString()));
             //             //
             // load the private key and check for validity             // load the private key and check for validity
             //             //
Line 1093 
Line 1021 
     //     //
     if (_keyPath != String::EMPTY && !keyLoaded)     if (_keyPath != String::EMPTY && !keyLoaded)
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,          PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
             "---> SSL: loading private key from: " + _keyPath);              "---> SSL: loading private key from: %s",
               (const char*)_keyPath.getCString()));
         //         //
         // load given private key and check for validity         // load given private key and check for validity
         //         //
Line 1117 
Line 1046 
 { {
     PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()");     PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()");
  
     if (SSL_CTX_use_PrivateKey_file(      // Open the private key file.
             ctx, keyPath.getCString(), SSL_FILETYPE_PEM) <= 0)  
       FILE* is = Executor::openFile(keyPath.getCString(), 'r');
   
       if (!is)
       {
           PEG_TRACE((TRC_SSL, Tracer::LEVEL1,
               "---> SSL: failed to open private key file: %s",
               (const char*)keyPath.getCString()));
           return false;
       }
   
       // Read the private key from the input stream.
   
       EVP_PKEY* pkey;
       pkey = PEM_read_PrivateKey(is, NULL, NULL, NULL);
   
       if (!pkey)
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,          PEG_TRACE_CSTRING(
             "---> SSL: no private key found in " + String(keyPath));              TRC_SSL, Tracer::LEVEL1, "---> SSL: failed to create private key");
           return false;
       }
   
       // Close the input stream.
   
       fclose(is);
   
       // Associate the new private key with the SSL context object.
   
       if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0)
       {
           EVP_PKEY_free(pkey);
           PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
               "---> SSL: no private key found in %s",
               (const char*)keyPath.getCString()));
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         return false;         return false;
     }     }
  
       EVP_PKEY_free(pkey);
   
       // Check private key for validity.
   
     if (!SSL_CTX_check_private_key(ctx))     if (!SSL_CTX_check_private_key(ctx))
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,          PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1,
             "---> SSL: Private and public key do not match");             "---> SSL: Private and public key do not match");
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         return false;         return false;
Line 1165 
Line 1129 
 } }
 #endif #endif
  
   String SSLContextRep::getCipherSuite() const
   {
       return _cipherSuite;
   }
   
 String SSLContextRep::getCRLPath() const String SSLContextRep::getCRLPath() const
 { {
     return _crlPath;     return _crlPath;
 } }
  
 X509_STORE* SSLContextRep::getCRLStore() const  SharedPtr<X509_STORE, FreeX509STOREPtr> SSLContextRep::getCRLStore() const
 { {
     return _crlStore;     return _crlStore;
 } }
  
 void SSLContextRep::setCRLStore(X509_STORE* store) void SSLContextRep::setCRLStore(X509_STORE* store)
 { {
     _crlStore = store;      _crlStore.reset(store);
 } }
  
 Boolean SSLContextRep::isPeerVerificationEnabled() const Boolean SSLContextRep::isPeerVerificationEnabled() const
Line 1191 
Line 1160 
     return _certificateVerifyFunction;     return _certificateVerifyFunction;
 } }
  
   void SSLContextRep::validateCertificate()
   {
       BIO* in = BIO_new_file(_certPath.getCString(), "r");
       PEGASUS_ASSERT(in != NULL);
       X509* cert = PEM_read_bio_X509(in, NULL, 0, NULL);
       BIO_free(in);
       PEGASUS_ASSERT(cert != NULL);
   
       if (X509_cmp_current_time(X509_get_notBefore(cert)) > 0)
       {
           X509_free(cert);
           MessageLoaderParms parms(
              "Common.SSLContext.CERTIFICATE_NOT_YET_VALID",
              "Certificate $0 is not yet valid.",
              _certPath);
           throw SSLException(parms);
       }
   
       if (X509_cmp_current_time(X509_get_notAfter(cert)) < 0)
       {
           X509_free(cert);
           MessageLoaderParms parms(
              "Common.SSLContext.CERTIFICATE_EXPIRED",
              "Certificate $0 has expired.",
              _certPath);
           throw SSLException(parms);
       }
   
       X509_free(cert);
   }
   
 #else #else
  
 // //
Line 1198 
Line 1198 
 // //
  
 SSLContextRep::SSLContextRep( SSLContextRep::SSLContextRep(
     const String& trustStore,      const String&,
     const String& certPath,      const String&,
     const String& keyPath,      const String&,
     const String& crlPath,      const String&,
     SSLCertificateVerifyFunction* verifyCert,      SSLCertificateVerifyFunction*,
     const String& randomFile)      const String&,
       const String&)
 { {
 } }
  
 SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {}  SSLContextRep::SSLContextRep(const SSLContextRep&) {}
  
 SSLContextRep::~SSLContextRep() {} SSLContextRep::~SSLContextRep() {}
  
 SSL_CTX* SSLContextRep::_makeSSLContext() { return 0; } SSL_CTX* SSLContextRep::_makeSSLContext() { return 0; }
  
 Boolean SSLContextRep::_verifyPrivateKey( Boolean SSLContextRep::_verifyPrivateKey(
     SSL_CTX *ctx,      SSL_CTX*,
     const String& keyPath)      const String&)
 { {
     return false;     return false;
 } }
Line 1228 
Line 1229 
  
 String SSLContextRep::getKeyPath() const { return String::EMPTY; } String SSLContextRep::getKeyPath() const { return String::EMPTY; }
  
   String SSLContextRep::getCipherSuite() const { return String::EMPTY; }
   
 #ifdef PEGASUS_USE_DEPRECATED_INTERFACES #ifdef PEGASUS_USE_DEPRECATED_INTERFACES
 String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; } String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; }
 #endif #endif
  
 String SSLContextRep::getCRLPath() const { return String::EMPTY; } String SSLContextRep::getCRLPath() const { return String::EMPTY; }
  
 X509_STORE* SSLContextRep::getCRLStore() const { return NULL; }  SharedPtr<X509_STORE, FreeX509STOREPtr> SSLContextRep::getCRLStore() const
   {
       return SharedPtr<X509_STORE, FreeX509STOREPtr>();
   }
  
 void SSLContextRep::setCRLStore(X509_STORE* store) { }  void SSLContextRep::setCRLStore(X509_STORE*) { }
  
 Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; }
  
Line 1246 
Line 1252 
     return NULL;     return NULL;
 } }
  
 void SSLContextRep::init_ssl() {}  void SSLContextRep::validateCertificate() { }
   
 void SSLContextRep::free_ssl() {}  
  
 #endif // end of PEGASUS_HAS_SSL #endif // end of PEGASUS_HAS_SSL
  
Line 1270 
Line 1274 
         String::EMPTY,         String::EMPTY,
         String::EMPTY,         String::EMPTY,
         verifyCert,         verifyCert,
         randomFile);          randomFile,
           String::EMPTY);
 } }
  
 SSLContext::SSLContext( SSLContext::SSLContext(
Line 1306 
Line 1311 
         trustStore, certPath, keyPath, crlPath, verifyCert, randomFile);         trustStore, certPath, keyPath, crlPath, verifyCert, randomFile);
 } }
  
   #ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES
   SSLContext::SSLContext(
           const String& trustStore,
           const String& certPath,
           const String& keyPath,
           const String& crlPath,
           SSLCertificateVerifyFunction* verifyCert,
           const String& randomFile,
           const String& cipherSuite)
   {
   #ifndef PEGASUS_ENABLE_SSL_CRL_VERIFICATION
       if (crlPath.size() > 0)
       {
           MessageLoaderParms parms(
               "Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",
               "SSL CRL verification is not enabled.");
           throw Exception(parms);
       }
   #endif
       _rep = new SSLContextRep(
           trustStore, certPath, keyPath, crlPath, verifyCert, randomFile,
           cipherSuite);
   }
   #endif
   
 #ifdef PEGASUS_USE_DEPRECATED_INTERFACES #ifdef PEGASUS_USE_DEPRECATED_INTERFACES
 SSLContext::SSLContext( SSLContext::SSLContext(
     const String& trustStore,     const String& trustStore,
     const String& certPath,     const String& certPath,
     const String& keyPath,     const String& keyPath,
     SSLCertificateVerifyFunction* verifyCert,     SSLCertificateVerifyFunction* verifyCert,
     String trustStoreUserName,      String,
     const String& randomFile)     const String& randomFile)
 { {
     _rep = new SSLContextRep(     _rep = new SSLContextRep(
Line 1359 
Line 1389 
         "Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",         "Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",
         "SSL CRL verification is not enabled.");         "SSL CRL verification is not enabled.");
     throw Exception(parms);     throw Exception(parms);
       PEGASUS_UNREACHABLE(return String::EMPTY;)
 #endif #endif
 } }
  
 X509_STORE* SSLContext::getCRLStore() const X509_STORE* SSLContext::getCRLStore() const
 { {
 #ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION #ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION
     return _rep->getCRLStore();      return _rep->getCRLStore().get();
 #else #else
     MessageLoaderParms parms(     MessageLoaderParms parms(
         "Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",         "Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",
         "SSL CRL verification is not enabled.");         "SSL CRL verification is not enabled.");
     throw Exception(parms);     throw Exception(parms);
       PEGASUS_UNREACHABLE(return 0;)
 #endif #endif
 } }
  
Line 1386 
Line 1418 
 } }
 #endif #endif
  
   #ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES
   String SSLContext::getCipherSuite() const
   {
       return _rep->getCipherSuite();
   }
   #endif
   
 SSLCertificateVerifyFunction* SSLCertificateVerifyFunction*
     SSLContext::getSSLCertificateVerifyFunction() const     SSLContext::getSSLCertificateVerifyFunction() const
 { {
     return _rep->getSSLCertificateVerifyFunction();     return _rep->getSSLCertificateVerifyFunction();
 } }
  
   void SSLContext::_validateCertificate()
   {
       _rep->validateCertificate();
   }
   
 /////////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////////
 // //
 // SSLCertificateInfo // SSLCertificateInfo
Line 1436 
Line 1480 
  
 const int    SSLCertificateInfo::V_ERR_APPLICATION_VERIFICATION            = 50; const int    SSLCertificateInfo::V_ERR_APPLICATION_VERIFICATION            = 50;
  
 class SSLCertificateInfoRep  
 {  
 public:  
     String    subjectName;  
     String    issuerName;  
     Uint32    depth;  
     Uint32    errorCode;  
     Uint32    respCode;  
     String    errorString;  
     Uint32    versionNumber;  
     long      serialNumber;  
     CIMDateTime    notBefore;  
     CIMDateTime    notAfter;  
 };  
   
   
 SSLCertificateInfo::SSLCertificateInfo( SSLCertificateInfo::SSLCertificateInfo(
     const String subjectName,     const String subjectName,
     const String issuerName,     const String issuerName,
Line 1511 
Line 1539 
     _rep->errorCode = certificateInfo._rep->errorCode;     _rep->errorCode = certificateInfo._rep->errorCode;
     _rep->errorString = certificateInfo._rep->errorString;     _rep->errorString = certificateInfo._rep->errorString;
     _rep->respCode = certificateInfo._rep->respCode;     _rep->respCode = certificateInfo._rep->respCode;
   #ifdef  PEGASUS_USE_EXPERIMENTAL_INTERFACES
       _rep->peerCertificate = certificateInfo._rep->peerCertificate;
   #endif
 } }
  
 // Dummy constructor made private to disallow default construction // Dummy constructor made private to disallow default construction
Line 1583 
Line 1614 
     _rep->respCode = respCode;     _rep->respCode = respCode;
 } }
  
   #ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES
   const String &SSLCertificateInfo::getPeerCertificate() const
   {
       return _rep->peerCertificate;
   }
   #endif
   
 String SSLCertificateInfo::toString() const String SSLCertificateInfo::toString() const
 { {
     char buf[1024];     char buf[1024];
Line 1597 
Line 1635 
     s.append(_rep->issuerName);     s.append(_rep->issuerName);
     s.append("\n");     s.append("\n");
  
     sprintf(buf, "Depth: %d\n", _rep->depth);      sprintf(buf, "Depth: %u\n", _rep->depth);
     s.append(buf);     s.append(buf);
  
     sprintf(buf, "Error code: %d\n", _rep->errorCode);      sprintf(buf, "Error code: %u\n", _rep->errorCode);
     s.append(buf);     s.append(buf);
  
     sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode);      sprintf(buf, "Response (preverify) code: %u\n", _rep->respCode);
     s.append(buf);     s.append(buf);
  
     s.append("Error string: ");     s.append("Error string: ");
     s.append(_rep->errorString);     s.append(_rep->errorString);
     s.append("\n");     s.append("\n");
  
     sprintf(buf, "Version number: %d\n", _rep->versionNumber);      sprintf(buf, "Version number: %u\n", _rep->versionNumber);
     s.append(buf);     s.append(buf);
  
     sprintf(buf, "Serial number: %lu\n", _rep->serialNumber);      sprintf(buf, "Serial number: %lu\n", (unsigned long)_rep->serialNumber);
     s.append(buf);     s.append(buf);
  
     s.append("Not before date: ");     s.append("Not before date: ");
Line 1649 
Line 1687 
     _rep->crlStore = crlStore;     _rep->crlStore = crlStore;
 } }
  
   SSLCallbackInfo::SSLCallbackInfo(
       SSLCertificateVerifyFunction* verifyCert,
       X509_STORE* crlStore,
       String ipAddress)
   {
       _rep = new SSLCallbackInfoRep();
       _rep->verifyCertificateCallback = verifyCert;
       _rep->crlStore = crlStore;
       _rep->ipAddress = ipAddress;
   }
   
 SSLCallbackInfo::~SSLCallbackInfo() SSLCallbackInfo::~SSLCallbackInfo()
 { {
     PEG_METHOD_ENTER(TRC_SSL, "SSLCallbackInfo::~SSLCallbackInfo");     PEG_METHOD_ENTER(TRC_SSL, "SSLCallbackInfo::~SSLCallbackInfo");

Legend:
Removed from v.1.75  
changed lines
  Added in v.1.115
No CVS admin address has been configured
 Powered by
ViewCVS 0.9.2