version 1.99, 2008/06/23 19:46:35
|
version 1.115, 2013/03/19 17:00:55
|
|
|
//%2006//////////////////////////////////////////////////////////////////////// |
//%LICENSE//////////////////////////////////////////////////////////////// |
// | // |
// Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development |
// Licensed to The Open Group (TOG) under one or more contributor license |
// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems. |
// agreements. Refer to the OpenPegasusNOTICE.txt file distributed with |
// Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L.P.; |
// this work for additional information regarding copyright ownership. |
// IBM Corp.; EMC Corporation, The Open Group. |
// Each contributor licenses this file to you under the OpenPegasus Open |
// Copyright (c) 2004 BMC Software; Hewlett-Packard Development Company, L.P.; |
// Source License; you may not use this file except in compliance with the |
// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group. |
// License. |
// Copyright (c) 2005 Hewlett-Packard Development Company, L.P.; IBM Corp.; |
// |
// EMC Corporation; VERITAS Software Corporation; The Open Group. |
// Permission is hereby granted, free of charge, to any person obtaining a |
// Copyright (c) 2006 Hewlett-Packard Development Company, L.P.; IBM Corp.; |
// copy of this software and associated documentation files (the "Software"), |
// EMC Corporation; Symantec Corporation; The Open Group. |
// to deal in the Software without restriction, including without limitation |
// |
// the rights to use, copy, modify, merge, publish, distribute, sublicense, |
// Permission is hereby granted, free of charge, to any person obtaining a copy |
// and/or sell copies of the Software, and to permit persons to whom the |
// of this software and associated documentation files (the "Software"), to |
// Software is furnished to do so, subject to the following conditions: |
// deal in the Software without restriction, including without limitation the |
// |
// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or |
// The above copyright notice and this permission notice shall be included |
// sell copies of the Software, and to permit persons to whom the Software is |
// in all copies or substantial portions of the Software. |
// furnished to do so, subject to the following conditions: |
// |
// |
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS |
// THE ABOVE COPYRIGHT NOTICE AND THIS PERMISSION NOTICE SHALL BE INCLUDED IN |
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
// ALL COPIES OR SUBSTANTIAL PORTIONS OF THE SOFTWARE. THE SOFTWARE IS PROVIDED |
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. |
// "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT |
// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY |
// LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR |
// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, |
// PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT |
// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE |
// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN |
// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION |
|
// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
|
// | // |
//============================================================================== |
////////////////////////////////////////////////////////////////////////// |
// | // |
//%///////////////////////////////////////////////////////////////////////////// | //%///////////////////////////////////////////////////////////////////////////// |
| |
|
|
| |
typedef struct x509_store_ctx_st X509_STORE_CTX; | typedef struct x509_store_ctx_st X509_STORE_CTX; |
| |
typedef struct Timestamp |
|
{ |
|
char year[4]; |
|
char month[2]; |
|
char day[2]; |
|
char hour[2]; |
|
char minutes[2]; |
|
char seconds[2]; |
|
char dot; |
|
char microSeconds[6]; |
|
char plusOrMinus; |
|
char utcOffset[3]; |
|
char padding[3]; |
|
} Timestamp_t; |
|
|
|
PEGASUS_USING_STD; | PEGASUS_USING_STD; |
| |
PEGASUS_NAMESPACE_BEGIN | PEGASUS_NAMESPACE_BEGIN |
| |
const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0; | const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0; |
| |
|
class SSLCertificateInfoRep |
|
{ |
|
public: |
|
String subjectName; |
|
String issuerName; |
|
Uint32 depth; |
|
Uint32 errorCode; |
|
Uint32 respCode; |
|
String errorString; |
|
Uint32 versionNumber; |
|
long serialNumber; |
|
CIMDateTime notBefore; |
|
CIMDateTime notAfter; |
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
String peerCertificate; |
|
#endif |
|
}; |
|
|
// | // |
// use the following definitions only if SSL is available | // use the following definitions only if SSL is available |
// | // |
|
|
{ | { |
struct tm time; | struct tm time; |
int offset; | int offset; |
Timestamp_t timeStamp; |
|
char tempString[80]; |
|
char plusOrMinus = '+'; | char plusOrMinus = '+'; |
unsigned char* utcTimeData = utcTime->data; | unsigned char* utcTimeData = utcTime->data; |
| |
|
|
} | } |
#undef g2 | #undef g2 |
| |
memset((void *)&timeStamp, 0, sizeof(Timestamp_t)); |
|
| |
// Format the date. |
if (plusOrMinus == '-') |
sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d", |
{ |
|
offset = -offset; |
|
} |
|
|
|
CIMDateTime dateTime = CIMDateTime( |
time.tm_year, | time.tm_year, |
time.tm_mon + 1, | time.tm_mon + 1, |
time.tm_mday, | time.tm_mday, |
|
|
time.tm_min, | time.tm_min, |
time.tm_sec, | time.tm_sec, |
0, | 0, |
|
6, |
offset); | offset); |
| |
timeStamp.plusOrMinus = plusOrMinus; |
|
|
|
CIMDateTime dateTime; |
|
|
|
dateTime.clear(); |
|
strcpy(tempString, (char *)&timeStamp); |
|
dateTime.set(tempString); |
|
|
|
return dateTime; | return dateTime; |
} | } |
| |
|
|
// return 1 if revoked, 0 otherwise | // return 1 if revoked, 0 otherwise |
// | // |
int SSLCallback::verificationCRLCallback( | int SSLCallback::verificationCRLCallback( |
int ok, |
int, |
X509_STORE_CTX* ctx, | X509_STORE_CTX* ctx, |
X509_STORE* sslCRLStore) | X509_STORE* sslCRLStore) |
{ | { |
|
|
| |
//check whether the subject's certificate is revoked | //check whether the subject's certificate is revoked |
X509_REVOKED* revokedCert = NULL; | X509_REVOKED* revokedCert = NULL; |
for (int i = 0; i < sk_X509_REVOKED_num(revokedCerts); i++) |
for (int i = 0; i < numRevoked; i++) |
{ | { |
revokedCert = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i); |
revokedCert = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i); |
|
|
//a matching serial number indicates revocation | //a matching serial number indicates revocation |
if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0) | if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0) |
{ | { |
|
|
| |
// insert at the beginning of the array so that the peer certificate is | // insert at the beginning of the array so that the peer certificate is |
// first and the root CA is last | // first and the root CA is last |
exData->_rep->peerCertificate.insert(0, new SSLCertificateInfo( |
SSLCertificateInfo *certInfo = new SSLCertificateInfo( |
subjectName, issuerName, version, serialNumber, |
subjectName, |
notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk)); |
issuerName, |
|
version, |
|
serialNumber, |
|
notBefore, |
|
notAfter, |
|
depth, |
|
errorCode, |
|
errorStr, |
|
preVerifyOk); |
|
|
|
String peerCertificate; |
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
// |
|
// Get Base64 encoded DER (PEM) certificate |
|
// |
|
char *data = 0; |
|
long length = 0; |
|
|
|
BIO *bio = BIO_new(BIO_s_mem()); |
|
if (bio) |
|
{ |
|
if (PEM_write_bio_X509(bio, currentCert) == 0) |
|
{ |
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1, |
|
"PEM converion failed."); |
|
} |
|
else |
|
{ |
|
length = BIO_get_mem_data(bio, &data); |
|
peerCertificate.assign(data, (Uint32)length); |
|
} |
|
BIO_free_all(bio); |
|
} |
|
certInfo->_rep->peerCertificate = peerCertificate; |
|
#endif |
|
|
|
exData->_rep->peerCertificate.insert(0, certInfo); |
|
|
| |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, "Created SSLCertificateInfo"); | PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, "Created SSLCertificateInfo"); |
| |
|
|
const String& keyPath, | const String& keyPath, |
const String& crlPath, | const String& crlPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) |
const String& randomFile, |
|
const String& cipherSuite) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
| |
|
|
_keyPath = keyPath; | _keyPath = keyPath; |
_crlPath = crlPath; | _crlPath = crlPath; |
_certificateVerifyFunction = verifyCert; | _certificateVerifyFunction = verifyCert; |
|
_cipherSuite = cipherSuite; |
| |
// | // |
// If a truststore and/or peer verification function is specified, | // If a truststore and/or peer verification function is specified, |
|
|
_verifyPeer = sslContextRep._verifyPeer; | _verifyPeer = sslContextRep._verifyPeer; |
_certificateVerifyFunction = sslContextRep._certificateVerifyFunction; | _certificateVerifyFunction = sslContextRep._certificateVerifyFunction; |
_randomFile = sslContextRep._randomFile; | _randomFile = sslContextRep._randomFile; |
|
_cipherSuite = sslContextRep._cipherSuite; |
| |
_sslContext = _makeSSLContext(); | _sslContext = _makeSSLContext(); |
| |
|
|
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_randomInit()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_randomInit()"); |
| |
Boolean ret; |
|
int retVal = 0; |
|
| |
#if defined(PEGASUS_SSL_RANDOMFILE) && !defined(PEGASUS_OS_PASE) | #if defined(PEGASUS_SSL_RANDOMFILE) && !defined(PEGASUS_OS_PASE) |
if ( RAND_status() == 0 ) | if ( RAND_status() == 0 ) |
|
|
// | // |
// Try the given random seed file | // Try the given random seed file |
// | // |
ret = FileSystem::exists(randomFile); |
Boolean ret = FileSystem::exists(randomFile); |
if (ret) | if (ret) |
{ | { |
retVal = RAND_load_file(randomFile.getCString(), -1); |
int retVal = RAND_load_file(randomFile.getCString(), -1); |
if ( retVal < 0 ) | if ( retVal < 0 ) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
String("Not enough seed data in seed file: ") + randomFile); |
"Not enough seed data in seed file: %s", |
|
(const char*)randomFile.getCString())); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
// do not put in $0 in default message, but pass in filename | // do not put in $0 in default message, but pass in filename |
// for bundle message | // for bundle message |
|
|
} | } |
else | else |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
String("seed file - " + randomFile + " does not exist.")); |
"Seed file \'%s\' does not exist.", |
|
(const char*)randomFile.getCString())); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
MessageLoaderParms parms( | MessageLoaderParms parms( |
"Common.SSLContext.SEED_FILE_DOES_NOT_EXIST", | "Common.SSLContext.SEED_FILE_DOES_NOT_EXIST", |
|
|
#ifdef PEGASUS_SSL_WEAKENCRYPTION | #ifdef PEGASUS_SSL_WEAKENCRYPTION |
if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40))) | if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40))) |
{ | { |
|
SSL_CTX_free(sslContext); |
|
|
MessageLoaderParms parms( | MessageLoaderParms parms( |
"Common.SSLContext.COULD_NOT_SET_CIPHER_LIST", | "Common.SSLContext.COULD_NOT_SET_CIPHER_LIST", |
"Could not set the cipher list"); | "Could not set the cipher list"); |
|
|
} | } |
#endif | #endif |
| |
|
if (_cipherSuite != String::EMPTY) |
|
{ |
|
if (!(SSL_CTX_set_cipher_list(sslContext, _cipherSuite.getCString()))) |
|
{ |
|
SSL_CTX_free(sslContext); |
|
|
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Cipher Suite could not be specified"); |
|
MessageLoaderParms parms( |
|
"Common.SSLContext.COULD_NOT_SET_CIPHER_LIST", |
|
"Could not set the cipher list"); |
|
throw SSLException(parms); |
|
} |
|
else |
|
{ |
|
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Cipher suite set to %s", |
|
(const char *)_cipherSuite.getCString())); |
|
} |
|
} |
|
|
// | // |
// set overall SSL Context flags | // set overall SSL Context flags |
// | // |
|
|
SSL_CTX_set_mode(sslContext, SSL_MODE_ENABLE_PARTIAL_WRITE); | SSL_CTX_set_mode(sslContext, SSL_MODE_ENABLE_PARTIAL_WRITE); |
SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF); | SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF); |
| |
|
#ifdef SSL_MODE_RELEASE_BUFFERS |
|
// Keep memory usage as low as possible |
|
SSL_CTX_set_mode (sslContext, SSL_MODE_RELEASE_BUFFERS); |
|
#endif |
|
|
int options = SSL_OP_ALL; | int options = SSL_OP_ALL; |
#ifndef PEGASUS_ENABLE_SSLV2 //SSLv2 is disabled by default | #ifndef PEGASUS_ENABLE_SSLV2 //SSLv2 is disabled by default |
options |= SSL_OP_NO_SSLv2; | options |= SSL_OP_NO_SSLv2; |
|
|
// | // |
// load certificates from the trust store | // load certificates from the trust store |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: Loading certificates from the trust store: " + |
"---> SSL: Loading certificates from the trust store: %s", |
_trustStore)); |
(const char*)_trustStore.getCString())); |
| |
if ((!SSL_CTX_load_verify_locations( | if ((!SSL_CTX_load_verify_locations( |
sslContext, NULL, _trustStore.getCString())) || | sslContext, NULL, _trustStore.getCString())) || |
(!SSL_CTX_set_default_verify_paths(sslContext))) | (!SSL_CTX_set_default_verify_paths(sslContext))) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
String("---> SSL: Could not load certificates from the " |
"---> SSL: Could not load certificates from the " |
"trust store: " + _trustStore)); |
"trust store: %s ",(const char*)_trustStore.getCString())); |
MessageLoaderParms parms( | MessageLoaderParms parms( |
"Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", | "Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
"Could not load certificates in to trust store."); | "Could not load certificates in to trust store."); |
|
|
// | // |
// load certificates from the trust store | // load certificates from the trust store |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: Loading certificates from the trust " |
"---> SSL: Loading certificates from the trust store: %s", |
"store: " + _trustStore)); |
(const char*)_trustStore.getCString())); |
| |
if ((!SSL_CTX_load_verify_locations( | if ((!SSL_CTX_load_verify_locations( |
sslContext, _trustStore.getCString(), NULL)) || | sslContext, _trustStore.getCString(), NULL)) || |
(!SSL_CTX_set_default_verify_paths(sslContext))) | (!SSL_CTX_set_default_verify_paths(sslContext))) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
String("---> SSL: Could not load certificates from the " |
"---> SSL: Could not load certificates from the " |
"trust store: " + _trustStore)); |
"trust store: %s", |
|
(const char*)_trustStore.getCString())); |
MessageLoaderParms parms( | MessageLoaderParms parms( |
"Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", | "Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
"Could not load certificates in to trust store."); | "Could not load certificates in to trust store."); |
|
|
// | // |
// no certificates found in the trust store | // no certificates found in the trust store |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL2, |
String("---> SSL: No certificates to load from the trust " |
"---> SSL: No certificates to load from the " |
"store: " + _trustStore)); |
"trust store: %s",(const char*)_trustStore.getCString())); |
} | } |
} | } |
} | } |
|
|
// | // |
// load the specified server certificates | // load the specified server certificates |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: Loading server certificate from: " + _certPath)); |
"---> SSL: Loading server certificate from: %s", |
|
(const char*)_certPath.getCString())); |
| |
if (SSL_CTX_use_certificate_file(sslContext, | if (SSL_CTX_use_certificate_file(sslContext, |
_certPath.getCString(), SSL_FILETYPE_PEM) <=0) | _certPath.getCString(), SSL_FILETYPE_PEM) <=0) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
String("---> SSL: No server certificate found in " + |
"---> SSL: No server certificate found in %s", |
_certPath)); |
(const char*)_certPath.getCString())); |
MessageLoaderParms parms( | MessageLoaderParms parms( |
"Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE", |
"Common.SSLContext.COULD_NOT_ACCESS_SERVER_CERTIFICATE", |
"Could not get server certificate."); |
"Could not access server certificate in $0.", |
|
(const char*)_certPath.getCString()); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
|
|
// | // |
if (_keyPath == String::EMPTY) | if (_keyPath == String::EMPTY) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: loading private key from: " + _certPath)); |
"---> SSL: Key file empty, loading private key from " |
|
"certificate file: %s",(const char*)_certPath.getCString())); |
// | // |
// load the private key and check for validity | // load the private key and check for validity |
// | // |
|
|
// | // |
if (_keyPath != String::EMPTY && !keyLoaded) | if (_keyPath != String::EMPTY && !keyLoaded) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: loading private key from: " + _keyPath)); |
"---> SSL: loading private key from: %s", |
|
(const char*)_keyPath.getCString())); |
// | // |
// load given private key and check for validity | // load given private key and check for validity |
// | // |
|
|
| |
if (!is) | if (!is) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
String("failed to open private key file: " + keyPath)); |
"---> SSL: failed to open private key file: %s", |
|
(const char*)keyPath.getCString())); |
return false; | return false; |
} | } |
| |
|
|
if (!pkey) | if (!pkey) |
{ | { |
PEG_TRACE_CSTRING( | PEG_TRACE_CSTRING( |
TRC_SSL, Tracer::LEVEL1, "failed to create private key"); |
TRC_SSL, Tracer::LEVEL1, "---> SSL: failed to create private key"); |
return false; | return false; |
} | } |
| |
|
|
if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) | if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) |
{ | { |
EVP_PKEY_free(pkey); | EVP_PKEY_free(pkey); |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: no private key found in " + keyPath)); |
"---> SSL: no private key found in %s", |
|
(const char*)keyPath.getCString())); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return false; | return false; |
} | } |
|
|
} | } |
#endif | #endif |
| |
|
String SSLContextRep::getCipherSuite() const |
|
{ |
|
return _cipherSuite; |
|
} |
|
|
String SSLContextRep::getCRLPath() const | String SSLContextRep::getCRLPath() const |
{ | { |
return _crlPath; | return _crlPath; |
|
|
// | // |
| |
SSLContextRep::SSLContextRep( | SSLContextRep::SSLContextRep( |
const String& trustStore, |
const String&, |
const String& certPath, |
const String&, |
const String& keyPath, |
const String&, |
const String& crlPath, |
const String&, |
SSLCertificateVerifyFunction* verifyCert, |
SSLCertificateVerifyFunction*, |
const String& randomFile) |
const String&, |
|
const String&) |
{ | { |
} | } |
| |
SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {} |
SSLContextRep::SSLContextRep(const SSLContextRep&) {} |
| |
SSLContextRep::~SSLContextRep() {} | SSLContextRep::~SSLContextRep() {} |
| |
SSL_CTX* SSLContextRep::_makeSSLContext() { return 0; } | SSL_CTX* SSLContextRep::_makeSSLContext() { return 0; } |
| |
Boolean SSLContextRep::_verifyPrivateKey( | Boolean SSLContextRep::_verifyPrivateKey( |
SSL_CTX *ctx, |
SSL_CTX*, |
const String& keyPath) |
const String&) |
{ | { |
return false; | return false; |
} | } |
|
|
| |
String SSLContextRep::getKeyPath() const { return String::EMPTY; } | String SSLContextRep::getKeyPath() const { return String::EMPTY; } |
| |
|
String SSLContextRep::getCipherSuite() const { return String::EMPTY; } |
|
|
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES | #ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; } | String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; } |
#endif | #endif |
|
|
return SharedPtr<X509_STORE, FreeX509STOREPtr>(); | return SharedPtr<X509_STORE, FreeX509STOREPtr>(); |
} | } |
| |
void SSLContextRep::setCRLStore(X509_STORE* store) { } |
void SSLContextRep::setCRLStore(X509_STORE*) { } |
| |
Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } | Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } |
| |
|
|
String::EMPTY, | String::EMPTY, |
String::EMPTY, | String::EMPTY, |
verifyCert, | verifyCert, |
randomFile); |
randomFile, |
|
String::EMPTY); |
} | } |
| |
SSLContext::SSLContext( | SSLContext::SSLContext( |
|
|
trustStore, certPath, keyPath, crlPath, verifyCert, randomFile); | trustStore, certPath, keyPath, crlPath, verifyCert, randomFile); |
} | } |
| |
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
SSLContext::SSLContext( |
|
const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
const String& crlPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile, |
|
const String& cipherSuite) |
|
{ |
|
#ifndef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
|
if (crlPath.size() > 0) |
|
{ |
|
MessageLoaderParms parms( |
|
"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", |
|
"SSL CRL verification is not enabled."); |
|
throw Exception(parms); |
|
} |
|
#endif |
|
_rep = new SSLContextRep( |
|
trustStore, certPath, keyPath, crlPath, verifyCert, randomFile, |
|
cipherSuite); |
|
} |
|
#endif |
|
|
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES | #ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
SSLContext::SSLContext( | SSLContext::SSLContext( |
const String& trustStore, | const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
String trustStoreUserName, |
String, |
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep( | _rep = new SSLContextRep( |
|
|
} | } |
#endif | #endif |
| |
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
String SSLContext::getCipherSuite() const |
|
{ |
|
return _rep->getCipherSuite(); |
|
} |
|
#endif |
|
|
SSLCertificateVerifyFunction* | SSLCertificateVerifyFunction* |
SSLContext::getSSLCertificateVerifyFunction() const | SSLContext::getSSLCertificateVerifyFunction() const |
{ | { |
|
|
| |
const int SSLCertificateInfo::V_ERR_APPLICATION_VERIFICATION = 50; | const int SSLCertificateInfo::V_ERR_APPLICATION_VERIFICATION = 50; |
| |
class SSLCertificateInfoRep |
|
{ |
|
public: |
|
String subjectName; |
|
String issuerName; |
|
Uint32 depth; |
|
Uint32 errorCode; |
|
Uint32 respCode; |
|
String errorString; |
|
Uint32 versionNumber; |
|
long serialNumber; |
|
CIMDateTime notBefore; |
|
CIMDateTime notAfter; |
|
}; |
|
|
|
|
|
SSLCertificateInfo::SSLCertificateInfo( | SSLCertificateInfo::SSLCertificateInfo( |
const String subjectName, | const String subjectName, |
const String issuerName, | const String issuerName, |
|
|
_rep->errorCode = certificateInfo._rep->errorCode; | _rep->errorCode = certificateInfo._rep->errorCode; |
_rep->errorString = certificateInfo._rep->errorString; | _rep->errorString = certificateInfo._rep->errorString; |
_rep->respCode = certificateInfo._rep->respCode; | _rep->respCode = certificateInfo._rep->respCode; |
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
_rep->peerCertificate = certificateInfo._rep->peerCertificate; |
|
#endif |
} | } |
| |
// Dummy constructor made private to disallow default construction | // Dummy constructor made private to disallow default construction |
|
|
_rep->respCode = respCode; | _rep->respCode = respCode; |
} | } |
| |
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
const String &SSLCertificateInfo::getPeerCertificate() const |
|
{ |
|
return _rep->peerCertificate; |
|
} |
|
#endif |
|
|
String SSLCertificateInfo::toString() const | String SSLCertificateInfo::toString() const |
{ | { |
char buf[1024]; | char buf[1024]; |
|
|
s.append(_rep->issuerName); | s.append(_rep->issuerName); |
s.append("\n"); | s.append("\n"); |
| |
sprintf(buf, "Depth: %d\n", _rep->depth); |
sprintf(buf, "Depth: %u\n", _rep->depth); |
s.append(buf); | s.append(buf); |
| |
sprintf(buf, "Error code: %d\n", _rep->errorCode); |
sprintf(buf, "Error code: %u\n", _rep->errorCode); |
s.append(buf); | s.append(buf); |
| |
sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode); |
sprintf(buf, "Response (preverify) code: %u\n", _rep->respCode); |
s.append(buf); | s.append(buf); |
| |
s.append("Error string: "); | s.append("Error string: "); |
s.append(_rep->errorString); | s.append(_rep->errorString); |
s.append("\n"); | s.append("\n"); |
| |
sprintf(buf, "Version number: %d\n", _rep->versionNumber); |
sprintf(buf, "Version number: %u\n", _rep->versionNumber); |
s.append(buf); | s.append(buf); |
| |
sprintf(buf, "Serial number: %lu\n", _rep->serialNumber); |
sprintf(buf, "Serial number: %lu\n", (unsigned long)_rep->serialNumber); |
s.append(buf); | s.append(buf); |
| |
s.append("Not before date: "); | s.append("Not before date: "); |