version 1.24, 2003/11/11 19:34:24
|
version 1.31, 2004/06/30 15:09:53
|
|
|
// | // |
// Modified By: Nag Boranna, Hewlett-Packard Company (nagaraja_boranna@hp.com) | // Modified By: Nag Boranna, Hewlett-Packard Company (nagaraja_boranna@hp.com) |
// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com) | // Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com) |
// Sushma Fernandes, |
// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com) |
// Hewlett-Packard Company (sushma_fernandes@hp.com) |
// Heather Sterling, IBM (hsterl@us.ibm.com) |
// | // |
//%///////////////////////////////////////////////////////////////////////////// | //%///////////////////////////////////////////////////////////////////////////// |
| |
|
|
// | // |
#ifdef PEGASUS_HAS_SSL | #ifdef PEGASUS_HAS_SSL |
| |
// |
|
// certificate handling routine |
|
// |
|
|
|
// ATTN-RK-20020905: This global variable is unsafe with multiple SSL contexts |
|
SSLCertificateVerifyFunction* verify_certificate; |
|
|
|
// Mutex for SSL locks. | // Mutex for SSL locks. |
Mutex* SSLContextRep::_sslLocks = 0; | Mutex* SSLContextRep::_sslLocks = 0; |
| |
|
|
| |
char buf[256]; | char buf[256]; |
X509 *currentCert; | X509 *currentCert; |
|
SSL *ssl; |
int verifyError = X509_V_OK; | int verifyError = X509_V_OK; |
| |
// | // |
|
// get the verification callback info specific to each SSL connection |
|
// |
|
ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); |
|
SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSL_CALLBACK_INDEX); |
|
|
|
// |
|
// If the SSLContext does not have an additional callback |
|
// simply return the preverification error. |
|
// We do not need to go through the additional steps. |
|
// |
|
if (exData->verifyCertificateCallback == NULL) |
|
{ |
|
return (preVerifyOk); |
|
} |
|
|
|
// |
// get the current certificate | // get the current certificate |
// | // |
currentCert = X509_STORE_CTX_get_current_cert(ctx); | currentCert = X509_STORE_CTX_get_current_cert(ctx); |
|
|
// | // |
int depth = X509_STORE_CTX_get_error_depth(ctx); | int depth = X509_STORE_CTX_get_error_depth(ctx); |
| |
//FUTURE: Not sure what to do with these...? |
|
//ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); |
|
//mydata = SSL_get_ex_data(ssl, mydata_index); |
|
|
|
// | // |
// get the version on the certificate | // get the version on the certificate |
// | // |
|
|
} | } |
String issuerName = String(buf); | String issuerName = String(buf); |
| |
// |
// SSLCertificateInfo certInfo(subjectName, issuerName, version, serialNumber, |
// Call the verify_certificate() application callback |
// notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk); |
// |
|
SSLCertificateInfo certInfo(subjectName, issuerName, version, serialNumber, |
exData->_peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber, |
notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk); | notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk); |
| |
if (verify_certificate(certInfo)) |
// |
|
// Call the application callback. |
|
// Note that the verification result does not automatically get set to X509_V_OK if the callback is successful. |
|
// This is because OpenSSL retains the original default error in case we want to use it later. |
|
// To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here. |
|
// |
|
if (exData->verifyCertificateCallback(*exData->_peerCertificate))//certInfo)) |
{ | { |
verifyError = X509_V_OK; |
|
preVerifyOk = 1; |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"--> SSL: verify_certificate() returned X509_V_OK"); |
"--> SSL: verifyCertificateCallback() returned X509_V_OK"); |
|
|
|
PEG_METHOD_EXIT(); |
|
return 1; |
} | } |
else |
else // verification failed, handshake will be immediately terminated |
{ | { |
verifyError = certInfo.getErrorCode(); |
|
preVerifyOk = 0; |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"--> SSL: verify_certificate() returned error %d", verifyError); |
"--> SSL: verifyCertificateCallback() returned error %d", exData->_peerCertificate->getErrorCode()); |
} |
|
|
|
// |
|
// Reset the error. It is logically not required to reset the error code, but |
|
// openSSL code does not take just the return value on a failed certificate |
|
// verification. |
|
// |
|
X509_STORE_CTX_set_error(ctx, verifyError); |
|
| |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
|
return 0; |
return(preVerifyOk); |
} |
} | } |
| |
// | // |
|
|
| |
if ( mode & CRYPTO_LOCK ) | if ( mode & CRYPTO_LOCK ) |
{ | { |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
/*Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Now locking for %d", pegasus_thread_self()); |
"Now locking for %d", pegasus_thread_self());*/ |
SSLContextRep::_sslLocks[type].lock( pegasus_thread_self() ); | SSLContextRep::_sslLocks[type].lock( pegasus_thread_self() ); |
} | } |
else | else |
{ | { |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
/*Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Now unlocking for %d", pegasus_thread_self()); |
"Now unlocking for %d", pegasus_thread_self());*/ |
SSLContextRep::_sslLocks[type].unlock( ); | SSLContextRep::_sslLocks[type].unlock( ); |
} | } |
} | } |
|
|
// For the OSs that don't have /dev/random device file, | // For the OSs that don't have /dev/random device file, |
// must enable PEGASUS_SSL_RANDOMFILE flag. | // must enable PEGASUS_SSL_RANDOMFILE flag. |
// | // |
SSLContextRep::SSLContextRep(const String& trustPath, |
SSLContextRep::SSLContextRep( |
|
const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
|
Boolean trustStoreAutoUpdate, |
|
String trustStoreUserName, |
const String& randomFile) | const String& randomFile) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
| |
_trustPath = trustPath.getCString(); |
_trustStore = trustStore; |
|
|
|
_certPath = certPath; |
|
|
|
_keyPath = keyPath; |
| |
_certPath = certPath.getCString(); |
_certificateVerifyFunction = verifyCert; |
| |
_keyPath = keyPath.getCString(); |
_trustStoreAutoUpdate = trustStoreAutoUpdate; |
| |
verify_certificate = verifyCert; |
_trustStoreUserName = trustStoreUserName; |
| |
|
// |
|
// If a truststore and/or peer verification function is specified, enable peer verification |
|
// |
|
if (trustStore != String::EMPTY || verifyCert != NULL) |
|
{ |
|
_verifyPeer = true; |
|
} |
|
else |
|
{ |
|
_verifyPeer = false; |
|
} |
| |
|
// |
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. | // Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
|
// |
_countRepMutex.lock(pegasus_thread_self()); | _countRepMutex.lock(pegasus_thread_self()); |
| |
try | try |
|
|
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
| |
_trustPath = sslContextRep._trustPath; |
_trustStore = sslContextRep._trustStore; |
_certPath = sslContextRep._certPath; | _certPath = sslContextRep._certPath; |
_keyPath = sslContextRep._keyPath; | _keyPath = sslContextRep._keyPath; |
// ATTN: verify_certificate is set implicitly in global variable |
_verifyPeer = sslContextRep._verifyPeer; |
|
_trustStoreAutoUpdate = sslContextRep._trustStoreAutoUpdate; |
|
_trustStoreUserName = sslContextRep._trustStoreUserName; |
|
_certificateVerifyFunction = sslContextRep._certificateVerifyFunction; |
_randomFile = sslContextRep._randomFile; | _randomFile = sslContextRep._randomFile; |
| |
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. | // Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
|
|
SSL_CTX_set_options(sslContext,SSL_OP_ALL); | SSL_CTX_set_options(sslContext,SSL_OP_ALL); |
SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF); | SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF); |
| |
if (verify_certificate != NULL) |
if (_verifyPeer) |
|
{ |
|
//ATTN: We might still need a flag to specify SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
|
// If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be terminated |
|
// if the client sends no certificate or sends an untrusted certificate. The |
|
// callback function is not called in this case; the handshake is simply terminated. |
|
// This value has NO effect in from a client perspective |
|
|
|
if (_certificateVerifyFunction != NULL) |
{ | { |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: certificate verification callback specified"); |
SSL_CTX_set_verify(sslContext, | SSL_CTX_set_verify(sslContext, |
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback); | SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback); |
} | } |
else | else |
{ | { |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: Trust Store specified"); |
|
SSL_CTX_set_verify(sslContext, |
|
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, |
|
prepareForCallback); |
|
} |
|
} |
|
else |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Trust Store and certificate verification callback are NOT specified"); |
SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL); | SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL); |
} | } |
| |
// | // |
// Check if there is CA certificate file specified. If specified, |
// Check if there is CA certificate file or directory specified. If specified, |
// load the certificates from the file in to the CA trust store. |
// and is not empty, load the certificates from the Trust store. |
// | // |
if (strncmp(_trustPath, "", 1) != 0) |
if (_trustStore != String::EMPTY) |
{ | { |
// | // |
// load certificates in to trust store |
// The truststore may be a single file of CA certificates OR |
|
// a directory containing multiple CA certificates. |
|
// Check which one it is, and call the load_verify_locations function |
|
// with the appropriate parameter. Note: It is possible to have both |
|
// options, in which case the CA file takes precedence over the CA path. |
|
// However, since there is currently only one trust parameter to the |
|
// SSL functions, only allow one choice here. |
|
// |
|
if (FileSystem::isDirectory(_trustStore)) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Truststore is a directory"); |
|
// |
|
// load certificates from the trust store |
// | // |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Loading certificates from the trust store: " + _trustStore); |
| |
if ((!SSL_CTX_load_verify_locations(sslContext, _trustPath, NULL)) || |
if ((!SSL_CTX_load_verify_locations(sslContext, NULL, _trustStore.getCString())) || |
(!SSL_CTX_set_default_verify_paths(sslContext))) | (!SSL_CTX_set_default_verify_paths(sslContext))) |
{ | { |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Could not load certificates from the trust store: " + _trustStore); |
|
//l10n |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
|
"Could not load certificates in to trust store."); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
|
|
} |
|
else if (FileSystem::exists(_trustStore)) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Truststore is a file"); |
|
// |
|
// Get size of the trust store file: |
|
// |
|
Uint32 fileSize = 0; |
|
|
|
FileSystem::getFileSize(_trustStore, fileSize); |
|
|
|
if (fileSize > 0) |
|
{ |
|
// |
|
// load certificates from the trust store |
|
// |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Loading certificates from the trust store: " + _trustStore); |
|
|
|
if ((!SSL_CTX_load_verify_locations(sslContext, _trustStore.getCString(), NULL)) || |
|
(!SSL_CTX_set_default_verify_paths(sslContext))) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Could not load certificates from the trust store: " + _trustStore); |
//l10n | //l10n |
//throw( SSLException("Could not load certificates in to trust store.")); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", | MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
"Could not load certificates in to trust store."); | "Could not load certificates in to trust store."); |
|
PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
} | } |
|
else |
|
{ |
|
// |
|
// no certificates found in the trust store |
|
// |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: No certificates to load from the trust store: " + _trustStore); |
|
} |
|
} |
|
} |
| |
Boolean keyLoaded = false; | Boolean keyLoaded = false; |
|
|
// | // |
// Check if there is a certificate file (file containing server | // Check if there is a certificate file (file containing server |
// certificate) specified. If specified, validate and load the | // certificate) specified. If specified, validate and load the |
// certificate. | // certificate. |
// | // |
if (strncmp(_certPath, "", 1) != 0) |
if (_certPath != String::EMPTY) |
{ | { |
// | // |
// load the specified server certificates | // load the specified server certificates |
// | // |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Loading server certificate from: " + _certPath); |
| |
if (SSL_CTX_use_certificate_file(sslContext, | if (SSL_CTX_use_certificate_file(sslContext, |
_certPath, SSL_FILETYPE_PEM) <=0) |
_certPath.getCString(), SSL_FILETYPE_PEM) <=0) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: no certificate found in " + String(_certPath)); |
"---> SSL: No server certificate found in " + _certPath); |
PEG_METHOD_EXIT(); |
|
//l10n |
|
//throw( SSLException("Could not get server certificate.")); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE", | MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE", |
"Could not get server certificate."); | "Could not get server certificate."); |
|
PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
| |
// | // |
// If there is no key file (file containing server | // If there is no key file (file containing server |
// private key) specified or the specified file does not exist, |
// private key) specified, then try loading the key from the certificate file. |
// then try loading the key from the certificate file. |
// As of 2.4, if a keyfile is specified, its location is verified during server |
|
// startup and will throw an error if the path is invalid. |
// | // |
if ( strncmp(_keyPath, "", 1) == 0 || |
if (_keyPath == String::EMPTY) |
!FileSystem::exists(String(_keyPath)) ) |
|
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: loading key from" + String(_certPath)); |
"---> SSL: loading private key from: " + _certPath); |
// | // |
// load the private key and check for validity | // load the private key and check for validity |
// | // |
if (!_verifyPrivateKey(sslContext, _certPath)) | if (!_verifyPrivateKey(sslContext, _certPath)) |
{ | { |
PEG_METHOD_EXIT(); |
|
//l10n |
|
//throw( SSLException("Could not get private key.")); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", | MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", |
"Could not get private key."); | "Could not get private key."); |
|
PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
keyLoaded = true; | keyLoaded = true; |
|
|
// private key) specified and the key was not already loaded. | // private key) specified and the key was not already loaded. |
// If specified, validate and load the key. | // If specified, validate and load the key. |
// | // |
if (strncmp(_keyPath, "", 1) != 0 && !keyLoaded) |
if (_keyPath != String::EMPTY && !keyLoaded) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: loading key from" + String(_keyPath)); |
"---> SSL: loading private key from: " + _keyPath); |
// | // |
// load given private key and check for validity | // load given private key and check for validity |
// | // |
if (!_verifyPrivateKey(sslContext, _keyPath)) | if (!_verifyPrivateKey(sslContext, _keyPath)) |
{ | { |
PEG_METHOD_EXIT(); |
|
//l10n |
|
//throw( SSLException("Could not get private key.")); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", | MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", |
"Could not get private key."); | "Could not get private key."); |
|
PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
keyLoaded = true; | keyLoaded = true; |
|
|
return sslContext; | return sslContext; |
} | } |
| |
Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, const char *keyPath) |
Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, const String& keyPath) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()"); | PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()"); |
| |
if (SSL_CTX_use_PrivateKey_file(ctx, keyPath, SSL_FILETYPE_PEM) <= 0) |
if (SSL_CTX_use_PrivateKey_file(ctx, keyPath.getCString(), SSL_FILETYPE_PEM) <= 0) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: no private key found in " + String(keyPath)); | "---> SSL: no private key found in " + String(keyPath)); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return false; | return false; |
|
|
| |
if (!SSL_CTX_check_private_key(ctx)) | if (!SSL_CTX_check_private_key(ctx)) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: Private and public key do not match"); | "---> SSL: Private and public key do not match"); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return false; | return false; |
|
|
{ | { |
return _sslContext; | return _sslContext; |
} | } |
|
|
|
String SSLContextRep::getTrustStore() const |
|
{ |
|
return _trustStore; |
|
} |
|
|
|
String SSLContextRep::getCertPath() const |
|
{ |
|
return _certPath; |
|
} |
|
|
|
String SSLContextRep::getKeyPath() const |
|
{ |
|
return _keyPath; |
|
} |
|
|
|
Boolean SSLContextRep::isPeerVerificationEnabled() const |
|
{ |
|
return _verifyPeer; |
|
} |
|
|
|
Boolean SSLContextRep::isTrustStoreAutoUpdateEnabled() const |
|
{ |
|
return _trustStoreAutoUpdate; |
|
} |
|
|
|
String SSLContextRep::getTrustStoreUserName() const |
|
{ |
|
return _trustStoreUserName; |
|
} |
|
|
|
SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const |
|
{ |
|
return _certificateVerifyFunction; |
|
} |
|
|
#else | #else |
| |
// | // |
// these definitions are used if ssl is not available | // these definitions are used if ssl is not available |
// | // |
| |
SSLContextRep::SSLContextRep(const String& trustPath, |
SSLContextRep::SSLContextRep(const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
|
Boolean trustStoreAutoUpdate, |
|
String trustStoreUserName, |
const String& randomFile) {} | const String& randomFile) {} |
| |
SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {} | SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {} |
|
|
SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; } | SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; } |
| |
Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, | Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, |
const char *keyPath) { return false; } |
const String& keyPath) { return false; } |
| |
SSL_CTX * SSLContextRep::getContext() const { return 0; } | SSL_CTX * SSLContextRep::getContext() const { return 0; } |
| |
|
String SSLContextRep::getTrustStore() const { return String::EMPTY; } |
|
|
|
String SSLContextRep::getCertPath() const { return String::EMPTY; } |
|
|
|
String SSLContextRep::getKeyPath() const { return String::EMPTY; } |
|
|
|
Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } |
|
|
|
Boolean SSLContextRep::isTrustStoreAutoUpdateEnabled() const { return false; } |
|
|
|
String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; } |
|
|
|
SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; } |
|
|
void SSLContextRep::init_ssl() {} | void SSLContextRep::init_ssl() {} |
| |
void SSLContextRep::free_ssl() {} | void SSLContextRep::free_ssl() {} |
|
|
| |
| |
SSLContext::SSLContext( | SSLContext::SSLContext( |
const String& trustPath, |
const String& trustStore, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep(trustPath, String::EMPTY, String::EMPTY, verifyCert, randomFile); |
_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, verifyCert, false, String::EMPTY, randomFile); |
} | } |
| |
#ifndef PEGASUS_REMOVE_DEPRECATED |
|
SSLContext::SSLContext( | SSLContext::SSLContext( |
|
const String& trustStore, |
const String& certPath, | const String& certPath, |
|
const String& keyPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile, |
const String& randomFile) |
Boolean isCIMClient) |
|
{ | { |
_rep = new SSLContextRep(certPath, String::EMPTY, String::EMPTY, verifyCert, randomFile); |
_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, String::EMPTY, randomFile); |
} | } |
| |
SSLContext::SSLContext( | SSLContext::SSLContext( |
|
const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& certKeyPath, |
const String& keyPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
|
String trustStoreUserName, |
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep(certPath, certKeyPath, String::EMPTY, verifyCert, randomFile); |
_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, trustStoreUserName, randomFile); |
} | } |
#endif |
|
| |
|
#ifdef PEGASUS_USE_AUTOMATIC_TRUSTSTORE_UPDATE |
SSLContext::SSLContext( | SSLContext::SSLContext( |
const String& trustPath, |
const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
|
Boolean trustStoreAutoUpdate, |
|
String trustStoreUserName, |
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep(trustPath, certPath, keyPath, verifyCert, randomFile); |
_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, trustStoreAutoUpdate, trustStoreUserName, randomFile); |
} | } |
|
#endif |
|
|
| |
SSLContext::SSLContext(const SSLContext& sslContext) | SSLContext::SSLContext(const SSLContext& sslContext) |
{ | { |
|
|
delete _rep; | delete _rep; |
} | } |
| |
|
String SSLContext::getTrustStore() const |
|
{ |
|
return (_rep->getTrustStore()); |
|
} |
|
|
|
String SSLContext::getCertPath() const |
|
{ |
|
return (_rep->getCertPath()); |
|
} |
|
|
|
String SSLContext::getKeyPath() const |
|
{ |
|
return (_rep->getKeyPath()); |
|
} |
|
|
|
Boolean SSLContext::isPeerVerificationEnabled() const |
|
{ |
|
return (_rep->isPeerVerificationEnabled()); |
|
} |
|
|
|
#ifdef PEGASUS_USE_AUTOMATIC_TRUSTSTORE_UPDATE |
|
Boolean SSLContext::isTrustStoreAutoUpdateEnabled() const |
|
{ |
|
return (_rep->isTrustStoreAutoUpdateEnabled()); |
|
} |
|
#endif |
|
|
|
String SSLContext::getTrustStoreUserName() const |
|
{ |
|
return (_rep->getTrustStoreUserName()); |
|
} |
|
|
|
SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const |
|
{ |
|
return (_rep->getSSLCertificateVerifyFunction()); |
|
} |
| |
/////////////////////////////////////////////////////////////////////////////// | /////////////////////////////////////////////////////////////////////////////// |
// | // |
|
|
_rep->issuerName = issuerName; | _rep->issuerName = issuerName; |
_rep->versionNumber = 0; | _rep->versionNumber = 0; |
_rep->serialNumber = 0; | _rep->serialNumber = 0; |
_rep->notBefore = CIMDateTime(String::EMPTY); |
_rep->notBefore = CIMDateTime(); |
_rep->notAfter = CIMDateTime(String::EMPTY); |
_rep->notAfter = CIMDateTime(); |
_rep->depth = errorDepth; | _rep->depth = errorDepth; |
_rep->errorCode = errorCode; | _rep->errorCode = errorCode; |
_rep->errorString = String::EMPTY; | _rep->errorString = String::EMPTY; |
|
|
_rep->respCode = respCode; | _rep->respCode = respCode; |
} | } |
| |
|
String SSLCertificateInfo::toString() const |
|
{ |
|
char buf[1024]; |
|
|
|
String s; |
|
|
|
s.append("Subject Name:\n\t"); |
|
s.append(_rep->subjectName); |
|
s.append("\n"); |
|
|
|
s.append("Issuer Name:\n\t"); |
|
s.append(_rep->issuerName); |
|
s.append("\n"); |
|
|
|
sprintf(buf, "Depth: %d\n", _rep->depth); |
|
s.append(buf); |
|
|
|
sprintf(buf, "Error code: %d\n", _rep->errorCode); |
|
s.append(buf); |
|
|
|
sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode); |
|
s.append(buf); |
|
|
|
s.append("Error string: "); |
|
s.append(_rep->errorString); |
|
s.append("\n"); |
|
|
|
sprintf(buf, "Version number: %d\n", _rep->versionNumber); |
|
s.append(buf); |
|
|
|
sprintf(buf, "Serial number: %ld\n", _rep->serialNumber); |
|
s.append(buf); |
|
|
|
s.append("Not before date: "); |
|
s.append((_rep->notBefore).toString()); |
|
s.append("\n"); |
|
|
|
s.append("Not after date: "); |
|
s.append((_rep->notAfter).toString()); |
|
s.append("\n"); |
|
|
|
return s; |
|
} |
|
|
|
SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert) |
|
{ |
|
verifyCertificateCallback = verifyCert; |
|
_peerCertificate = NULL; |
|
} |
|
|
|
SSLCallbackInfo::~SSLCallbackInfo() |
|
{ |
|
if (_peerCertificate) |
|
{ |
|
delete _peerCertificate; |
|
} |
|
} |
|
|
PEGASUS_NAMESPACE_END | PEGASUS_NAMESPACE_END |
| |