pegasus/src/Pegasus/Common/SSLContext.cpp - diff

Return to SSLContext.cpp CVS log

Up to [Pegasus] / pegasus / src / Pegasus / Common

Diff for /pegasus/src/Pegasus/Common/SSLContext.cpp between version 1.25 and 1.31

version 1.25, 2003/11/15 02:49:54

version 1.31, 2004/06/30 15:09:53

Line 27

// Modified By: Nag Boranna, Hewlett-Packard Company (nagaraja_boranna@hp.com)

// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com)

// Sushma Fernandes,

// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com)

// Hewlett-Packard Company (sushma_fernandes@hp.com)

// Heather Sterling, IBM (hsterl@us.ibm.com)

//%/////////////////////////////////////////////////////////////////////////////

Line 74

#ifdef PEGASUS_HAS_SSL

// certificate handling routine

// ATTN-RK-20020905: This global variable is unsafe with multiple SSL contexts

SSLCertificateVerifyFunction* verify_certificate;

// Mutex for SSL locks.

Mutex* SSLContextRep::_sslLocks = 0;

Line 168

Line 161

char buf[256];

X509 *currentCert;

SSL *ssl;

int verifyError = X509_V_OK;

// get the verification callback info specific to each SSL connection

ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());

SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSL_CALLBACK_INDEX);

// If the SSLContext does not have an additional callback

// simply return the preverification error.

// We do not need to go through the additional steps.

if (exData->verifyCertificateCallback == NULL)

{

return (preVerifyOk);

}

// get the current certificate

currentCert = X509_STORE_CTX_get_current_cert(ctx);

Line 185

Line 195

int depth = X509_STORE_CTX_get_error_depth(ctx);

//FUTURE: Not sure what to do with these...?

//ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());

//mydata = SSL_get_ex_data(ssl, mydata_index);

// get the version on the certificate

Line 239

Line 245

}

String issuerName = String(buf);

// SSLCertificateInfo certInfo(subjectName, issuerName, version, serialNumber,

// Call the verify_certificate() application callback

// notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk);

SSLCertificateInfo certInfo(subjectName, issuerName, version, serialNumber,

exData->_peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber,

notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk);

if (verify_certificate(certInfo))

// Call the application callback.

// Note that the verification result does not automatically get set to X509_V_OK if the callback is successful.

// This is because OpenSSL retains the original default error in case we want to use it later.

// To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here.

if (exData->verifyCertificateCallback(*exData->_peerCertificate))//certInfo))

{

verifyError = X509_V_OK;

preVerifyOk = 1;

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--> SSL: verify_certificate() returned X509_V_OK");

"--> SSL: verifyCertificateCallback() returned X509_V_OK");

PEG_METHOD_EXIT();

return 1;

}

else

else // verification failed, handshake will be immediately terminated

{

verifyError = certInfo.getErrorCode();

preVerifyOk = 0;

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--> SSL: verify_certificate() returned error %d", verifyError);

"--> SSL: verifyCertificateCallback() returned error %d", exData->_peerCertificate->getErrorCode());

}

// Reset the error. It is logically not required to reset the error code, but

// openSSL code does not take just the return value on a failed certificate

// verification.

X509_STORE_CTX_set_error(ctx, verifyError);

PEG_METHOD_EXIT();

return 0;

return(preVerifyOk);

}

Line 284

Line 287

if ( mode & CRYPTO_LOCK )

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

/*Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Now locking for %d", pegasus_thread_self());

"Now locking for %d", pegasus_thread_self());*/

SSLContextRep::_sslLocks[type].lock( pegasus_thread_self() );

}

else

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

/*Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Now unlocking for %d", pegasus_thread_self());

"Now unlocking for %d", pegasus_thread_self());*/

SSLContextRep::_sslLocks[type].unlock( );

}

Line 338

Line 341

// For the OSs that don't have /dev/random device file,

// must enable PEGASUS_SSL_RANDOMFILE flag.

SSLContextRep::SSLContextRep(const String& trustPath,

SSLContextRep::SSLContextRep(

const String& trustStore,

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

Boolean trustStoreAutoUpdate,

String trustStoreUserName,

const String& randomFile)

{

PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()");

_trustPath = trustPath.getCString();

_trustStore = trustStore;

_certPath = certPath;

_keyPath = keyPath;

_certPath = certPath.getCString();

_certificateVerifyFunction = verifyCert;

_keyPath = keyPath.getCString();

_trustStoreAutoUpdate = trustStoreAutoUpdate;

verify_certificate = verifyCert;

_trustStoreUserName = trustStoreUserName;

// If a truststore and/or peer verification function is specified, enable peer verification

if (trustStore != String::EMPTY || verifyCert != NULL)

{

_verifyPeer = true;

}

else

{

_verifyPeer = false;

}

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

_countRepMutex.lock(pegasus_thread_self());

try

Line 406

Line 429

{

PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()");

_trustPath = sslContextRep._trustPath;

_trustStore = sslContextRep._trustStore;

_certPath = sslContextRep._certPath;

_keyPath = sslContextRep._keyPath;

// ATTN: verify_certificate is set implicitly in global variable

_verifyPeer = sslContextRep._verifyPeer;

_trustStoreAutoUpdate = sslContextRep._trustStoreAutoUpdate;

_trustStoreUserName = sslContextRep._trustStoreUserName;

_certificateVerifyFunction = sslContextRep._certificateVerifyFunction;

_randomFile = sslContextRep._randomFile;

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

Line 657

Line 683

SSL_CTX_set_options(sslContext,SSL_OP_ALL);

SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF);

if (verify_certificate != NULL)

if (_verifyPeer)

{

//ATTN: We might still need a flag to specify SSL_VERIFY_FAIL_IF_NO_PEER_CERT

// If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be terminated

// if the client sends no certificate or sends an untrusted certificate. The

// callback function is not called in this case; the handshake is simply terminated.

// This value has NO effect in from a client perspective

if (_certificateVerifyFunction != NULL)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: certificate verification callback specified");

SSL_CTX_set_verify(sslContext,

SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback);

}

else

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: Trust Store specified");

SSL_CTX_set_verify(sslContext,

SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,

prepareForCallback);

}

else

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Trust Store and certificate verification callback are NOT specified");

SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL);

}

// Check if there is CA certificate file specified. If specified,

// Check if there is CA certificate file or directory specified. If specified,

// load the certificates from the file in to the CA trust store.

// and is not empty, load the certificates from the Trust store.

if (strncmp(_trustPath, "", 1) != 0)

if (_trustStore != String::EMPTY)

{

// load certificates in to trust store

// The truststore may be a single file of CA certificates OR

// a directory containing multiple CA certificates.

// Check which one it is, and call the load_verify_locations function

// with the appropriate parameter. Note: It is possible to have both

// options, in which case the CA file takes precedence over the CA path.

// However, since there is currently only one trust parameter to the

// SSL functions, only allow one choice here.

if (FileSystem::isDirectory(_trustStore))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Truststore is a directory");

// load certificates from the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Loading certificates from the trust store: " + _trustStore);

if ((!SSL_CTX_load_verify_locations(sslContext, _trustPath, NULL)) ||

if ((!SSL_CTX_load_verify_locations(sslContext, NULL, _trustStore.getCString())) ||

(!SSL_CTX_set_default_verify_paths(sslContext)))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Could not load certificates from the trust store: " + _trustStore);

//l10n

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",

"Could not load certificates in to trust store.");

PEG_METHOD_EXIT();

throw SSLException(parms);

}

else if (FileSystem::exists(_trustStore))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Truststore is a file");

// Get size of the trust store file:

Uint32 fileSize = 0;

FileSystem::getFileSize(_trustStore, fileSize);

if (fileSize > 0)

{

// load certificates from the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Loading certificates from the trust store: " + _trustStore);

if ((!SSL_CTX_load_verify_locations(sslContext, _trustStore.getCString(), NULL)) ||

(!SSL_CTX_set_default_verify_paths(sslContext)))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Could not load certificates from the trust store: " + _trustStore);

//l10n

//throw( SSLException("Could not load certificates in to trust store."));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",

"Could not load certificates in to trust store.");

PEG_METHOD_EXIT();

throw SSLException(parms);

}

else

{

// no certificates found in the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: No certificates to load from the trust store: " + _trustStore);

}

Boolean keyLoaded = false;

// Check if there is a certificate file (file containing server

// certificate) specified. If specified, validate and load the

// certificate.

if (strncmp(_certPath, "", 1) != 0)

if (_certPath != String::EMPTY)

{

// load the specified server certificates

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Loading server certificate from: " + _certPath);

if (SSL_CTX_use_certificate_file(sslContext,

_certPath, SSL_FILETYPE_PEM) <=0)

_certPath.getCString(), SSL_FILETYPE_PEM) <=0)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: no certificate found in " + String(_certPath));

"---> SSL: No server certificate found in " + _certPath);

PEG_METHOD_EXIT();

//l10n

//throw( SSLException("Could not get server certificate."));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE",

"Could not get server certificate.");

PEG_METHOD_EXIT();

throw SSLException(parms);

}

// If there is no key file (file containing server

// private key) specified or the specified file does not exist,

// private key) specified, then try loading the key from the certificate file.

// then try loading the key from the certificate file.

// As of 2.4, if a keyfile is specified, its location is verified during server

// startup and will throw an error if the path is invalid.

if ( strncmp(_keyPath, "", 1) == 0 ||

if (_keyPath == String::EMPTY)

!FileSystem::exists(String(_keyPath)) )

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: loading key from" + String(_certPath));

"---> SSL: loading private key from: " + _certPath);

// load the private key and check for validity

if (!_verifyPrivateKey(sslContext, _certPath))

{

PEG_METHOD_EXIT();

//l10n

//throw( SSLException("Could not get private key."));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",

"Could not get private key.");

PEG_METHOD_EXIT();

throw SSLException(parms);

}

keyLoaded = true;

Line 745

Line 848

// private key) specified and the key was not already loaded.

// If specified, validate and load the key.

if (strncmp(_keyPath, "", 1) != 0 && !keyLoaded)

if (_keyPath != String::EMPTY && !keyLoaded)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: loading key from" + String(_keyPath));

"---> SSL: loading private key from: " + _keyPath);

// load given private key and check for validity

if (!_verifyPrivateKey(sslContext, _keyPath))

{

PEG_METHOD_EXIT();

//l10n

//throw( SSLException("Could not get private key."));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",

"Could not get private key.");

PEG_METHOD_EXIT();

throw SSLException(parms);

}

keyLoaded = true;

Line 768

Line 869

return sslContext;

}

Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, const char *keyPath)

Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, const String& keyPath)

{

PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()");

if (SSL_CTX_use_PrivateKey_file(ctx, keyPath, SSL_FILETYPE_PEM) <= 0)

if (SSL_CTX_use_PrivateKey_file(ctx, keyPath.getCString(), SSL_FILETYPE_PEM) <= 0)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: no private key found in " + String(keyPath));

PEG_METHOD_EXIT();

return false;

Line 782

Line 883

if (!SSL_CTX_check_private_key(ctx))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Private and public key do not match");

PEG_METHOD_EXIT();

return false;

Line 796

Line 897

{

return _sslContext;

}

String SSLContextRep::getTrustStore() const

{

return _trustStore;

}

String SSLContextRep::getCertPath() const

{

return _certPath;

}

String SSLContextRep::getKeyPath() const

{

return _keyPath;

}

Boolean SSLContextRep::isPeerVerificationEnabled() const

{

return _verifyPeer;

}

Boolean SSLContextRep::isTrustStoreAutoUpdateEnabled() const

{

return _trustStoreAutoUpdate;

}

String SSLContextRep::getTrustStoreUserName() const

{

return _trustStoreUserName;

}

SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const

{

return _certificateVerifyFunction;

}

#else

// these definitions are used if ssl is not available

SSLContextRep::SSLContextRep(const String& trustPath,

SSLContextRep::SSLContextRep(const String& trustStore,

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

Boolean trustStoreAutoUpdate,

String trustStoreUserName,

const String& randomFile) {}

SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {}

Line 815

Line 954

SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; }

Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx,

const char *keyPath) { return false; }

const String& keyPath) { return false; }

SSL_CTX * SSLContextRep::getContext() const { return 0; }

String SSLContextRep::getTrustStore() const { return String::EMPTY; }

String SSLContextRep::getCertPath() const { return String::EMPTY; }

String SSLContextRep::getKeyPath() const { return String::EMPTY; }

Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; }

Boolean SSLContextRep::isTrustStoreAutoUpdateEnabled() const { return false; }

String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; }

SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; }

void SSLContextRep::init_ssl() {}

void SSLContextRep::free_ssl() {}

Line 833

Line 986

SSLContext::SSLContext(

const String& trustPath,

const String& trustStore,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

_rep = new SSLContextRep(trustPath, String::EMPTY, String::EMPTY, verifyCert, randomFile);

_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, verifyCert, false, String::EMPTY, randomFile);

}

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile,

const String& randomFile)

Boolean isCIMClient)

{

_rep = new SSLContextRep(certPath, String::EMPTY, String::EMPTY, verifyCert, randomFile);

_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, String::EMPTY, randomFile);

}

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

const String& certKeyPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

String trustStoreUserName,

const String& randomFile)

{

_rep = new SSLContextRep(certPath, certKeyPath, String::EMPTY, verifyCert, randomFile);

_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, trustStoreUserName, randomFile);

}

#endif

#ifdef PEGASUS_USE_AUTOMATIC_TRUSTSTORE_UPDATE

SSLContext::SSLContext(

const String& trustPath,

const String& trustStore,

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

Boolean trustStoreAutoUpdate,

String trustStoreUserName,

const String& randomFile)

{

_rep = new SSLContextRep(trustPath, certPath, keyPath, verifyCert, randomFile);

_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, trustStoreAutoUpdate, trustStoreUserName, randomFile);

}

#endif

SSLContext::SSLContext(const SSLContext& sslContext)

{

Line 885

Line 1044

delete _rep;

}

String SSLContext::getTrustStore() const

{

return (_rep->getTrustStore());

}

String SSLContext::getCertPath() const

{

return (_rep->getCertPath());

}

String SSLContext::getKeyPath() const

{

return (_rep->getKeyPath());

}

Boolean SSLContext::isPeerVerificationEnabled() const

{

return (_rep->isPeerVerificationEnabled());

}

#ifdef PEGASUS_USE_AUTOMATIC_TRUSTSTORE_UPDATE

Boolean SSLContext::isTrustStoreAutoUpdateEnabled() const

{

return (_rep->isTrustStoreAutoUpdateEnabled());

}

#endif

String SSLContext::getTrustStoreUserName() const

{

return (_rep->getTrustStoreUserName());

}

SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const

{

return (_rep->getSSLCertificateVerifyFunction());

}

///////////////////////////////////////////////////////////////////////////////

Line 958

Line 1153

_rep->issuerName = issuerName;

_rep->versionNumber = 0;

_rep->serialNumber = 0;

_rep->notBefore = CIMDateTime(String::EMPTY);

_rep->notBefore = CIMDateTime();

_rep->notAfter = CIMDateTime(String::EMPTY);

_rep->notAfter = CIMDateTime();

_rep->depth = errorDepth;

_rep->errorCode = errorCode;

_rep->errorString = String::EMPTY;

Line 1077

Line 1272

_rep->respCode = respCode;

}

String SSLCertificateInfo::toString() const

{

char buf[1024];

String s;

s.append("Subject Name:\n\t");

s.append(_rep->subjectName);

s.append("\n");

s.append("Issuer Name:\n\t");

s.append(_rep->issuerName);

s.append("\n");

sprintf(buf, "Depth: %d\n", _rep->depth);

s.append(buf);

sprintf(buf, "Error code: %d\n", _rep->errorCode);

s.append(buf);

sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode);

s.append(buf);

s.append("Error string: ");

s.append(_rep->errorString);

s.append("\n");

sprintf(buf, "Version number: %d\n", _rep->versionNumber);

s.append(buf);

sprintf(buf, "Serial number: %ld\n", _rep->serialNumber);

s.append(buf);

s.append("Not before date: ");

s.append((_rep->notBefore).toString());

s.append("\n");

s.append("Not after date: ");

s.append((_rep->notAfter).toString());

s.append("\n");

return s;

}

SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert)

{

verifyCertificateCallback = verifyCert;

_peerCertificate = NULL;

}

SSLCallbackInfo::~SSLCallbackInfo()

{

if (_peerCertificate)

{

delete _peerCertificate;

}

PEGASUS_NAMESPACE_END

Legend:

Removed from v.1.25
changed lines
	Added in v.1.31

No CVS admin address has been configured