version 1.31, 2004/06/30 15:09:53
|
version 1.39, 2004/10/17 20:39:17
|
|
|
//%2003//////////////////////////////////////////////////////////////////////// |
//%2004//////////////////////////////////////////////////////////////////////// |
// | // |
// Copyright (c) 2000, 2001, 2002 BMC Software, Hewlett-Packard Development |
// Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development |
// Company, L. P., IBM Corp., The Open Group, Tivoli Systems. |
// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems. |
// Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L. P.; | // Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L. P.; |
// IBM Corp.; EMC Corporation, The Open Group. | // IBM Corp.; EMC Corporation, The Open Group. |
|
// Copyright (c) 2004 BMC Software; Hewlett-Packard Development Company, L.P.; |
|
// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group. |
// | // |
// Permission is hereby granted, free of charge, to any person obtaining a copy | // Permission is hereby granted, free of charge, to any person obtaining a copy |
// of this software and associated documentation files (the "Software"), to | // of this software and associated documentation files (the "Software"), to |
|
|
// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com) | // Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com) |
// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com) | // Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com) |
// Heather Sterling, IBM (hsterl@us.ibm.com) | // Heather Sterling, IBM (hsterl@us.ibm.com) |
|
// Amit K Arora, IBM (amita@in.ibm.com) for Bug#1090 |
// | // |
//%///////////////////////////////////////////////////////////////////////////// | //%///////////////////////////////////////////////////////////////////////////// |
| |
|
|
#include "SSLContext.h" | #include "SSLContext.h" |
#include "SSLContextRep.h" | #include "SSLContextRep.h" |
| |
|
|
|
// |
|
// Typedef's for OpenSSL callback functions. |
|
// |
|
extern "C" |
|
{ |
|
typedef void (* CRYPTO_SET_LOCKING_CALLBACK)(int, int, const char *, int); |
|
typedef unsigned long (* CRYPTO_SET_ID_CALLBACK)(void); |
|
}; |
|
|
|
|
typedef struct Timestamp | typedef struct Timestamp |
{ | { |
char year[4]; | char year[4]; |
|
|
| |
PEGASUS_NAMESPACE_BEGIN | PEGASUS_NAMESPACE_BEGIN |
| |
|
const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0; |
|
|
// | // |
// use the following definitions only if SSL is available | // use the following definitions only if SSL is available |
// | // |
|
|
Timestamp_t timeStamp; | Timestamp_t timeStamp; |
char tempString[80]; | char tempString[80]; |
char plusOrMinus = '+'; | char plusOrMinus = '+'; |
|
unsigned char* utcTimeData = utcTime->data; |
| |
memset(&time, '\0', sizeof(time)); | memset(&time, '\0', sizeof(time)); |
| |
#define g2(p) ( ( (p)[0] - '0' ) * 10 + (p)[1] - '0' ) | #define g2(p) ( ( (p)[0] - '0' ) * 10 + (p)[1] - '0' ) |
| |
time.tm_year = g2(utcTime->data); |
if (utcTime->type == V_ASN1_GENERALIZEDTIME) |
|
{ |
|
time.tm_year = g2(utcTimeData) * 100; |
|
utcTimeData += 2; // Remaining data is equivalent to ASN1_UTCTIME type |
|
time.tm_year += g2(utcTimeData); |
|
} |
|
else |
|
{ |
|
time.tm_year = g2(utcTimeData); |
if(time.tm_year < 50) | if(time.tm_year < 50) |
{ | { |
time.tm_year += 100; |
time.tm_year += 2000; |
|
} |
|
else |
|
{ |
|
time.tm_year += 1900; |
|
} |
} | } |
time.tm_mon = g2(utcTime->data + 2) - 1; |
|
time.tm_mday = g2(utcTime->data + 4); |
|
time.tm_hour = g2(utcTime->data + 6); |
|
time.tm_min = g2(utcTime->data + 8); |
|
time.tm_sec = g2(utcTime->data + 10); |
|
| |
if(utcTime->data[12] == 'Z') |
time.tm_mon = g2(utcTimeData + 2) - 1; |
|
time.tm_mday = g2(utcTimeData + 4); |
|
time.tm_hour = g2(utcTimeData + 6); |
|
time.tm_min = g2(utcTimeData + 8); |
|
time.tm_sec = g2(utcTimeData + 10); |
|
|
|
if (utcTimeData[12] == 'Z') |
{ | { |
offset = 0; | offset = 0; |
} | } |
else | else |
{ | { |
offset = g2(utcTime->data + 13) * 60 + g2(utcTime->data + 15); |
offset = g2(utcTimeData + 13) * 60 + g2(utcTimeData + 15); |
if(utcTime->data[12] == '-') |
if (utcTimeData[12] == '-') |
{ | { |
plusOrMinus = '-'; | plusOrMinus = '-'; |
} | } |
} | } |
#undef g2 | #undef g2 |
| |
int year = 1900; |
|
memset((void *)&timeStamp, 0, sizeof(Timestamp_t)); | memset((void *)&timeStamp, 0, sizeof(Timestamp_t)); |
| |
// Format the date. | // Format the date. |
sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d", | sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d", |
year + time.tm_year, |
time.tm_year, |
time.tm_mon + 1, | time.tm_mon + 1, |
time.tm_mday, | time.tm_mday, |
time.tm_hour, | time.tm_hour, |
|
|
} | } |
| |
// | // |
|
// Static class used to define C++ callback function. |
|
// |
|
class SSLCallback |
|
{ |
|
|
|
public: |
|
static int callback(int preVerifyOk, X509_STORE_CTX *ctx); |
|
}; |
|
|
|
// |
// Callback function that is called by the OpenSSL library. This function | // Callback function that is called by the OpenSSL library. This function |
// extracts X509 certficate information and pass that on to client application | // extracts X509 certficate information and pass that on to client application |
// callback function. | // callback function. |
// | // |
int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
int SSLCallback::callback(int preVerifyOk, X509_STORE_CTX *ctx) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "prepareForCallback()"); |
PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()"); |
| |
char buf[256]; | char buf[256]; |
X509 *currentCert; | X509 *currentCert; |
|
|
// get the verification callback info specific to each SSL connection | // get the verification callback info specific to each SSL connection |
// | // |
ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); | ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); |
SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSL_CALLBACK_INDEX); |
SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX); |
| |
// | // |
// If the SSLContext does not have an additional callback | // If the SSLContext does not have an additional callback |
|
|
} | } |
| |
// | // |
|
// Callback function called by OpenSSL. This request is merely forwarded to the static |
|
// function SSLCallback::callback(). The SSLCallback class is a friend class of the |
|
// Pegasus SSL related classes needed to complete the callback. |
|
// |
|
extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
|
{ |
|
return SSLCallback::callback(preVerifyOk, ctx); |
|
} |
|
|
|
// |
// Implement OpenSSL locking callback. | // Implement OpenSSL locking callback. |
// | // |
void pegasus_locking_callback( int mode, | void pegasus_locking_callback( int mode, |
|
|
| |
// Set the ID callback. The ID callback returns a thread ID. | // Set the ID callback. The ID callback returns a thread ID. |
| |
CRYPTO_set_id_callback((unsigned long (*)())pegasus_thread_self); |
CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK) pegasus_thread_self); |
| |
// Set the locking callback to pegasus_locking_callback. | // Set the locking callback to pegasus_locking_callback. |
| |
CRYPTO_set_locking_callback((void (*)(int,int,const char *,int))pegasus_locking_callback); |
CRYPTO_set_locking_callback((CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback); |
| |
} | } |
| |
|
|
// | // |
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. | // Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
// | // |
_countRepMutex.lock(pegasus_thread_self()); |
|
|
|
try |
|
{ | { |
|
AutoMutex autoMut(_countRepMutex); |
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Value of Countrep in constructor %d", _countRep); | "Value of Countrep in constructor %d", _countRep); |
if ( _countRep == 0 ) | if ( _countRep == 0 ) |
|
|
"After calling SSL_library_init %d", pegasus_thread_self()); | "After calling SSL_library_init %d", pegasus_thread_self()); |
| |
} | } |
} |
|
catch(...) |
|
{ |
|
_countRepMutex.unlock(); |
|
throw; |
|
} |
|
_countRep++; | _countRep++; |
_countRepMutex.unlock(); |
} // mutex unlocks here |
| |
_randomInit(randomFile); | _randomInit(randomFile); |
| |
|
|
_randomFile = sslContextRep._randomFile; | _randomFile = sslContextRep._randomFile; |
| |
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. | // Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
_countRepMutex.lock(pegasus_thread_self()); |
|
try |
|
{ | { |
|
AutoMutex autoMut(_countRepMutex); |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Value of Countrep in copy constructor %d", _countRep); | "Value of Countrep in copy constructor %d", _countRep); |
if ( _countRep == 0 ) | if ( _countRep == 0 ) |
{ | { |
init_ssl(); | init_ssl(); |
} | } |
} |
|
catch(...) |
|
{ |
|
_countRepMutex.unlock(); |
|
throw; |
|
} |
|
_countRep++; | _countRep++; |
_countRepMutex.unlock(); |
} // mutex unlocks here |
| |
_sslContext = _makeSSLContext(); | _sslContext = _makeSSLContext(); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
|
|
SSL_CTX_free(_sslContext); | SSL_CTX_free(_sslContext); |
| |
// Decrement the SSLContextRep object _counter. | // Decrement the SSLContextRep object _counter. |
_countRepMutex.lock(pegasus_thread_self()); |
{ |
|
AutoMutex autoMut(_countRepMutex); |
_countRep--; | _countRep--; |
// Free SSL locks if no instances of SSLContextRep exist. | // Free SSL locks if no instances of SSLContextRep exist. |
try |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Value of Countrep in destructor %d", _countRep); | "Value of Countrep in destructor %d", _countRep); |
if ( _countRep == 0 ) | if ( _countRep == 0 ) |
{ | { |
free_ssl(); | free_ssl(); |
} | } |
|
|
} | } |
catch(...) |
|
{ |
|
_countRepMutex.unlock(); |
|
throw; |
|
} |
|
_countRepMutex.unlock(); |
|
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
} | } |
| |
|
|
Boolean ret; | Boolean ret; |
int retVal = 0; | int retVal = 0; |
| |
const int DEV_RANDOM_BYTES = 64; /* how many bytes to read */ |
|
const String devRandom = "/dev/random"; /* random device name */ |
|
const String devUrandom = "/dev/urandom"; /* pseudo-random device name */ |
|
|
|
#ifdef PEGASUS_SSL_DEVRANDOM |
|
|
|
if ( FileSystem::exists(devRandom) ) |
|
{ |
|
while ( RAND_status() == 0 ) |
|
{ |
|
// |
|
// Always attempt to seed from good entropy sources, first |
|
// try /dev/random |
|
// |
|
retVal = RAND_load_file(devRandom.getCString(), DEV_RANDOM_BYTES); |
|
if (retVal <= 0) |
|
{ |
|
break; |
|
} |
|
} |
|
} |
|
|
|
if ( FileSystem::exists(devUrandom) ) |
|
{ |
|
while ( RAND_status() == 0 ) |
|
{ |
|
// |
|
// If there isn't /dev/random try /dev/urandom |
|
// |
|
retVal = RAND_load_file(devUrandom.getCString(), DEV_RANDOM_BYTES); |
|
if (retVal <= 0) |
|
{ |
|
break; |
|
} |
|
} |
|
} |
|
#endif /* PEGASUS_SSL_DEVRANDOM */ |
|
|
|
|
|
#ifdef PEGASUS_SSL_RANDOMFILE | #ifdef PEGASUS_SSL_RANDOMFILE |
if ( RAND_status() == 0 ) | if ( RAND_status() == 0 ) |
{ | { |