version 1.31, 2004/06/30 15:09:53
|
version 1.43, 2004/12/08 21:53:32
|
|
|
//%2003//////////////////////////////////////////////////////////////////////// |
//%2004//////////////////////////////////////////////////////////////////////// |
// | // |
// Copyright (c) 2000, 2001, 2002 BMC Software, Hewlett-Packard Development |
// Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development |
// Company, L. P., IBM Corp., The Open Group, Tivoli Systems. |
// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems. |
// Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L. P.; | // Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L. P.; |
// IBM Corp.; EMC Corporation, The Open Group. | // IBM Corp.; EMC Corporation, The Open Group. |
|
// Copyright (c) 2004 BMC Software; Hewlett-Packard Development Company, L.P.; |
|
// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group. |
// | // |
// Permission is hereby granted, free of charge, to any person obtaining a copy | // Permission is hereby granted, free of charge, to any person obtaining a copy |
// of this software and associated documentation files (the "Software"), to | // of this software and associated documentation files (the "Software"), to |
|
|
// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com) | // Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com) |
// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com) | // Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com) |
// Heather Sterling, IBM (hsterl@us.ibm.com) | // Heather Sterling, IBM (hsterl@us.ibm.com) |
|
// Amit K Arora, IBM (amita@in.ibm.com) for Bug#1090 |
// | // |
//%///////////////////////////////////////////////////////////////////////////// | //%///////////////////////////////////////////////////////////////////////////// |
| |
#ifdef PEGASUS_HAS_SSL | #ifdef PEGASUS_HAS_SSL |
|
|
|
#ifdef PEGASUS_PLATFORM_WIN32_IX86_MSVC |
|
//Bugzilla 2366 |
|
//Use the X509_NAME in wincrypt.h on Windows. See X509.h for more info. |
|
#include <windows.h> |
|
#include <wincrypt.h> |
|
#endif |
|
|
#define OPENSSL_NO_KRB5 1 | #define OPENSSL_NO_KRB5 1 |
#include <openssl/err.h> | #include <openssl/err.h> |
#include <openssl/ssl.h> | #include <openssl/ssl.h> |
|
|
#include <Pegasus/Common/FileSystem.h> | #include <Pegasus/Common/FileSystem.h> |
#include <time.h> | #include <time.h> |
#include <Pegasus/Common/MessageLoader.h> //l10n | #include <Pegasus/Common/MessageLoader.h> //l10n |
|
#include <Pegasus/Common/Formatter.h> |
| |
#include "SSLContext.h" | #include "SSLContext.h" |
#include "SSLContextRep.h" | #include "SSLContextRep.h" |
| |
|
|
|
// |
|
// Typedef's for OpenSSL callback functions. |
|
// |
|
extern "C" |
|
{ |
|
typedef void (* CRYPTO_SET_LOCKING_CALLBACK)(int, int, const char *, int); |
|
typedef unsigned long (* CRYPTO_SET_ID_CALLBACK)(void); |
|
}; |
|
|
|
typedef struct x509_store_ctx_st X509_STORE_CTX; |
|
|
typedef struct Timestamp | typedef struct Timestamp |
{ | { |
char year[4]; | char year[4]; |
|
|
| |
PEGASUS_NAMESPACE_BEGIN | PEGASUS_NAMESPACE_BEGIN |
| |
|
const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0; |
|
|
// | // |
// use the following definitions only if SSL is available | // use the following definitions only if SSL is available |
// | // |
|
|
Timestamp_t timeStamp; | Timestamp_t timeStamp; |
char tempString[80]; | char tempString[80]; |
char plusOrMinus = '+'; | char plusOrMinus = '+'; |
|
unsigned char* utcTimeData = utcTime->data; |
| |
memset(&time, '\0', sizeof(time)); | memset(&time, '\0', sizeof(time)); |
| |
#define g2(p) ( ( (p)[0] - '0' ) * 10 + (p)[1] - '0' ) | #define g2(p) ( ( (p)[0] - '0' ) * 10 + (p)[1] - '0' ) |
| |
time.tm_year = g2(utcTime->data); |
if (utcTime->type == V_ASN1_GENERALIZEDTIME) |
|
{ |
|
time.tm_year = g2(utcTimeData) * 100; |
|
utcTimeData += 2; // Remaining data is equivalent to ASN1_UTCTIME type |
|
time.tm_year += g2(utcTimeData); |
|
} |
|
else |
|
{ |
|
time.tm_year = g2(utcTimeData); |
if(time.tm_year < 50) | if(time.tm_year < 50) |
{ | { |
time.tm_year += 100; |
time.tm_year += 2000; |
|
} |
|
else |
|
{ |
|
time.tm_year += 1900; |
} | } |
time.tm_mon = g2(utcTime->data + 2) - 1; |
} |
time.tm_mday = g2(utcTime->data + 4); |
|
time.tm_hour = g2(utcTime->data + 6); |
time.tm_mon = g2(utcTimeData + 2) - 1; |
time.tm_min = g2(utcTime->data + 8); |
time.tm_mday = g2(utcTimeData + 4); |
time.tm_sec = g2(utcTime->data + 10); |
time.tm_hour = g2(utcTimeData + 6); |
|
time.tm_min = g2(utcTimeData + 8); |
|
time.tm_sec = g2(utcTimeData + 10); |
| |
if(utcTime->data[12] == 'Z') |
if (utcTimeData[12] == 'Z') |
{ | { |
offset = 0; | offset = 0; |
} | } |
else | else |
{ | { |
offset = g2(utcTime->data + 13) * 60 + g2(utcTime->data + 15); |
offset = g2(utcTimeData + 13) * 60 + g2(utcTimeData + 15); |
if(utcTime->data[12] == '-') |
if (utcTimeData[12] == '-') |
{ | { |
plusOrMinus = '-'; | plusOrMinus = '-'; |
} | } |
} | } |
#undef g2 | #undef g2 |
| |
int year = 1900; |
|
memset((void *)&timeStamp, 0, sizeof(Timestamp_t)); | memset((void *)&timeStamp, 0, sizeof(Timestamp_t)); |
| |
// Format the date. | // Format the date. |
sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d", | sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d", |
year + time.tm_year, |
time.tm_year, |
time.tm_mon + 1, | time.tm_mon + 1, |
time.tm_mday, | time.tm_mday, |
time.tm_hour, | time.tm_hour, |
|
|
} | } |
| |
// | // |
|
// Static class used to define C++ callback functions for OpenSSL. |
|
// |
|
class SSLCallback |
|
{ |
|
|
|
public: |
|
static int verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx); |
|
static int verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore); |
|
}; |
|
|
|
// |
|
// Callback function that is called by the OpenSSL library. This function |
|
// checks whether the certificate is listed in any of the CRL's |
|
// |
|
int SSLCallback::verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore) |
|
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::verificationCRLCallback"); |
|
|
|
X509_OBJECT obj; |
|
X509_NAME *subject; |
|
X509_NAME *issuer; |
|
X509 *xs; |
|
X509_CRL *crl; |
|
X509_REVOKED *revoked; |
|
long serial; |
|
BIO *bio; |
|
int i, n, rc; |
|
char *cp; |
|
char *cp2; |
|
|
|
if (sslCRLStore == NULL) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL store is NULL"); |
|
return ok; |
|
} |
|
|
|
//ATTN: The following excerpt is based off of modssl's callback function |
|
//We may need to do something here for legal purposes. I have informed Warren of this, will resolve before 2.5 ships. |
|
|
|
/* |
|
* Determine certificate ingredients in advance |
|
*/ |
|
xs = X509_STORE_CTX_get_current_cert(ctx); |
|
subject = X509_get_subject_name(xs); |
|
issuer = X509_get_issuer_name(xs); |
|
|
|
/* |
|
* OpenSSL provides the general mechanism to deal with CRLs but does not |
|
* use them automatically when verifying certificates, so we do it |
|
* explicitly here. We will check the CRL for the currently checked |
|
* certificate, if there is such a CRL in the store. |
|
* |
|
* We come through this procedure for each certificate in the certificate |
|
* chain, starting with the root-CA's certificate. At each step we've to |
|
* both verify the signature on the CRL (to make sure it's a valid CRL) |
|
* and it's revocation list (to make sure the current certificate isn't |
|
* revoked). But because to check the signature on the CRL we need the |
|
* public key of the issuing CA certificate (which was already processed |
|
* one round before), we've a little problem. But we can both solve it and |
|
* at the same time optimize the processing by using the following |
|
* verification scheme (idea and code snippets borrowed from the GLOBUS |
|
* project): |
|
* |
|
* 1. We'll check the signature of a CRL in each step when we find a CRL |
|
* through the _subject_ name of the current certificate. This CRL |
|
* itself will be needed the first time in the next round, of course. |
|
* But we do the signature processing one round before this where the |
|
* public key of the CA is available. |
|
* |
|
* 2. We'll check the revocation list of a CRL in each step when |
|
* we find a CRL through the _issuer_ name of the current certificate. |
|
* This CRLs signature was then already verified one round before. |
|
* |
|
* This verification scheme allows a CA to revoke its own certificate as |
|
* well, of course. |
|
*/ |
|
|
|
/* |
|
* Try to retrieve a CRL corresponding to the _subject_ of |
|
* the current certificate in order to verify it's integrity. |
|
*/ |
|
|
|
memset((char *)&obj, 0, sizeof(obj)); |
|
X509_STORE_CTX pStoreCtx; |
|
X509_STORE_CTX_init(&pStoreCtx, sslCRLStore, NULL, NULL); |
|
rc = X509_STORE_get_by_subject(&pStoreCtx, X509_LU_CRL, subject, &obj); |
|
X509_STORE_CTX_cleanup(&pStoreCtx); |
|
crl = obj.data.crl; |
|
|
|
////////////////////////////////////////// |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL : return code is %d", rc); |
|
|
|
if (rc > 0 && crl != NULL) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL found"); |
|
|
|
// |
|
// Log information about CRL |
|
// (A little bit complicated because of ASN.1 and BIOs...) |
|
// |
|
bio = BIO_new(BIO_s_mem()); |
|
BIO_printf(bio, "lastUpdate: "); |
|
ASN1_UTCTIME_print(bio, X509_CRL_get_lastUpdate(crl)); |
|
BIO_printf(bio, ", nextUpdate: "); |
|
ASN1_UTCTIME_print(bio, X509_CRL_get_nextUpdate(crl)); |
|
n = BIO_pending(bio); |
|
cp = (char*) malloc(n+1); |
|
n = BIO_read(bio, cp, n); |
|
cp[n] = '\0'; |
|
BIO_free(bio); |
|
cp2 = X509_NAME_oneline(subject, NULL, 0); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL : CRL Issuer : %s, %s", cp2, cp); |
|
|
|
//ATTN: This throws a memory error |
|
//free(cp2); |
|
free(cp); |
|
|
|
// |
|
// Verify the signature on this CRL |
|
// |
|
if (X509_CRL_verify(crl, X509_get_pubkey(xs)) <= 0) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL : Invalid signature on CRL"); |
|
//ATTN: Do we need to set this? |
|
//X509_STORE_CTX_set_error(ctx, X509_V_ERR_CRL_SIGNATURE_FAILURE); |
|
//X509_OBJECT_free_contents(&obj); |
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
|
|
// |
|
// Check date of CRL to make sure it's not expired |
|
// |
|
i = X509_cmp_current_time(X509_CRL_get_nextUpdate(crl)); |
|
if (i == 0) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL2, "CRL has invalid nextUpdate field\n"); |
|
//ATTN: Do we need to set this? |
|
//X509_STORE_CTX_set_error(ctx, X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD); |
|
//X509_OBJECT_free_contents(&obj); |
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
if (i < 0) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL2, "CRL has expired\n"); |
|
//ATTN: Do we need to set this? |
|
//X509_STORE_CTX_set_error(ctx, X509_V_ERR_CRL_HAS_EXPIRED); |
|
//X509_OBJECT_free_contents(&obj); |
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
|
|
X509_OBJECT_free_contents(&obj); |
|
|
|
} else |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: No CRL for that subject found"); |
|
} |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL checks out ok\n"); |
|
|
|
// |
|
// Try to retrieve a CRL corresponding to the _issuer_ of |
|
// the current certificate in order to check for revocation. |
|
// |
|
memset((char *)&obj, 0, sizeof(obj)); |
|
|
|
X509_STORE_CTX_init(&pStoreCtx, sslCRLStore, NULL, NULL); |
|
rc = X509_STORE_get_by_subject(&pStoreCtx, X509_LU_CRL, issuer, &obj); |
|
X509_STORE_CTX_cleanup(&pStoreCtx); |
|
crl = obj.data.crl; |
|
|
|
if (rc > 0 && crl != NULL) |
|
{ |
|
// |
|
// Check if the current certificate is revoked by this CRL |
|
// |
|
#if SSL_LIBRARY_VERSION < 0x00904000 |
|
n = sk_num(X509_CRL_get_REVOKED(crl)); |
|
#else |
|
n = sk_X509_REVOKED_num(X509_CRL_get_REVOKED(crl)); |
|
#endif |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: Number of certificates revoked by the issuer %d", n); |
|
|
|
for (i = 0; i < n; i++) |
|
{ |
|
#if SSL_LIBRARY_VERSION < 0x00904000 |
|
revoked = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i); |
|
#else |
|
revoked = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i); |
|
#endif |
|
|
|
serial = ASN1_INTEGER_get(revoked->serialNumber); |
|
|
|
printf("Got serial number %ld\n", serial); |
|
|
|
if (ASN1_INTEGER_cmp(revoked->serialNumber, X509_get_serialNumber(xs)) == 0) |
|
{ |
|
serial = ASN1_INTEGER_get(revoked->serialNumber); |
|
cp = X509_NAME_oneline(issuer, NULL, 0); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"---> SSL : Certificate with serial %ld revoked per CRL from issuer %s\n", serial, cp); |
|
//ATTN: Mem error if uncomment following |
|
//free(cp); |
|
|
|
X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED); |
|
X509_OBJECT_free_contents(&obj); |
|
|
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
} |
|
|
|
X509_OBJECT_free_contents(&obj); |
|
} |
|
|
|
PEG_METHOD_EXIT(); |
|
return ok; |
|
} |
|
|
|
// |
// Callback function that is called by the OpenSSL library. This function | // Callback function that is called by the OpenSSL library. This function |
// extracts X509 certficate information and pass that on to client application | // extracts X509 certficate information and pass that on to client application |
// callback function. | // callback function. |
|
// We HAVE to build the certificate in all cases since it's needed to get the associated username out of the repository |
|
// later in the transaction |
// | // |
int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "prepareForCallback()"); |
PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()"); |
| |
char buf[256]; | char buf[256]; |
X509 *currentCert; | X509 *currentCert; |
SSL *ssl; | SSL *ssl; |
int verifyError = X509_V_OK; | int verifyError = X509_V_OK; |
|
int revoked = -1; |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"--->SSL: Preverify Error %d", verifyError); |
| |
// | // |
// get the verification callback info specific to each SSL connection | // get the verification callback info specific to each SSL connection |
// | // |
ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); | ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); |
SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSL_CALLBACK_INDEX); |
SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX); |
| |
// | // |
// If the SSLContext does not have an additional callback | // If the SSLContext does not have an additional callback |
// simply return the preverification error. |
// simply return the preverification error (or check the CRL) |
// We do not need to go through the additional steps. | // We do not need to go through the additional steps. |
// | // |
if (exData->verifyCertificateCallback == NULL) | if (exData->verifyCertificateCallback == NULL) |
{ | { |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"--->SSL: No verification callback specified"); |
|
|
|
if (exData->_crlStore == NULL) |
|
{ |
|
PEG_METHOD_EXIT(); |
return (preVerifyOk); | return (preVerifyOk); |
|
} else |
|
{ |
|
revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_crlStore); |
|
PEG_METHOD_EXIT(); |
|
return (revoked); |
|
} |
|
} |
|
|
|
// |
|
// Check to see if a CRL path is defined |
|
// |
|
if (exData->_crlStore) |
|
{ |
|
revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_crlStore); |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"---> SSL: CRL callback returned %d", revoked); |
} | } |
| |
// | // |
|
|
// | // |
if (!preVerifyOk) | if (!preVerifyOk) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"---> SSL: certificate default verification error: " + errorStr); |
"---> SSL: certificate default verification error: %s", (const char*)errorStr.getCString()); |
} | } |
| |
// | // |
|
|
} | } |
String issuerName = String(buf); | String issuerName = String(buf); |
| |
// SSLCertificateInfo certInfo(subjectName, issuerName, version, serialNumber, |
// |
// notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk); |
// Create the certificate object |
|
// |
exData->_peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber, | exData->_peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber, |
notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk); | notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk); |
| |
|
|
// This is because OpenSSL retains the original default error in case we want to use it later. | // This is because OpenSSL retains the original default error in case we want to use it later. |
// To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here. | // To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here. |
// | // |
if (exData->verifyCertificateCallback(*exData->_peerCertificate))//certInfo)) |
if (exData->verifyCertificateCallback(*exData->_peerCertificate)) |
{ | { |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"--> SSL: verifyCertificateCallback() returned X509_V_OK"); | "--> SSL: verifyCertificateCallback() returned X509_V_OK"); |
|
|
} | } |
| |
// | // |
|
// Callback function called by OpenSSL. This request is merely forwarded to the static |
|
// function SSLCallback::callback(). The SSLCallback class is a friend class of the |
|
// Pegasus SSL related classes needed to complete the callback. |
|
// |
|
extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
|
{ |
|
return SSLCallback::verificationCallback(preVerifyOk, ctx); |
|
} |
|
|
|
// |
// Implement OpenSSL locking callback. | // Implement OpenSSL locking callback. |
// | // |
void pegasus_locking_callback( int mode, | void pegasus_locking_callback( int mode, |
|
|
| |
// Set the ID callback. The ID callback returns a thread ID. | // Set the ID callback. The ID callback returns a thread ID. |
| |
CRYPTO_set_id_callback((unsigned long (*)())pegasus_thread_self); |
CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK) pegasus_thread_self); |
| |
// Set the locking callback to pegasus_locking_callback. | // Set the locking callback to pegasus_locking_callback. |
| |
CRYPTO_set_locking_callback((void (*)(int,int,const char *,int))pegasus_locking_callback); |
CRYPTO_set_locking_callback((CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback); |
| |
} | } |
| |
|
|
const String& trustStore, | const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
|
const String& crlPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
Boolean trustStoreAutoUpdate, |
|
String trustStoreUserName, |
|
const String& randomFile) | const String& randomFile) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
|
|
| |
_keyPath = keyPath; | _keyPath = keyPath; |
| |
_certificateVerifyFunction = verifyCert; |
_crlPath = crlPath; |
| |
_trustStoreAutoUpdate = trustStoreAutoUpdate; |
_crlStore = NULL; |
| |
_trustStoreUserName = trustStoreUserName; |
_certificateVerifyFunction = verifyCert; |
| |
// | // |
// If a truststore and/or peer verification function is specified, enable peer verification | // If a truststore and/or peer verification function is specified, enable peer verification |
|
|
// | // |
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. | // Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
// | // |
_countRepMutex.lock(pegasus_thread_self()); |
|
|
|
try |
|
{ | { |
|
AutoMutex autoMut(_countRepMutex); |
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Value of Countrep in constructor %d", _countRep); | "Value of Countrep in constructor %d", _countRep); |
if ( _countRep == 0 ) | if ( _countRep == 0 ) |
|
|
"After calling SSL_library_init %d", pegasus_thread_self()); | "After calling SSL_library_init %d", pegasus_thread_self()); |
| |
} | } |
} |
|
catch(...) |
|
{ |
|
_countRepMutex.unlock(); |
|
throw; |
|
} |
|
_countRep++; | _countRep++; |
_countRepMutex.unlock(); |
} // mutex unlocks here |
| |
_randomInit(randomFile); | _randomInit(randomFile); |
| |
|
|
_trustStore = sslContextRep._trustStore; | _trustStore = sslContextRep._trustStore; |
_certPath = sslContextRep._certPath; | _certPath = sslContextRep._certPath; |
_keyPath = sslContextRep._keyPath; | _keyPath = sslContextRep._keyPath; |
|
_crlPath = sslContextRep._crlPath; |
_verifyPeer = sslContextRep._verifyPeer; | _verifyPeer = sslContextRep._verifyPeer; |
_trustStoreAutoUpdate = sslContextRep._trustStoreAutoUpdate; |
|
_trustStoreUserName = sslContextRep._trustStoreUserName; |
|
_certificateVerifyFunction = sslContextRep._certificateVerifyFunction; | _certificateVerifyFunction = sslContextRep._certificateVerifyFunction; |
_randomFile = sslContextRep._randomFile; | _randomFile = sslContextRep._randomFile; |
| |
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. | // Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
_countRepMutex.lock(pegasus_thread_self()); |
|
try |
|
{ | { |
|
AutoMutex autoMut(_countRepMutex); |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Value of Countrep in copy constructor %d", _countRep); | "Value of Countrep in copy constructor %d", _countRep); |
if ( _countRep == 0 ) | if ( _countRep == 0 ) |
{ | { |
init_ssl(); | init_ssl(); |
} | } |
} |
|
catch(...) |
|
{ |
|
_countRepMutex.unlock(); |
|
throw; |
|
} |
|
_countRep++; | _countRep++; |
_countRepMutex.unlock(); |
} // mutex unlocks here |
| |
_sslContext = _makeSSLContext(); | _sslContext = _makeSSLContext(); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
|
|
SSL_CTX_free(_sslContext); | SSL_CTX_free(_sslContext); |
| |
// Decrement the SSLContextRep object _counter. | // Decrement the SSLContextRep object _counter. |
_countRepMutex.lock(pegasus_thread_self()); |
{ |
|
AutoMutex autoMut(_countRepMutex); |
_countRep--; | _countRep--; |
// Free SSL locks if no instances of SSLContextRep exist. | // Free SSL locks if no instances of SSLContextRep exist. |
try |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Value of Countrep in destructor %d", _countRep); | "Value of Countrep in destructor %d", _countRep); |
if ( _countRep == 0 ) | if ( _countRep == 0 ) |
{ | { |
free_ssl(); | free_ssl(); |
} | } |
|
|
} | } |
catch(...) |
|
{ |
|
_countRepMutex.unlock(); |
|
throw; |
|
} |
|
_countRepMutex.unlock(); |
|
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
} | } |
| |
|
|
Boolean ret; | Boolean ret; |
int retVal = 0; | int retVal = 0; |
| |
const int DEV_RANDOM_BYTES = 64; /* how many bytes to read */ |
|
const String devRandom = "/dev/random"; /* random device name */ |
|
const String devUrandom = "/dev/urandom"; /* pseudo-random device name */ |
|
|
|
#ifdef PEGASUS_SSL_DEVRANDOM |
|
|
|
if ( FileSystem::exists(devRandom) ) |
|
{ |
|
while ( RAND_status() == 0 ) |
|
{ |
|
// |
|
// Always attempt to seed from good entropy sources, first |
|
// try /dev/random |
|
// |
|
retVal = RAND_load_file(devRandom.getCString(), DEV_RANDOM_BYTES); |
|
if (retVal <= 0) |
|
{ |
|
break; |
|
} |
|
} |
|
} |
|
|
|
if ( FileSystem::exists(devUrandom) ) |
|
{ |
|
while ( RAND_status() == 0 ) |
|
{ |
|
// |
|
// If there isn't /dev/random try /dev/urandom |
|
// |
|
retVal = RAND_load_file(devUrandom.getCString(), DEV_RANDOM_BYTES); |
|
if (retVal <= 0) |
|
{ |
|
break; |
|
} |
|
} |
|
} |
|
#endif /* PEGASUS_SSL_DEVRANDOM */ |
|
|
|
|
|
#ifdef PEGASUS_SSL_RANDOMFILE | #ifdef PEGASUS_SSL_RANDOMFILE |
if ( RAND_status() == 0 ) | if ( RAND_status() == 0 ) |
{ | { |
|
|
} | } |
} | } |
| |
|
if (_crlPath != String::EMPTY) |
|
{ |
|
//need to save this -- can we make it static since there's only one CRL for cimserver? |
|
X509_LOOKUP* pLookup; |
|
|
|
_crlStore = X509_STORE_new(); |
|
|
|
//the validity of the crlstore was checked in ConfigManager during server startup |
|
if (FileSystem::isDirectory(_crlPath)) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: CRL store is a directory in %s", (const char*)_crlPath.getCString()); |
|
|
|
if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_hash_dir())) == NULL) |
|
{ |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS", |
|
"Could not load certificate revocation list."); |
|
X509_STORE_free(_crlStore); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
|
|
X509_LOOKUP_add_dir(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM); |
|
|
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Successfully configured CRL directory"); |
|
|
|
} else |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: CRL store is the file %s", (const char*)_crlPath.getCString()); |
|
|
|
if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_file())) == NULL) |
|
{ |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS", |
|
"Could not load certificate revocation list."); |
|
X509_STORE_free(_crlStore); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
|
|
X509_LOOKUP_load_file(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM); |
|
|
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Successfully configured CRL file"); |
|
} |
|
} |
|
|
Boolean keyLoaded = false; | Boolean keyLoaded = false; |
| |
// | // |
|
|
return _keyPath; | return _keyPath; |
} | } |
| |
Boolean SSLContextRep::isPeerVerificationEnabled() const |
String SSLContextRep::getCRLPath() const |
{ | { |
return _verifyPeer; |
return _crlPath; |
} | } |
| |
Boolean SSLContextRep::isTrustStoreAutoUpdateEnabled() const |
X509_STORE* SSLContextRep::getCRLStore() const |
{ | { |
return _trustStoreAutoUpdate; |
return _crlStore; |
} | } |
| |
String SSLContextRep::getTrustStoreUserName() const |
Boolean SSLContextRep::isPeerVerificationEnabled() const |
{ | { |
return _trustStoreUserName; |
return _verifyPeer; |
} | } |
| |
SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const | SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const |
|
|
SSLContextRep::SSLContextRep(const String& trustStore, | SSLContextRep::SSLContextRep(const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
|
const String& crlPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
Boolean trustStoreAutoUpdate, |
const String& randomFile) |
String trustStoreUserName, |
{} |
const String& randomFile) {} |
|
| |
SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {} | SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {} |
| |
|
|
| |
String SSLContextRep::getKeyPath() const { return String::EMPTY; } | String SSLContextRep::getKeyPath() const { return String::EMPTY; } |
| |
Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } |
String SSLContextRep::getCRLPath() const { return String::EMPTY; } |
| |
Boolean SSLContextRep::isTrustStoreAutoUpdateEnabled() const { return false; } |
X509_STORE* SSLContextRep::getCRLStore() const { return NULL; } |
| |
String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; } |
Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } |
| |
SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; } | SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; } |
| |
|
|
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, verifyCert, false, String::EMPTY, randomFile); |
_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, String::EMPTY, verifyCert, randomFile); |
} |
|
|
|
SSLContext::SSLContext( |
|
const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile) |
|
{ |
|
_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, String::EMPTY, randomFile); |
|
} | } |
| |
SSLContext::SSLContext( | SSLContext::SSLContext( |
|
|
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
String trustStoreUserName, |
|
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, trustStoreUserName, randomFile); |
_rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile); |
} | } |
| |
#ifdef PEGASUS_USE_AUTOMATIC_TRUSTSTORE_UPDATE |
//PEP187 |
SSLContext::SSLContext( | SSLContext::SSLContext( |
const String& trustStore, | const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
|
const String& crlPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
Boolean trustStoreAutoUpdate, |
|
String trustStoreUserName, |
|
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, trustStoreAutoUpdate, trustStoreUserName, randomFile); |
_rep = new SSLContextRep(trustStore, certPath, keyPath, crlPath, verifyCert, randomFile); |
} | } |
#endif |
|
|
|
| |
SSLContext::SSLContext(const SSLContext& sslContext) | SSLContext::SSLContext(const SSLContext& sslContext) |
{ | { |
|
|
return (_rep->getKeyPath()); | return (_rep->getKeyPath()); |
} | } |
| |
Boolean SSLContext::isPeerVerificationEnabled() const |
String SSLContext::getCRLPath() const |
{ | { |
return (_rep->isPeerVerificationEnabled()); |
return (_rep->getCRLPath()); |
} | } |
| |
#ifdef PEGASUS_USE_AUTOMATIC_TRUSTSTORE_UPDATE |
X509_STORE* SSLContext::getCRLStore() const |
Boolean SSLContext::isTrustStoreAutoUpdateEnabled() const |
|
{ | { |
return (_rep->isTrustStoreAutoUpdateEnabled()); |
return (_rep->getCRLStore()); |
} | } |
#endif |
|
| |
String SSLContext::getTrustStoreUserName() const |
Boolean SSLContext::isPeerVerificationEnabled() const |
{ | { |
return (_rep->getTrustStoreUserName()); |
return (_rep->isPeerVerificationEnabled()); |
} | } |
| |
SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const | SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const |
|
|
return s; | return s; |
} | } |
| |
SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert) |
SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert, X509_STORE* crlStore) |
{ | { |
verifyCertificateCallback = verifyCert; | verifyCertificateCallback = verifyCert; |
|
_crlStore = crlStore; |
_peerCertificate = NULL; | _peerCertificate = NULL; |
} | } |
| |