pegasus/src/Pegasus/Common/SSLContext.cpp - diff

Return to SSLContext.cpp CVS log

Up to [Pegasus] / pegasus / src / Pegasus / Common

Diff for /pegasus/src/Pegasus/Common/SSLContext.cpp between version 1.31 and 1.62

version 1.31, 2004/06/30 15:09:53

version 1.62, 2006/01/03 15:00:52

Line 1

//%2003////////////////////////////////////////////////////////////////////////

//%2005////////////////////////////////////////////////////////////////////////

// Company, L. P., IBM Corp., The Open Group, Tivoli Systems.

// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.

// IBM Corp.; EMC Corporation, The Open Group.

// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.

// EMC Corporation; VERITAS Software Corporation; The Open Group.

// Permission is hereby granted, free of charge, to any person obtaining a copy

// of this software and associated documentation files (the "Software"), to

Line 29

Line 33

// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com)

// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com)

// Heather Sterling, IBM (hsterl@us.ibm.com)

// Amit K Arora, IBM (amita@in.ibm.com) for Bug#1090

// David Dillard, Symantec Corp. (david_dillard@symantec.com)

// Aruran, IBM (ashanmug@in.ibm.com) for Bug#4422

//%/////////////////////////////////////////////////////////////////////////////

#ifdef PEGASUS_HAS_SSL

#include <Pegasus/Common/Config.h>

#ifdef PEGASUS_OS_TYPE_WINDOWS

//Bugzilla 2366

//Use the X509_NAME in wincrypt.h on Windows. See X509.h for more info.

#include <windows.h>

#include <wincrypt.h>

#endif

#define OPENSSL_NO_KRB5 1

#include <openssl/err.h>

#include <openssl/ssl.h>

Line 40

Line 57

#else

#define SSL_CTX void

#endif // end of PEGASUS_HAS_SSL

#include <Pegasus/Common/Destroyer.h>

#include <Pegasus/Common/Socket.h>

#include <Pegasus/Common/Tracer.h>

#include <Pegasus/Common/FileSystem.h>

#include <time.h>

#include <Pegasus/Common/MessageLoader.h> //l10n

#include <Pegasus/Common/Formatter.h>

#include "SSLContext.h"

#include "SSLContextRep.h"

#ifdef PEGASUS_OS_OS400

#include "SSLWrapperOS400.h"

#endif

// Typedef's for OpenSSL callback functions.

extern "C"

{

typedef void (* CRYPTO_SET_LOCKING_CALLBACK)(int, int, const char *, int);

typedef unsigned long (* CRYPTO_SET_ID_CALLBACK)(void);

};

typedef struct x509_store_ctx_st X509_STORE_CTX;

typedef struct Timestamp

{

char year[4];

Line 69

Line 101

PEGASUS_NAMESPACE_BEGIN

const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0;

// use the following definitions only if SSL is available

#ifdef PEGASUS_HAS_SSL

// Mutex for SSL locks.

// Mutex for SSL locks which will get initialized by AutoArrayPtr constructor.

Mutex* SSLContextRep::_sslLocks = 0;

AutoArrayPtr<Mutex> SSLContextRep::_sslLocks;

// Mutex for _countRep.

Mutex SSLContextRep::_countRepMutex;

Line 94

Line 128

Timestamp_t timeStamp;

char tempString[80];

char plusOrMinus = '+';

unsigned char* utcTimeData = utcTime->data;

memset(&time, '\0', sizeof(time));

#define g2(p) ( ( (p)[0] - '0' ) * 10 + (p)[1] - '0' )

time.tm_year = g2(utcTime->data);

if (utcTime->type == V_ASN1_GENERALIZEDTIME)

{

time.tm_year = g2(utcTimeData) * 100;

utcTimeData += 2; // Remaining data is equivalent to ASN1_UTCTIME type

time.tm_year += g2(utcTimeData);

}

else

{

time.tm_year = g2(utcTimeData);

if(time.tm_year < 50)

{

time.tm_year += 100;

time.tm_year += 2000;

}

time.tm_mon = g2(utcTime->data + 2) - 1;

else

time.tm_mday = g2(utcTime->data + 4);

{

time.tm_hour = g2(utcTime->data + 6);

time.tm_year += 1900;

time.tm_min = g2(utcTime->data + 8);

}

time.tm_sec = g2(utcTime->data + 10);

}

time.tm_mon = g2(utcTimeData + 2) - 1;

time.tm_mday = g2(utcTimeData + 4);

time.tm_hour = g2(utcTimeData + 6);

time.tm_min = g2(utcTimeData + 8);

time.tm_sec = g2(utcTimeData + 10);

if(utcTime->data[12] == 'Z')

if (utcTimeData[12] == 'Z')

{

offset = 0;

}

else

{

offset = g2(utcTime->data + 13) * 60 + g2(utcTime->data + 15);

offset = g2(utcTimeData + 13) * 60 + g2(utcTimeData + 15);

if(utcTime->data[12] == '-')

if (utcTimeData[12] == '-')

{

plusOrMinus = '-';

}

#undef g2

int year = 1900;

memset((void *)&timeStamp, 0, sizeof(Timestamp_t));

// Format the date.

sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d",

year + time.tm_year,

time.tm_year,

time.tm_mon + 1,

time.tm_mday,

time.tm_hour,

Line 151

Line 198

}

// Static class used to define C++ callback functions for OpenSSL.

class SSLCallback

{

public:

static int verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx);

static int verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore);

};

// Callback function that is called by the OpenSSL library. This function

// checks whether the certificate is listed in any of the CRL's

// return 1 if revoked, 0 otherwise

int SSLCallback::verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore)

{

PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::verificationCRLCallback");

char buf[1024];

//check whether a CRL store was specified

if (sslCRLStore == NULL)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: CRL store is NULL");

PEG_METHOD_EXIT();

return 0;

}

//get the current certificate info

X509* currentCert;

X509_NAME* issuerName;

X509_NAME* subjectName;

ASN1_INTEGER* serialNumber;

currentCert = X509_STORE_CTX_get_current_cert(ctx);

subjectName = X509_get_subject_name(currentCert);

issuerName = X509_get_issuer_name(currentCert);

serialNumber = X509_get_serialNumber(currentCert);

//log certificate information

//this is information in the "public" key, so it does no harm to log it

X509_NAME_oneline(issuerName, buf, sizeof(buf));

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Certificate Data: Issuer/Subject");

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, buf);

X509_NAME_oneline(subjectName, buf, sizeof(buf));

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, buf);

//initialize the CRL store

X509_STORE_CTX crlStoreCtx;

X509_STORE_CTX_init(&crlStoreCtx, sslCRLStore, NULL, NULL);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Initialized CRL store");

//attempt to get a CRL issued by the certificate's issuer

X509_OBJECT obj;

if (X509_STORE_get_by_subject(&crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: No CRL by that issuer");

PEG_METHOD_EXIT();

return 0;

}

X509_STORE_CTX_cleanup(&crlStoreCtx);

//get CRL

X509_CRL* crl = obj.data.crl;

if (crl == NULL)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL is null");

PEG_METHOD_EXIT();

return 0;

} else

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Found CRL by that issuer");

}

//get revoked certificates

STACK_OF(X509_REVOKED)* revokedCerts = NULL;

revokedCerts = X509_CRL_get_REVOKED(crl);

int numRevoked = sk_X509_REVOKED_num(revokedCerts);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,"---> SSL: Number of certificates revoked by the issuer %d\n", numRevoked);

//check whether the subject's certificate is revoked

X509_REVOKED* revokedCert = NULL;

for (int i = 0; i < sk_X509_REVOKED_num(revokedCerts); i++)

{

revokedCert = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i);

//a matching serial number indicates revocation

if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, "---> SSL: Certificate is revoked");

X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED);

PEG_METHOD_EXIT();

return 1;

}

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Certificate is not revoked at this level");

PEG_METHOD_EXIT();

return 0;

}

// Callback function that is called by the OpenSSL library. This function

// extracts X509 certficate information and pass that on to client application

// callback function.

// We HAVE to build the certificate in all cases since it's needed to get the associated username out of the repository

// later in the transaction

int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx)

int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx)

{

PEG_METHOD_ENTER(TRC_SSL, "prepareForCallback()");

PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()");

char buf[256];

X509 *currentCert;

SSL *ssl;

int verifyError = X509_V_OK;

int revoked = -1;

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--->SSL: Preverify Error %d", verifyError);

// get the verification callback info specific to each SSL connection

ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());

SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSL_CALLBACK_INDEX);

SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX);

// If the SSLContext does not have an additional callback

// Check to see if a CRL path is defined

// simply return the preverification error.

// We do not need to go through the additional steps.

if (exData->verifyCertificateCallback == NULL)

if (exData->_rep->crlStore != NULL)

{

revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_rep->crlStore);

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL callback returned %d", revoked);

if (revoked) //with the SSL callbacks '0' indicates failure

{

return (preVerifyOk);

PEG_METHOD_EXIT();

return 0;

}

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL callback returned %d", revoked);

// get the current certificate

Line 228

Line 395

if (!preVerifyOk)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"---> SSL: certificate default verification error: " + errorStr);

"---> SSL: certificate default verification error: %s", (const char*)errorStr.getCString());

}

Line 245

Line 412

}

String issuerName = String(buf);

// SSLCertificateInfo certInfo(subjectName, issuerName, version, serialNumber,

// notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk);

// Create the certificate object

if (exData->_rep->peerCertificate != NULL)

{

//Delete an existing certificate object from a previous call.

//SSL validates the certificate chain starting with the root CA and working down to the peer certificate.

//With this strategy, we end up with the peer certificate as the last certificate stored in the SSLCallbackInfo

//so we can retrieve the correct certificate info and username.

delete exData->_rep->peerCertificate;

exData->_rep->peerCertificate = NULL;

}

exData->_peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber,

exData->_rep->peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber,

notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk);

// Call the application callback.

// Call the user-specified application callback if it is specified. If it is null, return OpenSSL's verification code.

// Note that the verification result does not automatically get set to X509_V_OK if the callback is successful.

// This is because OpenSSL retains the original default error in case we want to use it later.

// To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here.

if (exData->verifyCertificateCallback(*exData->_peerCertificate))//certInfo))

if (exData->_rep->verifyCertificateCallback == NULL)

{

return preVerifyOk;

} else

{

if (exData->_rep->verifyCertificateCallback(*exData->_rep->peerCertificate))

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--> SSL: verifyCertificateCallback() returned X509_V_OK");

"--> SSL: _rep->verifyCertificateCallback() returned X509_V_OK");

PEG_METHOD_EXIT();

return 1;

Line 268

Line 451

else // verification failed, handshake will be immediately terminated

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--> SSL: verifyCertificateCallback() returned error %d", exData->_peerCertificate->getErrorCode());

"--> SSL: _rep->verifyCertificateCallback() returned error %d", exData->_rep->peerCertificate->getErrorCode());

PEG_METHOD_EXIT();

return 0;

}

// Callback function called by OpenSSL. This request is merely forwarded to the static

// function SSLCallback::callback(). The SSLCallback class is a friend class of the

// Pegasus SSL related classes needed to complete the callback.

extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx)

{

return SSLCallback::verificationCallback(preVerifyOk, ctx);

}

// Implement OpenSSL locking callback.

Line 289

Line 483

{

/*Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Now locking for %d", pegasus_thread_self());*/

SSLContextRep::_sslLocks[type].lock( pegasus_thread_self() );

SSLContextRep::_sslLocks.get()[type].lock( pegasus_thread_self() );

}

else

{

/*Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Now unlocking for %d", pegasus_thread_self());*/

SSLContextRep::_sslLocks[type].unlock( );

SSLContextRep::_sslLocks.get()[type].unlock( );

}

Line 309

Line 503

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

"Initialized SSL callback.");

_sslLocks= new Mutex[CRYPTO_num_locks()];

#ifdef PEGASUS_OS_OS400

// Load the OpenSSL library and get the exports

SSL_OS400_Init();

#endif

_sslLocks.reset(new Mutex[CRYPTO_num_locks()]);

// Set the ID callback. The ID callback returns a thread ID.

CRYPTO_set_id_callback((unsigned long (*)())pegasus_thread_self);

CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK) pegasus_thread_self);

// Set the locking callback to pegasus_locking_callback.

CRYPTO_set_locking_callback((void (*)(int,int,const char *,int))pegasus_locking_callback);

CRYPTO_set_locking_callback((CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback);

}

Line 330

Line 529

CRYPTO_set_id_callback (NULL);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

"Freed SSL callback.");

_sslLocks.reset();

delete []_sslLocks;

}

Line 345

Line 543

const String& trustStore,

const String& certPath,

const String& keyPath,

const String& crlPath,

SSLCertificateVerifyFunction* verifyCert,

Boolean trustStoreAutoUpdate,

String trustStoreUserName,

const String& randomFile)

{

PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()");

Line 358

Line 555

_keyPath = keyPath;

_certificateVerifyFunction = verifyCert;

_crlPath = crlPath;

_trustStoreAutoUpdate = trustStoreAutoUpdate;

_crlStore = NULL;

_trustStoreUserName = trustStoreUserName;

_certificateVerifyFunction = verifyCert;

// If a truststore and/or peer verification function is specified, enable peer verification

Line 379

Line 576

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

_countRepMutex.lock(pegasus_thread_self());

try

{

AutoMutex autoMut(_countRepMutex);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in constructor %d", _countRep);

if ( _countRep == 0 )

Line 409

Line 605

"After calling SSL_library_init %d", pegasus_thread_self());

}

catch(...)

{

_countRepMutex.unlock();

throw;

}

_countRep++;

_countRepMutex.unlock();

} // mutex unlocks here

_randomInit(randomFile);

Line 432

Line 623

_trustStore = sslContextRep._trustStore;

_certPath = sslContextRep._certPath;

_keyPath = sslContextRep._keyPath;

_crlPath = sslContextRep._crlPath;

_crlStore = sslContextRep._crlStore;

_verifyPeer = sslContextRep._verifyPeer;

_trustStoreAutoUpdate = sslContextRep._trustStoreAutoUpdate;

_trustStoreUserName = sslContextRep._trustStoreUserName;

_certificateVerifyFunction = sslContextRep._certificateVerifyFunction;

_randomFile = sslContextRep._randomFile;

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

_countRepMutex.lock(pegasus_thread_self());

try

{

AutoMutex autoMut(_countRepMutex);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in copy constructor %d", _countRep);

if ( _countRep == 0 )

{

init_ssl();

}

catch(...)

{

_countRepMutex.unlock();

throw;

}

_countRep++;

_countRepMutex.unlock();

} // mutex unlocks here

_sslContext = _makeSSLContext();

PEG_METHOD_EXIT();

Line 472

Line 657

SSL_CTX_free(_sslContext);

// Decrement the SSLContextRep object _counter.

_countRepMutex.lock(pegasus_thread_self());

{

AutoMutex autoMut(_countRepMutex);

_countRep--;

// Free SSL locks if no instances of SSLContextRep exist.

try

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in destructor %d", _countRep);

if ( _countRep == 0 )

{

free_ssl();

}

catch(...)

{

_countRepMutex.unlock();

throw;

}

_countRepMutex.unlock();

PEG_METHOD_EXIT();

}

Line 503

Line 683

Boolean ret;

int retVal = 0;

const int DEV_RANDOM_BYTES = 64; /* how many bytes to read */

const String devRandom = "/dev/random"; /* random device name */

const String devUrandom = "/dev/urandom"; /* pseudo-random device name */

#ifdef PEGASUS_SSL_DEVRANDOM

if ( FileSystem::exists(devRandom) )

{

while ( RAND_status() == 0 )

{

// Always attempt to seed from good entropy sources, first

// try /dev/random

retVal = RAND_load_file(devRandom.getCString(), DEV_RANDOM_BYTES);

if (retVal <= 0)

{

break;

}

if ( FileSystem::exists(devUrandom) )

{

while ( RAND_status() == 0 )

{

// If there isn't /dev/random try /dev/urandom

retVal = RAND_load_file(devUrandom.getCString(), DEV_RANDOM_BYTES);

if (retVal <= 0)

{

break;

}

#endif /* PEGASUS_SSL_DEVRANDOM */

#ifdef PEGASUS_SSL_RANDOMFILE

if ( RAND_status() == 0 )

{

Line 600

Line 741

// Try to do more seeding

long seedNumber;

#if defined(PEGASUS_PLATFORM_WIN32_IX86_MSVC)

#if defined(PEGASUS_COMPILER_MSVC)

srand((unsigned int)time(NULL)); // Initialize

seedNumber = rand();

#else

Line 680

Line 821

SSL_CTX_set_quiet_shutdown(sslContext, 1);

SSL_CTX_set_mode(sslContext, SSL_MODE_AUTO_RETRY);

SSL_CTX_set_options(sslContext,SSL_OP_ALL);

SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF);

int options = SSL_OP_ALL;

#ifndef PEGASUS_ENABLE_SSLV2 //SSLv2 is disabled by default

options |= SSL_OP_NO_SSLv2;

#endif

SSL_CTX_set_options(sslContext, options);

if (_verifyPeer)

{

//ATTN: We might still need a flag to specify SSL_VERIFY_FAIL_IF_NO_PEER_CERT

Line 793

Line 939

}

if (_crlPath != String::EMPTY)

{

//need to save this -- can we make it static since there's only one CRL for cimserver?

X509_LOOKUP* pLookup;

_crlStore = X509_STORE_new();

//the validity of the crlstore was checked in ConfigManager during server startup

if (FileSystem::isDirectory(_crlPath))

{

Tracer::trace(TRC_SSL, Tracer::LEVEL3,

"---> SSL: CRL store is a directory in %s", (const char*)_crlPath.getCString());

if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_hash_dir())) == NULL)

{

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS",

"Could not load certificate revocation list.");

X509_STORE_free(_crlStore);

PEG_METHOD_EXIT();

throw SSLException(parms);

}

X509_LOOKUP_add_dir(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Successfully configured CRL directory");

} else

{

Tracer::trace(TRC_SSL, Tracer::LEVEL3,

"---> SSL: CRL store is the file %s", (const char*)_crlPath.getCString());

if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_file())) == NULL)

{

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS",

"Could not load certificate revocation list.");

X509_STORE_free(_crlStore);

PEG_METHOD_EXIT();

throw SSLException(parms);

}

X509_LOOKUP_load_file(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Successfully configured CRL file");

}

Boolean keyLoaded = false;

Line 913

Line 1107

return _keyPath;

}

Boolean SSLContextRep::isPeerVerificationEnabled() const

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

String SSLContextRep::getTrustStoreUserName() const

{

return _verifyPeer;

return String::EMPTY;

}

#endif

Boolean SSLContextRep::isTrustStoreAutoUpdateEnabled() const

String SSLContextRep::getCRLPath() const

{

return _trustStoreAutoUpdate;

return _crlPath;

}

String SSLContextRep::getTrustStoreUserName() const

X509_STORE* SSLContextRep::getCRLStore() const

{

return _trustStoreUserName;

return _crlStore;

}

void SSLContextRep::setCRLStore(X509_STORE* store)

{

_crlStore = store;

}

Boolean SSLContextRep::isPeerVerificationEnabled() const

{

return _verifyPeer;

}

SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const

Line 942

Line 1148

SSLContextRep::SSLContextRep(const String& trustStore,

const String& certPath,

const String& keyPath,

const String& crlPath,

SSLCertificateVerifyFunction* verifyCert,

Boolean trustStoreAutoUpdate,

const String& randomFile)

String trustStoreUserName,

{}

const String& randomFile) {}

SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {}

Line 964

Line 1170

String SSLContextRep::getKeyPath() const { return String::EMPTY; }

Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; }

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; }

#endif

Boolean SSLContextRep::isTrustStoreAutoUpdateEnabled() const { return false; }

String SSLContextRep::getCRLPath() const { return String::EMPTY; }

String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; }

X509_STORE* SSLContextRep::getCRLStore() const { return NULL; }

void SSLContextRep::setCRLStore(X509_STORE* store) { }

Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; }

SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; }

Line 990

Line 1202

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, verifyCert, false, String::EMPTY, randomFile);

_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, String::EMPTY, verifyCert, randomFile);

}

SSLContext::SSLContext(

Line 1000

Line 1212

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, String::EMPTY, randomFile);

_rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile);

}

//PEP187

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

const String& keyPath,

const String& crlPath,

SSLCertificateVerifyFunction* verifyCert,

String trustStoreUserName,

const String& randomFile)

{

_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, trustStoreUserName, randomFile);

_rep = new SSLContextRep(trustStore, certPath, keyPath, crlPath, verifyCert, randomFile);

}

#ifdef PEGASUS_USE_AUTOMATIC_TRUSTSTORE_UPDATE

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

Boolean trustStoreAutoUpdate,

String trustStoreUserName,

const String& randomFile)

{

_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, trustStoreAutoUpdate, trustStoreUserName, randomFile);

_rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile);

}

#endif

SSLContext::SSLContext(const SSLContext& sslContext)

{

_rep = new SSLContextRep(*sslContext._rep);

Line 1059

Line 1270

return (_rep->getKeyPath());

}

Boolean SSLContext::isPeerVerificationEnabled() const

String SSLContext::getCRLPath() const

{

return (_rep->isPeerVerificationEnabled());

return (_rep->getCRLPath());

}

#ifdef PEGASUS_USE_AUTOMATIC_TRUSTSTORE_UPDATE

X509_STORE* SSLContext::getCRLStore() const

Boolean SSLContext::isTrustStoreAutoUpdateEnabled() const

{

return (_rep->isTrustStoreAutoUpdateEnabled());

return (_rep->getCRLStore());

}

#endif

Boolean SSLContext::isPeerVerificationEnabled() const

{

return (_rep->isPeerVerificationEnabled());

}

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

String SSLContext::getTrustStoreUserName() const

{

return (_rep->getTrustStoreUserName());

}

#endif

SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const

{

Line 1302

Line 1518

sprintf(buf, "Version number: %d\n", _rep->versionNumber);

s.append(buf);

sprintf(buf, "Serial number: %ld\n", _rep->serialNumber);

sprintf(buf, "Serial number: %lu\n", _rep->serialNumber);

s.append(buf);

s.append("Not before date: ");

Line 1316

Line 1532

return s;

}

///////////////////////////////////////////////////////////////////////////////

// SSLCallbackInfo

///////////////////////////////////////////////////////////////////////////////

SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert)

{

verifyCertificateCallback = verifyCert;

_rep = new SSLCallbackInfoRep();

_peerCertificate = NULL;

_rep->verifyCertificateCallback = verifyCert;

_rep->crlStore = NULL;

_rep->peerCertificate = NULL;

}

SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert, X509_STORE* crlStore)

{

_rep = new SSLCallbackInfoRep();

_rep->verifyCertificateCallback = verifyCert;

_rep->crlStore = crlStore;

_rep->peerCertificate = NULL;

}

SSLCallbackInfo::~SSLCallbackInfo()

{

if (_peerCertificate)

if (_rep->peerCertificate)

{

delete _peerCertificate;

delete _rep->peerCertificate;

}

delete _rep;

}

PEGASUS_NAMESPACE_END

Legend:

Removed from v.1.31
changed lines
	Added in v.1.62

No CVS admin address has been configured