pegasus/src/Pegasus/Common/SSLContext.cpp - diff

Return to SSLContext.cpp CVS log

Up to [Pegasus] / pegasus / src / Pegasus / Common

Diff for /pegasus/src/Pegasus/Common/SSLContext.cpp between version 1.27 and 1.36

version 1.27, 2004/05/21 20:57:00

version 1.36, 2004/08/17 10:35:27

Line 29

// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com)

// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com)

// Heather Sterling, IBM (hsterl@us.ibm.com)

// Amit K Arora, IBM (amita@in.ibm.com) for Bug#1090

//%/////////////////////////////////////////////////////////////////////////////

Line 69

Line 70

PEGASUS_NAMESPACE_BEGIN

const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0;

// use the following definitions only if SSL is available

#ifdef PEGASUS_HAS_SSL

// certificate handling routine

// ATTN-RK-20020905: This global variable is unsafe with multiple SSL contexts

SSLCertificateVerifyFunction* verify_certificate;

// Mutex for SSL locks.

Mutex* SSLContextRep::_sslLocks = 0;

Line 101

Line 97

Timestamp_t timeStamp;

char tempString[80];

char plusOrMinus = '+';

unsigned char* utcTimeData = utcTime->data;

memset(&time, '\0', sizeof(time));

#define g2(p) ( ( (p)[0] - '0' ) * 10 + (p)[1] - '0' )

time.tm_year = g2(utcTime->data);

if (utcTime->type == V_ASN1_GENERALIZEDTIME)

{

time.tm_year = g2(utcTimeData) * 100;

utcTimeData += 2; // Remaining data is equivalent to ASN1_UTCTIME type

time.tm_year += g2(utcTimeData);

}

else

{

time.tm_year = g2(utcTimeData);

if(time.tm_year < 50)

{

time.tm_year += 100;

time.tm_year += 2000;

}

else

{

time.tm_year += 1900;

}

time.tm_mon = g2(utcTime->data + 2) - 1;

}

time.tm_mday = g2(utcTime->data + 4);

time.tm_hour = g2(utcTime->data + 6);

time.tm_mon = g2(utcTimeData + 2) - 1;

time.tm_min = g2(utcTime->data + 8);

time.tm_mday = g2(utcTimeData + 4);

time.tm_sec = g2(utcTime->data + 10);

time.tm_hour = g2(utcTimeData + 6);

time.tm_min = g2(utcTimeData + 8);

time.tm_sec = g2(utcTimeData + 10);

if(utcTime->data[12] == 'Z')

if (utcTimeData[12] == 'Z')

{

offset = 0;

}

else

{

offset = g2(utcTime->data + 13) * 60 + g2(utcTime->data + 15);

offset = g2(utcTimeData + 13) * 60 + g2(utcTimeData + 15);

if(utcTime->data[12] == '-')

if (utcTimeData[12] == '-')

{

plusOrMinus = '-';

}

#undef g2

int year = 1900;

memset((void *)&timeStamp, 0, sizeof(Timestamp_t));

// Format the date.

sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d",

year + time.tm_year,

time.tm_year,

time.tm_mon + 1,

time.tm_mday,

time.tm_hour,

Line 168

Line 177

char buf[256];

X509 *currentCert;

SSL *ssl;

int verifyError = X509_V_OK;

// get the verification callback info specific to each SSL connection

ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());

SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX);

// If the SSLContext does not have an additional callback

// simply return the preverification error.

// We do not need to go through the additional steps.

if (verify_certificate == NULL)

if (exData->verifyCertificateCallback == NULL)

{

return (preVerifyOk);

}

Line 193

Line 211

int depth = X509_STORE_CTX_get_error_depth(ctx);

//FUTURE: Not sure what to do with these...?

//ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());

//mydata = SSL_get_ex_data(ssl, mydata_index);

// get the version on the certificate

Line 247

Line 261

}

String issuerName = String(buf);

// SSLCertificateInfo certInfo(subjectName, issuerName, version, serialNumber,

// Call the verify_certificate() application callback

// notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk);

SSLCertificateInfo certInfo(subjectName, issuerName, version, serialNumber,

exData->_peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber,

notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk);

if (verify_certificate(certInfo))

// Call the application callback.

// Note that the verification result does not automatically get set to X509_V_OK if the callback is successful.

// This is because OpenSSL retains the original default error in case we want to use it later.

// To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here.

if (exData->verifyCertificateCallback(*exData->_peerCertificate))//certInfo))

{

#ifndef PEGASUS_USE_SSL_CLIENT_VERIFICATION

verifyError = X509_V_OK;

#endif

preVerifyOk = 1;

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--> SSL: verify_certificate() returned X509_V_OK");

"--> SSL: verifyCertificateCallback() returned X509_V_OK");

PEG_METHOD_EXIT();

return 1;

}

else

else // verification failed, handshake will be immediately terminated

{

#ifndef PEGASUS_USE_SSL_CLIENT_VERIFICATION

verifyError = certInfo.getErrorCode();

#endif

preVerifyOk = 0;

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--> SSL: verify_certificate() returned error %d", verifyError);

"--> SSL: verifyCertificateCallback() returned error %d", exData->_peerCertificate->getErrorCode());

}

// We need a way for the server to retain the verification result,

// so that in 'optional' settings, we can still continue the connection.

// We can then give the verification result to a consumer and let them

// decide whether to accept or reject the request.

// The problem is that if we don't reset the error, the server verification

// gets messed up on the client side.

// If SSL client verification is disabled, do things the old way,

// since the server will never even use the callback.

// If SSL client verification is enabled, do not set the error code explicitly.

// Instead, require the client to set the error code within its callback.

// i.e.

// Boolean verifyCertificate(SSLCertificateInfo cert)

// {

// cert.setErrorCode(SSLCertificateInfo::V_OK);

// return true;

// }

// If clients do not do this w/ PEGASUS_USE_SSL_CLIENT_VERIFICATION enabled,

// the server verification will fail because the error code will be the original result.

// This is sort of a kluge, but I cannot figure out a better way to do this w/o

// some storage tactic.

// This will definitely be fixed in 2.4. For 2.3.2, it shouldn't matter since we

// are not using server verification.

#ifdef PEGASUS_USE_SSL_CLIENT_VERIFICATION

X509_STORE_CTX_set_error(ctx, certInfo.getErrorCode());

#else

X509_STORE_CTX_set_error(ctx, verifyError);

#endif

PEG_METHOD_EXIT();

return 0;

return(preVerifyOk);

}

Line 377

Line 357

// For the OSs that don't have /dev/random device file,

// must enable PEGASUS_SSL_RANDOMFILE flag.

SSLContextRep::SSLContextRep(const String& trustStore,

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()");

_trustStore = trustStore;

_certPath = certPath;

_keyPath = keyPath;

//ATTN: This cannot be global now that there are multiple SSLContexts.

verify_certificate = verifyCert;

_trustStoreAutoUpdate = false;

_trustStoreUserName = String::EMPTY;

// If a truststore and/or peer verification function is specified, enable peer verification

if (trustStore != String::EMPTY || verifyCert != NULL)

{

_verifyPeer = true;

}

else

{

_verifyPeer = false;

}

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

_countRepMutex.lock(pegasus_thread_self());

try

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in constructor %d", _countRep);

if ( _countRep == 0 )

{

init_ssl();

// load SSL library

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Before calling SSL_load_error_strings %d", pegasus_thread_self());

SSL_load_error_strings();

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"After calling SSL_load_error_strings %d", pegasus_thread_self());

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Before calling SSL_library_init %d", pegasus_thread_self());

SSL_library_init();

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"After calling SSL_library_init %d", pegasus_thread_self());

}

catch(...)

{

_countRepMutex.unlock();

throw;

}

_countRep++;

_countRepMutex.unlock();

_randomInit(randomFile);

_sslContext = _makeSSLContext();

PEG_METHOD_EXIT();

}

#ifdef PEGASUS_USE_SSL_CLIENT_VERIFICATION

SSLContextRep::SSLContextRep(

const String& trustStore,

const String& certPath,

Line 473

Line 374

_keyPath = keyPath;

//ATTN: This cannot be global now that there are multiple SSLContexts.

_certificateVerifyFunction = verifyCert;

verify_certificate = verifyCert;

_trustStoreAutoUpdate = trustStoreAutoUpdate;

_trustStoreUserName = trustStoreUserName;

// If a truststore and/or peer verification function is specified, enable peer verification

if (trustStore != String::EMPTY || verifyCert != NULL)

{

_verifyPeer = true;

Line 490

Line 392

_verifyPeer = false;

}

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

_countRepMutex.lock(pegasus_thread_self());

try

{

AutoMutex autoMut(_countRepMutex);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in constructor %d", _countRep);

if ( _countRep == 0 )

Line 521

Line 424

"After calling SSL_library_init %d", pegasus_thread_self());

}

catch(...)

{

_countRepMutex.unlock();

throw;

}

_countRep++;

_countRepMutex.unlock();

} // mutex unlocks here

_randomInit(randomFile);

Line 536

Line 433

PEG_METHOD_EXIT();

}

#endif

SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep)

{

Line 548

Line 444

_verifyPeer = sslContextRep._verifyPeer;

_trustStoreAutoUpdate = sslContextRep._trustStoreAutoUpdate;

_trustStoreUserName = sslContextRep._trustStoreUserName;

_certificateVerifyFunction = sslContextRep._certificateVerifyFunction;

// ATTN: verify_certificate is set implicitly in global variable

_randomFile = sslContextRep._randomFile;

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

_countRepMutex.lock(pegasus_thread_self());

try

{

AutoMutex autoMut(_countRepMutex);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in copy constructor %d", _countRep);

if ( _countRep == 0 )

{

init_ssl();

}

catch(...)

{

_countRepMutex.unlock();

throw;

}

_countRep++;

_countRepMutex.unlock();

} // mutex unlocks here

_sslContext = _makeSSLContext();

PEG_METHOD_EXIT();

Line 586

Line 474

SSL_CTX_free(_sslContext);

// Decrement the SSLContextRep object _counter.

_countRepMutex.lock(pegasus_thread_self());

{

AutoMutex autoMut(_countRepMutex);

_countRep--;

// Free SSL locks if no instances of SSLContextRep exist.

try

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in destructor %d", _countRep);

if ( _countRep == 0 )

{

free_ssl();

}

catch(...)

{

_countRepMutex.unlock();

throw;

}

_countRepMutex.unlock();

PEG_METHOD_EXIT();

}

Line 617

Line 500

Boolean ret;

int retVal = 0;

const int DEV_RANDOM_BYTES = 64; /* how many bytes to read */

const String devRandom = "/dev/random"; /* random device name */

const String devUrandom = "/dev/urandom"; /* pseudo-random device name */

#ifdef PEGASUS_SSL_DEVRANDOM

if ( FileSystem::exists(devRandom) )

{

while ( RAND_status() == 0 )

{

// Always attempt to seed from good entropy sources, first

// try /dev/random

retVal = RAND_load_file(devRandom.getCString(), DEV_RANDOM_BYTES);

if (retVal <= 0)

{

break;

}

if ( FileSystem::exists(devUrandom) )

{

while ( RAND_status() == 0 )

{

// If there isn't /dev/random try /dev/urandom

retVal = RAND_load_file(devUrandom.getCString(), DEV_RANDOM_BYTES);

if (retVal <= 0)

{

break;

}

#endif /* PEGASUS_SSL_DEVRANDOM */

#ifdef PEGASUS_SSL_RANDOMFILE

if ( RAND_status() == 0 )

{

Line 805

Line 649

// callback function is not called in this case; the handshake is simply terminated.

// This value has NO effect in from a client perspective

if (verify_certificate != NULL)

if (_certificateVerifyFunction != NULL)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: certificate verification callback specified");

Line 1042

Line 886

return _trustStoreUserName;

}

SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const

{

return _certificateVerifyFunction;

}

#else

Line 1052

Line 901

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile) {}

#ifdef PEGASUS_USE_SSL_CLIENT_VERIFICATION

SSLContextRep::SSLContextRep(const String& trustStore,

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

Boolean trustStoreAutoUpdate,

String trustStoreUserName,

const String& randomFile) {}

#endif

SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {}

Line 1087

Line 928

String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; }

SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; }

void SSLContextRep::init_ssl() {}

void SSLContextRep::free_ssl() {}

Line 1105

Line 948

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

#ifdef PEGASUS_USE_SSL_CLIENT_VERIFICATION

_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, verifyCert, false, String::EMPTY, randomFile);

#else

_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, verifyCert, randomFile);

#endif

}

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

SSLContext::SSLContext(

const String& certPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile,

Boolean isCIMClient)

{

#ifdef PEGASUS_USE_SSL_CLIENT_VERIFICATION

_rep = new SSLContextRep(certPath, String::EMPTY, String::EMPTY, verifyCert, false, String::EMPTY, randomFile);

#else

_rep = new SSLContextRep(certPath, String::EMPTY, String::EMPTY, verifyCert, randomFile);

#endif

}

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

const String& certKeyPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

#ifdef PEGASUS_USE_SSL_CLIENT_VERIFICATION

_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, String::EMPTY, randomFile);

_rep = new SSLContextRep(certPath, certKeyPath, String::EMPTY, verifyCert, false, String::EMPTY, randomFile);

#else

_rep = new SSLContextRep(certPath, certKeyPath, String::EMPTY, verifyCert, randomFile);

#endif

}

#endif

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

String trustStoreUserName,

const String& randomFile)

{

#ifdef PEGASUS_USE_SSL_CLIENT_VERIFICATION

_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, trustStoreUserName, randomFile);

_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, String::EMPTY, randomFile);

#else

_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, randomFile);

#endif

}

#ifdef PEGASUS_USE_SSL_CLIENT_VERIFICATION

#ifdef PEGASUS_USE_AUTOMATIC_TRUSTSTORE_UPDATE

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

Line 1204

Line 1022

return (_rep->isPeerVerificationEnabled());

}

#ifdef PEGASUS_USE_AUTOMATIC_TRUSTSTORE_UPDATE

Boolean SSLContext::isTrustStoreAutoUpdateEnabled() const

{

return (_rep->isTrustStoreAutoUpdateEnabled());

}

#endif

String SSLContext::getTrustStoreUserName() const

{

return (_rep->getTrustStoreUserName());

}

SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const

{

return (_rep->getSSLCertificateVerifyFunction());

}

///////////////////////////////////////////////////////////////////////////////

// SSLCertificateInfo

Line 1405

Line 1230

_rep->respCode = respCode;

}

String SSLCertificateInfo::toString() const

{

char buf[1024];

String s;

s.append("Subject Name:\n\t");

s.append(_rep->subjectName);

s.append("\n");

s.append("Issuer Name:\n\t");

s.append(_rep->issuerName);

s.append("\n");

sprintf(buf, "Depth: %d\n", _rep->depth);

s.append(buf);

sprintf(buf, "Error code: %d\n", _rep->errorCode);

s.append(buf);

sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode);

s.append(buf);

s.append("Error string: ");

s.append(_rep->errorString);

s.append("\n");

sprintf(buf, "Version number: %d\n", _rep->versionNumber);

s.append(buf);

sprintf(buf, "Serial number: %ld\n", _rep->serialNumber);

s.append(buf);

s.append("Not before date: ");

s.append((_rep->notBefore).toString());

s.append("\n");

s.append("Not after date: ");

s.append((_rep->notAfter).toString());

s.append("\n");

return s;

}

SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert)

{

verifyCertificateCallback = verifyCert;

_peerCertificate = NULL;

}

SSLCallbackInfo::~SSLCallbackInfo()

{

if (_peerCertificate)

{

delete _peerCertificate;

}

PEGASUS_NAMESPACE_END

Legend:

Removed from v.1.27
changed lines
	Added in v.1.36

No CVS admin address has been configured