pegasus/src/Pegasus/Common/SSLContext.cpp - diff

Return to SSLContext.cpp CVS log

Up to [Pegasus] / pegasus / src / Pegasus / Common

Diff for /pegasus/src/Pegasus/Common/SSLContext.cpp between version 1.22 and 1.40

version 1.22, 2003/09/12 17:55:24

version 1.40, 2004/12/07 22:43:14

Line 1

//%/////////////////////////////////////////////////////////////////////////////

//%2004////////////////////////////////////////////////////////////////////////

// The Open Group, Tivoli Systems

// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.

// IBM Corp.; EMC Corporation, The Open Group.

// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.

// Permission is hereby granted, free of charge, to any person obtaining a copy

// of this software and associated documentation files (the "Software"), to

Line 25

Line 29

// Modified By: Nag Boranna, Hewlett-Packard Company (nagaraja_boranna@hp.com)

// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com)

// Sushma Fernandes,

// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com)

// Hewlett-Packard Company (sushma_fernandes@hp.com)

// Heather Sterling, IBM (hsterl@us.ibm.com)

// Amit K Arora, IBM (amita@in.ibm.com) for Bug#1090

//%/////////////////////////////////////////////////////////////////////////////

Line 44

Line 49

#include <Pegasus/Common/FileSystem.h>

#include <time.h>

#include <Pegasus/Common/MessageLoader.h> //l10n

#include <Pegasus/Common/Formatter.h>

#include "SSLContext.h"

#include "SSLContextRep.h"

// Typedef's for OpenSSL callback functions.

extern "C"

{

typedef void (* CRYPTO_SET_LOCKING_CALLBACK)(int, int, const char *, int);

typedef unsigned long (* CRYPTO_SET_ID_CALLBACK)(void);

};

typedef struct Timestamp

{

char year[4];

Line 67

Line 84

PEGASUS_NAMESPACE_BEGIN

const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0;

// use the following definitions only if SSL is available

#ifdef PEGASUS_HAS_SSL

// certificate handling routine

// ATTN-RK-20020905: This global variable is unsafe with multiple SSL contexts

SSLCertificateVerifyFunction* verify_certificate;

// Mutex for SSL locks.

Mutex* SSLContextRep::_sslLocks = 0;

Line 99

Line 111

Timestamp_t timeStamp;

char tempString[80];

char plusOrMinus = '+';

unsigned char* utcTimeData = utcTime->data;

memset(&time, '\0', sizeof(time));

#define g2(p) ( ( (p)[0] - '0' ) * 10 + (p)[1] - '0' )

time.tm_year = g2(utcTime->data);

if (utcTime->type == V_ASN1_GENERALIZEDTIME)

{

time.tm_year = g2(utcTimeData) * 100;

utcTimeData += 2; // Remaining data is equivalent to ASN1_UTCTIME type

time.tm_year += g2(utcTimeData);

}

else

{

time.tm_year = g2(utcTimeData);

if(time.tm_year < 50)

{

time.tm_year += 100;

time.tm_year += 2000;

}

else

{

time.tm_year += 1900;

}

time.tm_mon = g2(utcTime->data + 2) - 1;

}

time.tm_mday = g2(utcTime->data + 4);

time.tm_hour = g2(utcTime->data + 6);

time.tm_mon = g2(utcTimeData + 2) - 1;

time.tm_min = g2(utcTime->data + 8);

time.tm_mday = g2(utcTimeData + 4);

time.tm_sec = g2(utcTime->data + 10);

time.tm_hour = g2(utcTimeData + 6);

time.tm_min = g2(utcTimeData + 8);

time.tm_sec = g2(utcTimeData + 10);

if(utcTime->data[12] == 'Z')

if (utcTimeData[12] == 'Z')

{

offset = 0;

}

else

{

offset = g2(utcTime->data + 13) * 60 + g2(utcTime->data + 15);

offset = g2(utcTimeData + 13) * 60 + g2(utcTimeData + 15);

if(utcTime->data[12] == '-')

if (utcTimeData[12] == '-')

{

plusOrMinus = '-';

}

#undef g2

int year = 1900;

memset((void *)&timeStamp, 0, sizeof(Timestamp_t));

// Format the date.

sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d",

year + time.tm_year,

time.tm_year,

time.tm_mon + 1,

time.tm_mday,

time.tm_hour,

Line 156

Line 181

}

// Static class used to define C++ callback functions for OpenSSL.

class SSLCallback

{

public:

static int verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx);

static int verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore);

};

// Callback function that is called by the OpenSSL library. This function

// checks whether the certificate is listed in any of the CRL's

int SSLCallback::verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore)

{

PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::verificationCRLCallback");

X509_OBJECT obj;

X509_NAME *subject;

X509_NAME *issuer;

X509 *xs;

X509_CRL *crl;

X509_REVOKED *revoked;

long serial;

BIO *bio;

int i, n, rc;

char *cp;

char *cp2;

if (sslCRLStore == NULL)

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL store is NULL");

return ok;

}

//ATTN: The following excerpt is based off of modssl's callback function

//We may need to do something here for legal purposes. I have informed Warren of this, will resolve before 2.5 ships.

* Determine certificate ingredients in advance

xs = X509_STORE_CTX_get_current_cert(ctx);

subject = X509_get_subject_name(xs);

issuer = X509_get_issuer_name(xs);

* OpenSSL provides the general mechanism to deal with CRLs but does not

* use them automatically when verifying certificates, so we do it

* explicitly here. We will check the CRL for the currently checked

* certificate, if there is such a CRL in the store.

* We come through this procedure for each certificate in the certificate

* chain, starting with the root-CA's certificate. At each step we've to

* both verify the signature on the CRL (to make sure it's a valid CRL)

* and it's revocation list (to make sure the current certificate isn't

* revoked). But because to check the signature on the CRL we need the

* public key of the issuing CA certificate (which was already processed

* one round before), we've a little problem. But we can both solve it and

* at the same time optimize the processing by using the following

* verification scheme (idea and code snippets borrowed from the GLOBUS

* project):

* 1. We'll check the signature of a CRL in each step when we find a CRL

* through the _subject_ name of the current certificate. This CRL

* itself will be needed the first time in the next round, of course.

* But we do the signature processing one round before this where the

* public key of the CA is available.

* 2. We'll check the revocation list of a CRL in each step when

* we find a CRL through the _issuer_ name of the current certificate.

* This CRLs signature was then already verified one round before.

* This verification scheme allows a CA to revoke its own certificate as

* well, of course.

* Try to retrieve a CRL corresponding to the _subject_ of

* the current certificate in order to verify it's integrity.

memset((char *)&obj, 0, sizeof(obj));

X509_STORE_CTX pStoreCtx;

X509_STORE_CTX_init(&pStoreCtx, sslCRLStore, NULL, NULL);

rc = X509_STORE_get_by_subject(&pStoreCtx, X509_LU_CRL, subject, &obj);

X509_STORE_CTX_cleanup(&pStoreCtx);

crl = obj.data.crl;

//////////////////////////////////////////

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL : return code is %d", rc);

if (rc > 0 && crl != NULL)

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL found");

// Log information about CRL

// (A little bit complicated because of ASN.1 and BIOs...)

bio = BIO_new(BIO_s_mem());

BIO_printf(bio, "lastUpdate: ");

ASN1_UTCTIME_print(bio, X509_CRL_get_lastUpdate(crl));

BIO_printf(bio, ", nextUpdate: ");

ASN1_UTCTIME_print(bio, X509_CRL_get_nextUpdate(crl));

n = BIO_pending(bio);

cp = (char*) malloc(n+1);

n = BIO_read(bio, cp, n);

cp[n] = '\0';

BIO_free(bio);

cp2 = X509_NAME_oneline(subject, NULL, 0);

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL : CRL Issuer : %s, %s", cp2, cp);

//ATTN: This throws a memory error

//free(cp2);

free(cp);

// Verify the signature on this CRL

if (X509_CRL_verify(crl, X509_get_pubkey(xs)) <= 0)

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL : Invalid signature on CRL");

//ATTN: Do we need to set this?

//X509_STORE_CTX_set_error(ctx, X509_V_ERR_CRL_SIGNATURE_FAILURE);

//X509_OBJECT_free_contents(&obj);

PEG_METHOD_EXIT();

return 0;

}

// Check date of CRL to make sure it's not expired

i = X509_cmp_current_time(X509_CRL_get_nextUpdate(crl));

if (i == 0)

{

Tracer::trace(TRC_SSL, Tracer::LEVEL2, "CRL has invalid nextUpdate field\n");

//ATTN: Do we need to set this?

//X509_STORE_CTX_set_error(ctx, X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD);

//X509_OBJECT_free_contents(&obj);

PEG_METHOD_EXIT();

return 0;

}

if (i < 0)

{

Tracer::trace(TRC_SSL, Tracer::LEVEL2, "CRL has expired\n");

//ATTN: Do we need to set this?

//X509_STORE_CTX_set_error(ctx, X509_V_ERR_CRL_HAS_EXPIRED);

//X509_OBJECT_free_contents(&obj);

PEG_METHOD_EXIT();

return 0;

}

X509_OBJECT_free_contents(&obj);

} else

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: No CRL for that subject found");

}

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL checks out ok\n");

// Try to retrieve a CRL corresponding to the _issuer_ of

// the current certificate in order to check for revocation.

memset((char *)&obj, 0, sizeof(obj));

X509_STORE_CTX_init(&pStoreCtx, sslCRLStore, NULL, NULL);

rc = X509_STORE_get_by_subject(&pStoreCtx, X509_LU_CRL, issuer, &obj);

X509_STORE_CTX_cleanup(&pStoreCtx);

crl = obj.data.crl;

if (rc > 0 && crl != NULL)

{

// Check if the current certificate is revoked by this CRL

#if SSL_LIBRARY_VERSION < 0x00904000

n = sk_num(X509_CRL_get_REVOKED(crl));

#else

n = sk_X509_REVOKED_num(X509_CRL_get_REVOKED(crl));

#endif

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: Number of certificates revoked by the issuer %d", n);

for (i = 0; i < n; i++)

{

#if SSL_LIBRARY_VERSION < 0x00904000

revoked = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i);

#else

revoked = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i);

#endif

serial = ASN1_INTEGER_get(revoked->serialNumber);

printf("Got serial number %ld\n", serial);

if (ASN1_INTEGER_cmp(revoked->serialNumber, X509_get_serialNumber(xs)) == 0)

{

serial = ASN1_INTEGER_get(revoked->serialNumber);

cp = X509_NAME_oneline(issuer, NULL, 0);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"---> SSL : Certificate with serial %ld revoked per CRL from issuer %s\n", serial, cp);

//ATTN: Mem error if uncomment following

//free(cp);

X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED);

X509_OBJECT_free_contents(&obj);

PEG_METHOD_EXIT();

return 0;

}

X509_OBJECT_free_contents(&obj);

}

PEG_METHOD_EXIT();

return ok;

}

// Callback function that is called by the OpenSSL library. This function

// extracts X509 certficate information and pass that on to client application

// callback function.

// We HAVE to build the certificate in all cases since it's needed to get the associated username out of the repository

// later in the transaction

int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx)

int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx)

{

PEG_METHOD_ENTER(TRC_SSL, "prepareForCallback()");

PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()");

char buf[256];

X509 *currentCert;

SSL *ssl;

int verifyError = X509_V_OK;

int revoked = -1;

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--->SSL: Preverify Error %d", verifyError);

// get the verification callback info specific to each SSL connection

ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());

SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX);

// If the SSLContext does not have an additional callback

// simply return the preverification error (or check the CRL)

// We do not need to go through the additional steps.

if (exData->verifyCertificateCallback == NULL)

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--->SSL: No verification callback specified");

if (exData->_crlStore == NULL)

{

PEG_METHOD_EXIT();

return (preVerifyOk);

} else

{

revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_crlStore);

PEG_METHOD_EXIT();

return (revoked);

}

// Check to see if a CRL path is defined

if (exData->_crlStore)

{

revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_crlStore);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"---> SSL: CRL callback returned %d", revoked);

}

// get the current certificate

Line 183

Line 479

int depth = X509_STORE_CTX_get_error_depth(ctx);

//FUTURE: Not sure what to do with these...?

//ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());

//mydata = SSL_get_ex_data(ssl, mydata_index);

// get the version on the certificate

Line 220

Line 512

if (!preVerifyOk)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"---> SSL: certificate default verification error: " + errorStr);

"---> SSL: certificate default verification error: %s", (const char*)errorStr.getCString());

}

Line 238

Line 530

String issuerName = String(buf);

// Call the verify_certificate() application callback

// Create the certificate object

SSLCertificateInfo certInfo(subjectName, issuerName, version, serialNumber,

exData->_peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber,

notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk);

if (verify_certificate(certInfo))

// Call the application callback.

// Note that the verification result does not automatically get set to X509_V_OK if the callback is successful.

// This is because OpenSSL retains the original default error in case we want to use it later.

// To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here.

if (exData->verifyCertificateCallback(*exData->_peerCertificate))

{

verifyError = X509_V_OK;

preVerifyOk = 1;

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--> SSL: verify_certificate() returned X509_V_OK");

"--> SSL: verifyCertificateCallback() returned X509_V_OK");

PEG_METHOD_EXIT();

return 1;

}

else

else // verification failed, handshake will be immediately terminated

{

verifyError = certInfo.getErrorCode();

preVerifyOk = 0;

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"--> SSL: verify_certificate() returned error %d", verifyError);

"--> SSL: verifyCertificateCallback() returned error %d", exData->_peerCertificate->getErrorCode());

PEG_METHOD_EXIT();

return 0;

}

// Reset the error. It is logically not required to reset the error code, but

// Callback function called by OpenSSL. This request is merely forwarded to the static

// openSSL code does not take just the return value on a failed certificate

// function SSLCallback::callback(). The SSLCallback class is a friend class of the

// verification.

// Pegasus SSL related classes needed to complete the callback.

X509_STORE_CTX_set_error(ctx, verifyError);

extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx)

{

PEG_METHOD_EXIT();

return SSLCallback::verificationCallback(preVerifyOk, ctx);

return(preVerifyOk);

}

Line 282

Line 581

if ( mode & CRYPTO_LOCK )

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

/*Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Now locking for %d", pegasus_thread_self());

"Now locking for %d", pegasus_thread_self());*/

SSLContextRep::_sslLocks[type].lock( pegasus_thread_self() );

}

else

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

/*Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Now unlocking for %d", pegasus_thread_self());

"Now unlocking for %d", pegasus_thread_self());*/

SSLContextRep::_sslLocks[type].unlock( );

}

Line 308

Line 607

// Set the ID callback. The ID callback returns a thread ID.

CRYPTO_set_id_callback((unsigned long (*)())pegasus_thread_self);

CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK) pegasus_thread_self);

// Set the locking callback to pegasus_locking_callback.

CRYPTO_set_locking_callback((void (*)(int,int,const char *,int))pegasus_locking_callback);

CRYPTO_set_locking_callback((CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback);

}

Line 336

Line 635

// For the OSs that don't have /dev/random device file,

// must enable PEGASUS_SSL_RANDOMFILE flag.

SSLContextRep::SSLContextRep(const String& trustPath,

SSLContextRep::SSLContextRep(

const String& trustStore,

const String& certPath,

const String& keyPath,

const String& crlPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()");

_trustPath = trustPath.getCString();

_trustStore = trustStore;

_certPath = certPath.getCString();

_certPath = certPath;

_keyPath = keyPath.getCString();

_keyPath = keyPath;

verify_certificate = verifyCert;

_crlPath = crlPath;

_crlStore = NULL;

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

_certificateVerifyFunction = verifyCert;

_countRepMutex.lock(pegasus_thread_self());

try

// If a truststore and/or peer verification function is specified, enable peer verification

if (trustStore != String::EMPTY || verifyCert != NULL)

{

_verifyPeer = true;

}

else

{

_verifyPeer = false;

}

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

{

AutoMutex autoMut(_countRepMutex);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in constructor %d", _countRep);

if ( _countRep == 0 )

Line 384

Line 701

"After calling SSL_library_init %d", pegasus_thread_self());

}

catch(...)

{

_countRepMutex.unlock();

throw;

}

_countRep++;

_countRepMutex.unlock();

} // mutex unlocks here

_randomInit(randomFile);

Line 404

Line 716

{

PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()");

_trustPath = sslContextRep._trustPath;

_trustStore = sslContextRep._trustStore;

_certPath = sslContextRep._certPath;

_keyPath = sslContextRep._keyPath;

// ATTN: verify_certificate is set implicitly in global variable

_crlPath = sslContextRep._crlPath;

_verifyPeer = sslContextRep._verifyPeer;

_certificateVerifyFunction = sslContextRep._certificateVerifyFunction;

_randomFile = sslContextRep._randomFile;

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

_countRepMutex.lock(pegasus_thread_self());

try

{

AutoMutex autoMut(_countRepMutex);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in copy constructor %d", _countRep);

if ( _countRep == 0 )

{

init_ssl();

}

catch(...)

{

_countRepMutex.unlock();

throw;

}

_countRep++;

_countRepMutex.unlock();

} // mutex unlocks here

_sslContext = _makeSSLContext();

PEG_METHOD_EXIT();

Line 444

Line 752

SSL_CTX_free(_sslContext);

// Decrement the SSLContextRep object _counter.

_countRepMutex.lock(pegasus_thread_self());

{

AutoMutex autoMut(_countRepMutex);

_countRep--;

// Free SSL locks if no instances of SSLContextRep exist.

try

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in destructor %d", _countRep);

if ( _countRep == 0 )

{

free_ssl();

}

catch(...)

{

_countRepMutex.unlock();

throw;

}

_countRepMutex.unlock();

PEG_METHOD_EXIT();

}

Line 475

Line 778

Boolean ret;

int retVal = 0;

const int DEV_RANDOM_BYTES = 64; /* how many bytes to read */

const String devRandom = "/dev/random"; /* random device name */

const String devUrandom = "/dev/urandom"; /* pseudo-random device name */

#ifdef PEGASUS_SSL_DEVRANDOM

if ( FileSystem::exists(devRandom) )

{

while ( RAND_status() == 0 )

{

// Always attempt to seed from good entropy sources, first

// try /dev/random

retVal = RAND_load_file(devRandom.getCString(), DEV_RANDOM_BYTES);

if (retVal <= 0)

{

break;

}

if ( FileSystem::exists(devUrandom) )

{

while ( RAND_status() == 0 )

{

// If there isn't /dev/random try /dev/urandom

retVal = RAND_load_file(devUrandom.getCString(), DEV_RANDOM_BYTES);

if (retVal <= 0)

{

break;

}

#endif /* PEGASUS_SSL_DEVRANDOM */

#ifdef PEGASUS_SSL_RANDOMFILE

if ( RAND_status() == 0 )

{

Line 529

Line 793

//throw( SSLException("Random seed file required"));

MessageLoaderParms parms("Common.SSLContext.RANDOM_SEED_FILE_REQUIRED",

"Random seed file required");

throw( SSLException(parms));

throw SSLException(parms);

}

Line 550

Line 814

MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE",

"Not enough seed data in random seed file.",

randomFile);

throw( SSLException(parms));

throw SSLException(parms);

}

else

Line 563

Line 827

MessageLoaderParms parms("Common.SSLContext.SEED_FILE_DOES_NOT_EXIST",

"Seed file '$0' does not exist.",

randomFile);

throw( SSLException(parms));

throw SSLException(parms);

}

if ( RAND_status() == 0 )

Line 572

Line 836

// Try to do more seeding

long seedNumber;

#if defined(PEGASUS_PLATFORM_WIN32_IX86_MSVC)

srand((unsigned int)time(NULL)); // Initialize

seedNumber = rand();

#else

srandom((unsigned int)time(NULL)); // Initialize

seedNumber = random();

#endif

RAND_seed((unsigned char *) &seedNumber, sizeof(seedNumber));

int seedRet = RAND_status();

Line 589

Line 858

MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE",

"Not enough seed data in random seed file.",

randomFile);

throw( SSLException(parms));

throw SSLException(parms);

}

Line 605

Line 874

//throw( SSLException("Not enough seed data."));

MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA",

"Not enough seed data.");

throw( SSLException(parms));

throw SSLException(parms);

}

PEG_METHOD_EXIT();

Line 628

Line 897

//throw( SSLException("Could not get SSL CTX"));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET",

"Could not get SSL CTX");

throw( SSLException(parms));

throw SSLException(parms);

}

#ifdef PEGASUS_SSL_WEAKENCRYPTION

Line 637

Line 906

//throw( SSLException("Could not set the cipher list"));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_SET_CIPHER_LIST",

"Could not set the cipher list");

throw( SSLException(parms));

throw SSLException(parms);

}

#endif

Line 650

Line 919

SSL_CTX_set_options(sslContext,SSL_OP_ALL);

SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF);

if (verify_certificate != NULL)

if (_verifyPeer)

{

//ATTN: We might still need a flag to specify SSL_VERIFY_FAIL_IF_NO_PEER_CERT

// If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be terminated

// if the client sends no certificate or sends an untrusted certificate. The

// callback function is not called in this case; the handshake is simply terminated.

// This value has NO effect in from a client perspective

if (_certificateVerifyFunction != NULL)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: certificate verification callback specified");

SSL_CTX_set_verify(sslContext,

SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback);

}

else

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: Trust Store specified");

SSL_CTX_set_verify(sslContext,

SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,

prepareForCallback);

}

else

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Trust Store and certificate verification callback are NOT specified");

SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL);

}

// Check if there is CA certificate file specified. If specified,

// Check if there is CA certificate file or directory specified. If specified,

// load the certificates from the file in to the CA trust store.

// and is not empty, load the certificates from the Trust store.

if (_trustStore != String::EMPTY)

{

// The truststore may be a single file of CA certificates OR

// a directory containing multiple CA certificates.

// Check which one it is, and call the load_verify_locations function

// with the appropriate parameter. Note: It is possible to have both

// options, in which case the CA file takes precedence over the CA path.

// However, since there is currently only one trust parameter to the

// SSL functions, only allow one choice here.

if (strncmp(_trustPath, "", 1) != 0)

if (FileSystem::isDirectory(_trustStore))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Truststore is a directory");

// load certificates in to trust store

// load certificates from the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Loading certificates from the trust store: " + _trustStore);

if ((!SSL_CTX_load_verify_locations(sslContext, _trustPath, NULL)) ||

if ((!SSL_CTX_load_verify_locations(sslContext, NULL, _trustStore.getCString())) ||

(!SSL_CTX_set_default_verify_paths(sslContext)))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Could not load certificates from the trust store: " + _trustStore);

//l10n

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",

"Could not load certificates in to trust store.");

PEG_METHOD_EXIT();

throw SSLException(parms);

}

else if (FileSystem::exists(_trustStore))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Truststore is a file");

// Get size of the trust store file:

Uint32 fileSize = 0;

FileSystem::getFileSize(_trustStore, fileSize);

if (fileSize > 0)

{

// load certificates from the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Loading certificates from the trust store: " + _trustStore);

if ((!SSL_CTX_load_verify_locations(sslContext, _trustStore.getCString(), NULL)) ||

(!SSL_CTX_set_default_verify_paths(sslContext)))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Could not load certificates from the trust store: " + _trustStore);

//l10n

//throw( SSLException("Could not load certificates in to trust store."));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",

"Could not load certificates in to trust store.");

throw( SSLException(parms));

PEG_METHOD_EXIT();

throw SSLException(parms);

}

else

{

// no certificates found in the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: No certificates to load from the trust store: " + _trustStore);

}

if (_crlPath != String::EMPTY)

{

//need to save this -- can we make it static since there's only one CRL for cimserver?

X509_LOOKUP* pLookup;

_crlStore = X509_STORE_new();

//the validity of the crlstore was checked in ConfigManager during server startup

if (FileSystem::isDirectory(_crlPath))

{

Tracer::trace(TRC_SSL, Tracer::LEVEL3,

"---> SSL: CRL store is a directory in %s", (const char*)_crlPath.getCString());

if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_hash_dir())) == NULL)

{

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS",

"Could not load certificate revocation list.");

X509_STORE_free(_crlStore);

PEG_METHOD_EXIT();

throw SSLException(parms);

}

X509_LOOKUP_add_dir(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Successfully configured CRL directory");

} else

{

Tracer::trace(TRC_SSL, Tracer::LEVEL3,

"---> SSL: CRL store is the file %s", (const char*)_crlPath.getCString());

if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_file())) == NULL)

{

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS",

"Could not load certificate revocation list.");

X509_STORE_free(_crlStore);

PEG_METHOD_EXIT();

throw SSLException(parms);

}

X509_LOOKUP_load_file(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Successfully configured CRL file");

}

Boolean keyLoaded = false;

// Check if there is a certificate file (file containing server

// certificate) specified. If specified, validate and load the

// certificate.

if (strncmp(_certPath, "", 1) != 0)

if (_certPath != String::EMPTY)

{

// load the specified server certificates

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Loading server certificate from: " + _certPath);

if (SSL_CTX_use_certificate_file(sslContext,

_certPath, SSL_FILETYPE_PEM) <=0)

_certPath.getCString(), SSL_FILETYPE_PEM) <=0)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: no certificate found in " + String(_certPath));

"---> SSL: No server certificate found in " + _certPath);

PEG_METHOD_EXIT();

//l10n

//throw( SSLException("Could not get server certificate."));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE",

"Could not get server certificate.");

throw( SSLException(parms));

PEG_METHOD_EXIT();

throw SSLException(parms);

}

// If there is no key file (file containing server

// private key) specified or the specified file does not exist,

// private key) specified, then try loading the key from the certificate file.

// then try loading the key from the certificate file.

// As of 2.4, if a keyfile is specified, its location is verified during server

// startup and will throw an error if the path is invalid.

if ( strncmp(_keyPath, "", 1) == 0 ||

if (_keyPath == String::EMPTY)

!FileSystem::exists(String(_keyPath)) )

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: loading key from" + String(_certPath));

"---> SSL: loading private key from: " + _certPath);

// load the private key and check for validity

if (!_verifyPrivateKey(sslContext, _certPath))

{

PEG_METHOD_EXIT();

//l10n

//throw( SSLException("Could not get private key."));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",

"Could not get private key.");

throw( SSLException(parms));

PEG_METHOD_EXIT();

throw SSLException(parms);

}

keyLoaded = true;

}

Line 738

Line 1132

// private key) specified and the key was not already loaded.

// If specified, validate and load the key.

if (strncmp(_keyPath, "", 1) != 0 && !keyLoaded)

if (_keyPath != String::EMPTY && !keyLoaded)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: loading key from" + String(_keyPath));

"---> SSL: loading private key from: " + _keyPath);

// load given private key and check for validity

if (!_verifyPrivateKey(sslContext, _keyPath))

{

PEG_METHOD_EXIT();

//l10n

//throw( SSLException("Could not get private key."));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",

"Could not get private key.");

throw( SSLException(parms));

PEG_METHOD_EXIT();

throw SSLException(parms);

}

keyLoaded = true;

}

Line 761

Line 1153

return sslContext;

}

Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, const char *keyPath)

Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, const String& keyPath)

{

PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()");

if (SSL_CTX_use_PrivateKey_file(ctx, keyPath, SSL_FILETYPE_PEM) <= 0)

if (SSL_CTX_use_PrivateKey_file(ctx, keyPath.getCString(), SSL_FILETYPE_PEM) <= 0)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: no private key found in " + String(keyPath));

PEG_METHOD_EXIT();

return false;

Line 775

Line 1167

if (!SSL_CTX_check_private_key(ctx))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Private and public key do not match");

PEG_METHOD_EXIT();

return false;

Line 789

Line 1181

{

return _sslContext;

}

String SSLContextRep::getTrustStore() const

{

return _trustStore;

}

String SSLContextRep::getCertPath() const

{

return _certPath;

}

String SSLContextRep::getKeyPath() const

{

return _keyPath;

}

String SSLContextRep::getCRLPath() const

{

return _crlPath;

}

X509_STORE* SSLContextRep::getCRLStore() const

{

return _crlStore;

}

Boolean SSLContextRep::isPeerVerificationEnabled() const

{

return _verifyPeer;

}

SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const

{

return _certificateVerifyFunction;

}

#else

// these definitions are used if ssl is not available

SSLContextRep::SSLContextRep(const String& trustPath,

SSLContextRep::SSLContextRep(const String& trustStore,

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

Line 808

Line 1236

SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; }

Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx,

const char *keyPath) { return false; }

const String& keyPath) { return false; }

SSL_CTX * SSLContextRep::getContext() const { return 0; }

String SSLContextRep::getTrustStore() const { return String::EMPTY; }

String SSLContextRep::getCertPath() const { return String::EMPTY; }

String SSLContextRep::getKeyPath() const { return String::EMPTY; }

String SSLContextRep::getCRLPath() const { return String::EMPTY; }

X509_STORE* SSLContextRep::getCRLStore() const { return NULL; }

Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; }

SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; }

void SSLContextRep::init_ssl() {}

void SSLContextRep::free_ssl() {}

Line 826

Line 1268

SSLContext::SSLContext(

const String& trustPath,

const String& trustStore,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

_rep = new SSLContextRep(trustPath, String::EMPTY, String::EMPTY, verifyCert, randomFile);

_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, String::EMPTY, verifyCert, randomFile);

}

#ifndef PEGASUS_REMOVE_DEPRECATED

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

SSLCertificateVerifyFunction* verifyCert,

const String& keyPath,

const String& randomFile,

Boolean isCIMClient)

{

_rep = new SSLContextRep(certPath, String::EMPTY, String::EMPTY, verifyCert, randomFile);

}

SSLContext::SSLContext(

const String& certPath,

const String& certKeyPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

_rep = new SSLContextRep(certPath, certKeyPath, String::EMPTY, verifyCert, randomFile);

_rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile);

}

#endif

//PEP187

SSLContext::SSLContext(

const String& trustPath,

const String& trustStore,

const String& certPath,

const String& keyPath,

const String& crlPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

_rep = new SSLContextRep(trustPath, certPath, keyPath, verifyCert, randomFile);

_rep = new SSLContextRep(trustStore, certPath, keyPath, crlPath, verifyCert, randomFile);

}

SSLContext::SSLContext(const SSLContext& sslContext)

Line 878

Line 1312

delete _rep;

}

String SSLContext::getTrustStore() const

{

return (_rep->getTrustStore());

}

String SSLContext::getCertPath() const

{

return (_rep->getCertPath());

}

String SSLContext::getKeyPath() const

{

return (_rep->getKeyPath());

}

String SSLContext::getCRLPath() const

{

return (_rep->getCRLPath());

}

X509_STORE* SSLContext::getCRLStore() const

{

return (_rep->getCRLStore());

}

Boolean SSLContext::isPeerVerificationEnabled() const

{

return (_rep->isPeerVerificationEnabled());

}

SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const

{

return (_rep->getSSLCertificateVerifyFunction());

}

///////////////////////////////////////////////////////////////////////////////

Line 951

Line 1419

_rep->issuerName = issuerName;

_rep->versionNumber = 0;

_rep->serialNumber = 0;

_rep->notBefore = CIMDateTime(String::EMPTY);

_rep->notBefore = CIMDateTime();

_rep->notAfter = CIMDateTime(String::EMPTY);

_rep->notAfter = CIMDateTime();

_rep->depth = errorDepth;

_rep->errorCode = errorCode;

_rep->errorString = String::EMPTY;

Line 1070

Line 1538

_rep->respCode = respCode;

}

String SSLCertificateInfo::toString() const

{

char buf[1024];

String s;

s.append("Subject Name:\n\t");

s.append(_rep->subjectName);

s.append("\n");

s.append("Issuer Name:\n\t");

s.append(_rep->issuerName);

s.append("\n");

sprintf(buf, "Depth: %d\n", _rep->depth);

s.append(buf);

sprintf(buf, "Error code: %d\n", _rep->errorCode);

s.append(buf);

sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode);

s.append(buf);

s.append("Error string: ");

s.append(_rep->errorString);

s.append("\n");

sprintf(buf, "Version number: %d\n", _rep->versionNumber);

s.append(buf);

sprintf(buf, "Serial number: %ld\n", _rep->serialNumber);

s.append(buf);

s.append("Not before date: ");

s.append((_rep->notBefore).toString());

s.append("\n");

s.append("Not after date: ");

s.append((_rep->notAfter).toString());

s.append("\n");

return s;

}

SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert, X509_STORE* crlStore)

{

verifyCertificateCallback = verifyCert;

_crlStore = crlStore;

_peerCertificate = NULL;

}

SSLCallbackInfo::~SSLCallbackInfo()

{

if (_peerCertificate)

{

delete _peerCertificate;

}

PEGASUS_NAMESPACE_END

Legend:

Removed from v.1.22
changed lines
	Added in v.1.40

No CVS admin address has been configured