version 1.4, 2002/08/06 21:28:35
|
version 1.40, 2004/12/07 22:43:14
|
|
|
//%///////////////////////////////////////////////////////////////////////////// |
//%2004//////////////////////////////////////////////////////////////////////// |
// | // |
// Copyright (c) 2000, 2001, 2002 BMC Software, Hewlett-Packard Company, IBM, |
// Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development |
// The Open Group, Tivoli Systems |
// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems. |
|
// Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L.P.; |
|
// IBM Corp.; EMC Corporation, The Open Group. |
|
// Copyright (c) 2004 BMC Software; Hewlett-Packard Development Company, L.P.; |
|
// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group. |
// | // |
// Permission is hereby granted, free of charge, to any person obtaining a copy | // Permission is hereby granted, free of charge, to any person obtaining a copy |
// of this software and associated documentation files (the "Software"), to | // of this software and associated documentation files (the "Software"), to |
|
|
// | // |
// Author: Markus Mueller (sedgewick_de@yahoo.de) | // Author: Markus Mueller (sedgewick_de@yahoo.de) |
// | // |
// Modified By: |
// Modified By: Nag Boranna, Hewlett-Packard Company (nagaraja_boranna@hp.com) |
// Nag Boranna, Hewlett-Packard Company ( nagaraja_boranna@hp.com ) |
// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com) |
|
// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com) |
|
// Heather Sterling, IBM (hsterl@us.ibm.com) |
|
// Amit K Arora, IBM (amita@in.ibm.com) for Bug#1090 |
// | // |
//%///////////////////////////////////////////////////////////////////////////// | //%///////////////////////////////////////////////////////////////////////////// |
| |
#ifdef PEGASUS_HAS_SSL | #ifdef PEGASUS_HAS_SSL |
|
#define OPENSSL_NO_KRB5 1 |
#include <openssl/err.h> | #include <openssl/err.h> |
#include <openssl/ssl.h> | #include <openssl/ssl.h> |
#include <openssl/rand.h> | #include <openssl/rand.h> |
|
|
#include <Pegasus/Common/Destroyer.h> | #include <Pegasus/Common/Destroyer.h> |
#include <Pegasus/Common/Socket.h> | #include <Pegasus/Common/Socket.h> |
#include <Pegasus/Common/Tracer.h> | #include <Pegasus/Common/Tracer.h> |
|
#include <Pegasus/Common/FileSystem.h> |
|
#include <time.h> |
|
#include <Pegasus/Common/MessageLoader.h> //l10n |
|
#include <Pegasus/Common/Formatter.h> |
| |
#include "SSLContext.h" | #include "SSLContext.h" |
#include "SSLContextRep.h" | #include "SSLContextRep.h" |
| |
|
|
|
// |
|
// Typedef's for OpenSSL callback functions. |
|
// |
|
extern "C" |
|
{ |
|
typedef void (* CRYPTO_SET_LOCKING_CALLBACK)(int, int, const char *, int); |
|
typedef unsigned long (* CRYPTO_SET_ID_CALLBACK)(void); |
|
}; |
|
|
|
|
|
typedef struct Timestamp |
|
{ |
|
char year[4]; |
|
char month[2]; |
|
char day[2]; |
|
char hour[2]; |
|
char minutes[2]; |
|
char seconds[2]; |
|
char dot; |
|
char microSeconds[6]; |
|
char plusOrMinus; |
|
char utcOffset[3]; |
|
char padding[3]; |
|
} Timestamp_t; |
|
|
PEGASUS_USING_STD; | PEGASUS_USING_STD; |
| |
PEGASUS_NAMESPACE_BEGIN | PEGASUS_NAMESPACE_BEGIN |
| |
// switch on if 'server needs certified client' |
const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0; |
//#define CLIENT_CERTIFY |
|
| |
// | // |
// use the following definitions only if SSL is available | // use the following definitions only if SSL is available |
// | // |
#ifdef PEGASUS_HAS_SSL | #ifdef PEGASUS_HAS_SSL |
| |
|
// Mutex for SSL locks. |
|
Mutex* SSLContextRep::_sslLocks = 0; |
|
|
|
// Mutex for _countRep. |
|
Mutex SSLContextRep::_countRepMutex; |
|
|
|
// Initialise _count for SSLContextRep objects. |
|
int SSLContextRep::_countRep = 0; |
|
|
|
|
// | // |
// certificate handling routine |
// Convert ASN1_UTCTIME to CIMDateTime |
// | // |
|
CIMDateTime getDateTime(const ASN1_UTCTIME *utcTime) |
|
{ |
|
struct tm time; |
|
int offset; |
|
Timestamp_t timeStamp; |
|
char tempString[80]; |
|
char plusOrMinus = '+'; |
|
unsigned char* utcTimeData = utcTime->data; |
| |
VERIFY_CERTIFICATE verify_certificate; |
memset(&time, '\0', sizeof(time)); |
| |
static int cert_verify(SSL_CTX *ctx, char *cert_file, char *key_file) |
#define g2(p) ( ( (p)[0] - '0' ) * 10 + (p)[1] - '0' ) |
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "cert_verify()"); |
|
| |
if (cert_file != NULL) |
if (utcTime->type == V_ASN1_GENERALIZEDTIME) |
{ | { |
if (SSL_CTX_use_certificate_file(ctx,cert_file,SSL_FILETYPE_PEM) <=0) |
time.tm_year = g2(utcTimeData) * 100; |
|
utcTimeData += 2; // Remaining data is equivalent to ASN1_UTCTIME type |
|
time.tm_year += g2(utcTimeData); |
|
} |
|
else |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
time.tm_year = g2(utcTimeData); |
"---> SSL: no certificate found in " + String(cert_file)); |
if (time.tm_year < 50) |
PEG_METHOD_EXIT(); |
{ |
return 0; |
time.tm_year += 2000; |
} | } |
if (key_file == NULL) key_file=cert_file; |
else |
if (SSL_CTX_use_PrivateKey_file(ctx,key_file,SSL_FILETYPE_PEM) <= 0) |
|
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
time.tm_year += 1900; |
"---> SSL: no private key found in " + String(key_file)); |
} |
PEG_METHOD_EXIT(); |
|
return 0; |
|
} | } |
| |
if (!SSL_CTX_check_private_key(ctx)) |
time.tm_mon = g2(utcTimeData + 2) - 1; |
|
time.tm_mday = g2(utcTimeData + 4); |
|
time.tm_hour = g2(utcTimeData + 6); |
|
time.tm_min = g2(utcTimeData + 8); |
|
time.tm_sec = g2(utcTimeData + 10); |
|
|
|
if (utcTimeData[12] == 'Z') |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
offset = 0; |
"---> SSL: Private and public key do not match"); |
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} | } |
|
else |
|
{ |
|
offset = g2(utcTimeData + 13) * 60 + g2(utcTimeData + 15); |
|
if (utcTimeData[12] == '-') |
|
{ |
|
plusOrMinus = '-'; |
} | } |
PEG_METHOD_EXIT(); |
|
return -1; |
|
} | } |
|
#undef g2 |
| |
static int prepareForCallback(int preverifyOk, X509_STORE_CTX *ctx) |
memset((void *)&timeStamp, 0, sizeof(Timestamp_t)); |
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "prepareForCallback()"); |
|
| |
char buf[256]; |
// Format the date. |
X509 *err_cert; |
sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d", |
int err; |
time.tm_year, |
int depth; |
time.tm_mon + 1, |
String subjectName; |
time.tm_mday, |
String issuerName; |
time.tm_hour, |
int verify_depth = 0; |
time.tm_min, |
int verify_error = X509_V_OK; |
time.tm_sec, |
|
0, |
|
offset); |
|
|
|
timeStamp.plusOrMinus = plusOrMinus; |
| |
err_cert = X509_STORE_CTX_get_current_cert(ctx); |
CIMDateTime dateTime; |
err = X509_STORE_CTX_get_error(ctx); |
|
| |
depth = X509_STORE_CTX_get_error_depth(ctx); |
dateTime.clear(); |
|
strcpy(tempString, (char *)&timeStamp); |
|
dateTime.set(tempString); |
|
|
|
return (dateTime); |
|
} |
| |
//FUTURE: Not sure what to do with these...? |
// |
//ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); |
// Static class used to define C++ callback functions for OpenSSL. |
//mydata = SSL_get_ex_data(ssl, mydata_index); |
// |
|
class SSLCallback |
|
{ |
| |
X509_NAME_oneline(X509_get_subject_name(err_cert), buf, 256); |
public: |
subjectName = String(buf); |
static int verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx); |
|
static int verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore); |
|
}; |
| |
if (verify_depth >= depth) |
// |
|
// Callback function that is called by the OpenSSL library. This function |
|
// checks whether the certificate is listed in any of the CRL's |
|
// |
|
int SSLCallback::verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore) |
{ | { |
preverifyOk = 1; |
PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::verificationCRLCallback"); |
verify_error = X509_V_OK; |
|
} |
X509_OBJECT obj; |
else |
X509_NAME *subject; |
|
X509_NAME *issuer; |
|
X509 *xs; |
|
X509_CRL *crl; |
|
X509_REVOKED *revoked; |
|
long serial; |
|
BIO *bio; |
|
int i, n, rc; |
|
char *cp; |
|
char *cp2; |
|
|
|
if (sslCRLStore == NULL) |
{ | { |
preverifyOk = 0; |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL store is NULL"); |
verify_error = X509_V_ERR_CERT_CHAIN_TOO_LONG; |
return ok; |
X509_STORE_CTX_set_error(ctx, verify_error); |
|
} | } |
| |
if (!preverifyOk) |
//ATTN: The following excerpt is based off of modssl's callback function |
|
//We may need to do something here for legal purposes. I have informed Warren of this, will resolve before 2.5 ships. |
|
|
|
/* |
|
* Determine certificate ingredients in advance |
|
*/ |
|
xs = X509_STORE_CTX_get_current_cert(ctx); |
|
subject = X509_get_subject_name(xs); |
|
issuer = X509_get_issuer_name(xs); |
|
|
|
/* |
|
* OpenSSL provides the general mechanism to deal with CRLs but does not |
|
* use them automatically when verifying certificates, so we do it |
|
* explicitly here. We will check the CRL for the currently checked |
|
* certificate, if there is such a CRL in the store. |
|
* |
|
* We come through this procedure for each certificate in the certificate |
|
* chain, starting with the root-CA's certificate. At each step we've to |
|
* both verify the signature on the CRL (to make sure it's a valid CRL) |
|
* and it's revocation list (to make sure the current certificate isn't |
|
* revoked). But because to check the signature on the CRL we need the |
|
* public key of the issuing CA certificate (which was already processed |
|
* one round before), we've a little problem. But we can both solve it and |
|
* at the same time optimize the processing by using the following |
|
* verification scheme (idea and code snippets borrowed from the GLOBUS |
|
* project): |
|
* |
|
* 1. We'll check the signature of a CRL in each step when we find a CRL |
|
* through the _subject_ name of the current certificate. This CRL |
|
* itself will be needed the first time in the next round, of course. |
|
* But we do the signature processing one round before this where the |
|
* public key of the CA is available. |
|
* |
|
* 2. We'll check the revocation list of a CRL in each step when |
|
* we find a CRL through the _issuer_ name of the current certificate. |
|
* This CRLs signature was then already verified one round before. |
|
* |
|
* This verification scheme allows a CA to revoke its own certificate as |
|
* well, of course. |
|
*/ |
|
|
|
/* |
|
* Try to retrieve a CRL corresponding to the _subject_ of |
|
* the current certificate in order to verify it's integrity. |
|
*/ |
|
|
|
memset((char *)&obj, 0, sizeof(obj)); |
|
X509_STORE_CTX pStoreCtx; |
|
X509_STORE_CTX_init(&pStoreCtx, sslCRLStore, NULL, NULL); |
|
rc = X509_STORE_get_by_subject(&pStoreCtx, X509_LU_CRL, subject, &obj); |
|
X509_STORE_CTX_cleanup(&pStoreCtx); |
|
crl = obj.data.crl; |
|
|
|
////////////////////////////////////////// |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL : return code is %d", rc); |
|
|
|
if (rc > 0 && crl != NULL) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL found"); |
"---> SSL: verify error: " + String(X509_verify_cert_error_string(err))); |
|
|
// |
|
// Log information about CRL |
|
// (A little bit complicated because of ASN.1 and BIOs...) |
|
// |
|
bio = BIO_new(BIO_s_mem()); |
|
BIO_printf(bio, "lastUpdate: "); |
|
ASN1_UTCTIME_print(bio, X509_CRL_get_lastUpdate(crl)); |
|
BIO_printf(bio, ", nextUpdate: "); |
|
ASN1_UTCTIME_print(bio, X509_CRL_get_nextUpdate(crl)); |
|
n = BIO_pending(bio); |
|
cp = (char*) malloc(n+1); |
|
n = BIO_read(bio, cp, n); |
|
cp[n] = '\0'; |
|
BIO_free(bio); |
|
cp2 = X509_NAME_oneline(subject, NULL, 0); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL : CRL Issuer : %s, %s", cp2, cp); |
|
|
|
//ATTN: This throws a memory error |
|
//free(cp2); |
|
free(cp); |
|
|
|
// |
|
// Verify the signature on this CRL |
|
// |
|
if (X509_CRL_verify(crl, X509_get_pubkey(xs)) <= 0) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL : Invalid signature on CRL"); |
|
//ATTN: Do we need to set this? |
|
//X509_STORE_CTX_set_error(ctx, X509_V_ERR_CRL_SIGNATURE_FAILURE); |
|
//X509_OBJECT_free_contents(&obj); |
|
PEG_METHOD_EXIT(); |
|
return 0; |
} | } |
| |
if (!preverifyOk && (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)) |
// |
|
// Check date of CRL to make sure it's not expired |
|
// |
|
i = X509_cmp_current_time(X509_CRL_get_nextUpdate(crl)); |
|
if (i == 0) |
{ | { |
X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, 256); |
Tracer::trace(TRC_SSL, Tracer::LEVEL2, "CRL has invalid nextUpdate field\n"); |
issuerName = String(buf); |
//ATTN: Do we need to set this? |
|
//X509_STORE_CTX_set_error(ctx, X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD); |
|
//X509_OBJECT_free_contents(&obj); |
|
PEG_METHOD_EXIT(); |
|
return 0; |
} | } |
else |
if (i < 0) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL2, "CRL has expired\n"); |
|
//ATTN: Do we need to set this? |
|
//X509_STORE_CTX_set_error(ctx, X509_V_ERR_CRL_HAS_EXPIRED); |
|
//X509_OBJECT_free_contents(&obj); |
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
|
|
X509_OBJECT_free_contents(&obj); |
|
|
|
} else |
{ | { |
X509_NAME_oneline(X509_get_issuer_name(err_cert), buf, 256); |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: No CRL for that subject found"); |
issuerName = String(buf); |
|
} | } |
| |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL checks out ok\n"); |
|
|
// | // |
// Call the verify_certificate() callback |
// Try to retrieve a CRL corresponding to the _issuer_ of |
|
// the current certificate in order to check for revocation. |
// | // |
CertificateInfo certInfo(subjectName, issuerName, depth, err); |
memset((char *)&obj, 0, sizeof(obj)); |
|
|
|
X509_STORE_CTX_init(&pStoreCtx, sslCRLStore, NULL, NULL); |
|
rc = X509_STORE_get_by_subject(&pStoreCtx, X509_LU_CRL, issuer, &obj); |
|
X509_STORE_CTX_cleanup(&pStoreCtx); |
|
crl = obj.data.crl; |
| |
if (verify_certificate(certInfo)) |
if (rc > 0 && crl != NULL) |
{ | { |
preverifyOk = 1; |
// |
} |
// Check if the current certificate is revoked by this CRL |
|
// |
|
#if SSL_LIBRARY_VERSION < 0x00904000 |
|
n = sk_num(X509_CRL_get_REVOKED(crl)); |
|
#else |
|
n = sk_X509_REVOKED_num(X509_CRL_get_REVOKED(crl)); |
|
#endif |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: Number of certificates revoked by the issuer %d", n); |
| |
//delete certInfo; |
for (i = 0; i < n; i++) |
|
{ |
|
#if SSL_LIBRARY_VERSION < 0x00904000 |
|
revoked = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i); |
|
#else |
|
revoked = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i); |
|
#endif |
|
|
|
serial = ASN1_INTEGER_get(revoked->serialNumber); |
| |
// ATTN-NB-03-05102002: Overriding the default verification result, may |
printf("Got serial number %ld\n", serial); |
// need to be changed to make it more generic. |
|
if (preverifyOk) |
if (ASN1_INTEGER_cmp(revoked->serialNumber, X509_get_serialNumber(xs)) == 0) |
{ | { |
X509_STORE_CTX_set_error(ctx, verify_error); |
serial = ASN1_INTEGER_get(revoked->serialNumber); |
|
cp = X509_NAME_oneline(issuer, NULL, 0); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"---> SSL : Certificate with serial %ld revoked per CRL from issuer %s\n", serial, cp); |
|
//ATTN: Mem error if uncomment following |
|
//free(cp); |
|
|
|
X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED); |
|
X509_OBJECT_free_contents(&obj); |
|
|
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
} |
|
|
|
X509_OBJECT_free_contents(&obj); |
} | } |
| |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return(preverifyOk); |
return ok; |
} | } |
| |
|
// |
|
// Callback function that is called by the OpenSSL library. This function |
|
// extracts X509 certficate information and pass that on to client application |
|
// callback function. |
|
// We HAVE to build the certificate in all cases since it's needed to get the associated username out of the repository |
|
// later in the transaction |
|
// |
|
int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
|
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()"); |
|
|
|
char buf[256]; |
|
X509 *currentCert; |
|
SSL *ssl; |
|
int verifyError = X509_V_OK; |
|
int revoked = -1; |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"--->SSL: Preverify Error %d", verifyError); |
| |
// | // |
// SSL context area |
// get the verification callback info specific to each SSL connection |
// | // |
// For the OSs that don't have /dev/random device file, |
ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); |
// must enable PEGASUS_SSL_RANDOMFILE flag. |
SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX); |
|
|
|
// |
|
// If the SSLContext does not have an additional callback |
|
// simply return the preverification error (or check the CRL) |
|
// We do not need to go through the additional steps. |
// | // |
// CIM clients must specify a SSL random file and also |
if (exData->verifyCertificateCallback == NULL) |
// set isCIMClient to true. However, CIMserver does not |
{ |
// seem to care the Random seed and /dev/random. |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"--->SSL: No verification callback specified"); |
|
|
|
if (exData->_crlStore == NULL) |
|
{ |
|
PEG_METHOD_EXIT(); |
|
return (preVerifyOk); |
|
} else |
|
{ |
|
revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_crlStore); |
|
PEG_METHOD_EXIT(); |
|
return (revoked); |
|
} |
|
} |
|
|
// | // |
|
// Check to see if a CRL path is defined |
// | // |
SSLContextRep::SSLContextRep(const String& certPath, |
if (exData->_crlStore) |
VERIFY_CERTIFICATE verifyCert, |
|
const String& randomFile, |
|
Boolean isCIMClient) |
|
throw(SSL_Exception) |
|
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_crlStore); |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"---> SSL: CRL callback returned %d", revoked); |
|
} |
| |
_certPath = certPath.allocateCString(); |
// |
|
// get the current certificate |
|
// |
|
currentCert = X509_STORE_CTX_get_current_cert(ctx); |
| |
verify_certificate = verifyCert; |
// |
|
// get the default verification error code |
|
// |
|
int errorCode = X509_STORE_CTX_get_error(ctx); |
| |
// | // |
// load SSL library |
// get the depth of certificate chain |
// | // |
SSL_load_error_strings(); |
int depth = X509_STORE_CTX_get_error_depth(ctx); |
SSL_library_init(); |
|
| |
#ifdef PEGASUS_SSL_RANDOMFILE |
// |
|
// get the version on the certificate |
|
// |
|
long version = X509_get_version(currentCert); |
| |
// | // |
// We will only need SSL Random Seed for CIM Clients |
// get the serial number of the certificate |
// | // |
if (isCIMClient) |
long serialNumber = ASN1_INTEGER_get(X509_get_serialNumber(currentCert)); |
{ |
|
long seedNumber; |
|
// | // |
// Initialise OpenSSL 0.9.5 random number generator. |
// get the validity of the certificate |
// | // |
if ( randomFile != String::EMPTY ) |
CIMDateTime notBefore = getDateTime(X509_get_notBefore(currentCert)); |
{ |
|
ArrayDestroyer<char> pRandomFile(randomFile.allocateCString()); |
|
char* randFilename = pRandomFile.getPointer(); |
|
| |
int ret = RAND_load_file(randFilename, -1); |
CIMDateTime notAfter = getDateTime(X509_get_notAfter(currentCert)); |
if ( ret < 0 ) |
|
{ |
|
PEG_METHOD_EXIT(); |
|
throw( SSL_Exception("RAND_load_file - failed")); |
|
} |
|
| |
// | // |
// Will do more seeding |
// get the subject name on the certificate |
// | // |
srandom((unsigned int)time(NULL)); // Initialize |
X509_NAME_oneline(X509_get_subject_name(currentCert), buf, 256); |
seedNumber = random(); |
String subjectName = String(buf); |
RAND_seed((unsigned char *) &seedNumber, sizeof(seedNumber)); |
|
| |
int seedRet = RAND_status(); |
// |
if ( seedRet == 0 ) |
// get the default verification error string |
|
// |
|
String errorStr = String(X509_verify_cert_error_string(errorCode)); |
|
|
|
// |
|
// log the error string if the default verification was failed |
|
// |
|
if (!preVerifyOk) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Not enough data , RAND_status = " + seedRet ); |
"---> SSL: certificate default verification error: %s", (const char*)errorStr.getCString()); |
PEG_METHOD_EXIT(); |
|
throw( SSL_Exception("RAND_seed - Not enough seed data ")); |
|
} | } |
|
|
|
// |
|
// get the issuer name on the certificate |
|
// |
|
if (!preVerifyOk && (errorCode == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)) |
|
{ |
|
X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, 256); |
} | } |
else | else |
{ | { |
PEG_METHOD_EXIT(); |
X509_NAME_oneline(X509_get_issuer_name(currentCert), buf, 256); |
throw( SSL_Exception("Random seed file required")); |
|
} |
|
|
|
} | } |
|
String issuerName = String(buf); |
#endif // end of PEGASUS_SSL_RANDOMFILE |
|
| |
// | // |
// create SSL Context Area |
// Create the certificate object |
// | // |
|
exData->_peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber, |
|
notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk); |
| |
if (!( _SSLContext = SSL_CTX_new(SSLv23_method()) )) |
// |
|
// Call the application callback. |
|
// Note that the verification result does not automatically get set to X509_V_OK if the callback is successful. |
|
// This is because OpenSSL retains the original default error in case we want to use it later. |
|
// To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here. |
|
// |
|
if (exData->verifyCertificateCallback(*exData->_peerCertificate)) |
{ | { |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"--> SSL: verifyCertificateCallback() returned X509_V_OK"); |
|
|
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw( SSL_Exception("Could not get SSL CTX")); |
return 1; |
} | } |
|
else // verification failed, handshake will be immediately terminated |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"--> SSL: verifyCertificateCallback() returned error %d", exData->_peerCertificate->getErrorCode()); |
| |
#ifdef PEGASUS_OS_HPUX |
PEG_METHOD_EXIT(); |
if (!(SSL_CTX_set_cipher_list(_SSLContext, SSL_TXT_EXP40))) |
return 0; |
throw( SSL_Exception("Could not set the cipher list")); |
} |
#endif |
} |
| |
// | // |
// set overall SSL Context flags |
// Callback function called by OpenSSL. This request is merely forwarded to the static |
|
// function SSLCallback::callback(). The SSLCallback class is a friend class of the |
|
// Pegasus SSL related classes needed to complete the callback. |
// | // |
|
extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
SSL_CTX_set_quiet_shutdown(_SSLContext, 1); |
|
SSL_CTX_set_mode(_SSLContext, SSL_MODE_AUTO_RETRY); |
|
SSL_CTX_set_options(_SSLContext,SSL_OP_ALL); |
|
|
|
#ifdef CLIENT_CERTIFY |
|
SSL_CTX_set_verify(_SSLContext, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, |
|
prepareForCallback); |
|
#else |
|
if (verifyCert != NULL) |
|
{ | { |
SSL_CTX_set_verify(_SSLContext, |
return SSLCallback::verificationCallback(preVerifyOk, ctx); |
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback); |
|
} | } |
#endif |
|
| |
// | // |
// check certificate given to me |
// Implement OpenSSL locking callback. |
// | // |
|
void pegasus_locking_callback( int mode, |
|
int type, |
|
const char* file, |
|
int line) |
|
{ |
|
// Check whether the mode is lock or unlock. |
| |
if (!cert_verify(_SSLContext, _certPath, _certPath)) |
if ( mode & CRYPTO_LOCK ) |
{ | { |
PEG_METHOD_EXIT(); |
/*Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
throw( SSL_Exception("Could not get certificate and/or private key")); |
"Now locking for %d", pegasus_thread_self());*/ |
|
SSLContextRep::_sslLocks[type].lock( pegasus_thread_self() ); |
|
} |
|
else |
|
{ |
|
/*Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Now unlocking for %d", pegasus_thread_self());*/ |
|
SSLContextRep::_sslLocks[type].unlock( ); |
} | } |
|
|
PEG_METHOD_EXIT(); |
|
} | } |
|
|
| |
// | // |
// Destructor |
// Initialize OpenSSL Locking and id callbacks. |
// | // |
|
void SSLContextRep::init_ssl() |
SSLContextRep::~SSLContextRep() |
|
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::~SSLContextRep()"); |
// Allocate Memory for _sslLocks. SSL locks needs to be able to handle |
|
// up to CRYPTO_num_locks() different mutex locks. |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
|
"Initialized SSL callback."); |
| |
free(_certPath); |
_sslLocks= new Mutex[CRYPTO_num_locks()]; |
SSL_CTX_free(_SSLContext); |
|
|
// Set the ID callback. The ID callback returns a thread ID. |
|
|
|
CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK) pegasus_thread_self); |
|
|
|
// Set the locking callback to pegasus_locking_callback. |
|
|
|
CRYPTO_set_locking_callback((CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback); |
| |
PEG_METHOD_EXIT(); |
|
} | } |
| |
SSL_CTX * SSLContextRep::getContext() const |
// Free OpenSSL Locking and id callbacks. |
|
void SSLContextRep::free_ssl() |
{ | { |
return _SSLContext; |
// Cleanup _sslLocks and set locking & id callback to NULL. |
|
|
|
CRYPTO_set_locking_callback(NULL); |
|
CRYPTO_set_id_callback (NULL); |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
|
"Freed SSL callback."); |
|
|
|
delete []_sslLocks; |
} | } |
#else |
|
| |
|
|
|
// |
|
// SSL context area |
// | // |
// these definitions are used if ssl is not availabel |
// For the OSs that don't have /dev/random device file, |
|
// must enable PEGASUS_SSL_RANDOMFILE flag. |
// | // |
|
SSLContextRep::SSLContextRep( |
|
const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
const String& crlPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile) |
|
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
| |
SSLContextRep::SSLContextRep(const String& certPath, |
_trustStore = trustStore; |
VERIFY_CERTIFICATE verifyCert, |
|
const String& randomFile, |
|
Boolean isCIMClient) throw(SSL_Exception) {} |
|
| |
SSLContextRep::~SSLContextRep() {} |
_certPath = certPath; |
| |
SSL_CTX * SSLContextRep::getContext() const { return NULL; } |
_keyPath = keyPath; |
| |
#endif // end of PEGASUS_HAS_SSL |
_crlPath = crlPath; |
| |
/////////////////////////////////////////////////////////////////////////////// |
_crlStore = NULL; |
// |
|
// SSLContext |
|
// |
|
/////////////////////////////////////////////////////////////////////////////// |
|
| |
|
_certificateVerifyFunction = verifyCert; |
| |
SSLContext::SSLContext( |
// |
const String& certPath, |
// If a truststore and/or peer verification function is specified, enable peer verification |
VERIFY_CERTIFICATE verifyCert, |
// |
const String& randomFile, |
if (trustStore != String::EMPTY || verifyCert != NULL) |
Boolean isCIMClient) throw(SSL_Exception) |
|
{ | { |
_rep = new SSLContextRep(certPath, verifyCert, randomFile, isCIMClient); |
_verifyPeer = true; |
} | } |
|
else |
SSLContext::~SSLContext() |
|
{ | { |
delete _rep; |
_verifyPeer = false; |
} | } |
| |
|
|
/////////////////////////////////////////////////////////////////////////////// |
|
// | // |
// CertificateInfo |
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
// | // |
/////////////////////////////////////////////////////////////////////////////// |
|
|
|
CertificateInfo::CertificateInfo( |
|
const String subjectName, |
|
const String issuerName, |
|
const int errorDepth, |
|
const int errorCode) |
|
: |
|
_subjectName(subjectName), |
|
_issuerName(issuerName), |
|
_errorDepth(errorDepth), |
|
_errorCode(errorCode) |
|
{ | { |
_respCode = 0; |
AutoMutex autoMut(_countRepMutex); |
} |
|
| |
CertificateInfo::~CertificateInfo() |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Value of Countrep in constructor %d", _countRep); |
|
if ( _countRep == 0 ) |
{ | { |
|
init_ssl(); |
|
|
|
// |
|
// load SSL library |
|
// |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Before calling SSL_load_error_strings %d", pegasus_thread_self()); |
|
|
|
SSL_load_error_strings(); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"After calling SSL_load_error_strings %d", pegasus_thread_self()); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Before calling SSL_library_init %d", pegasus_thread_self()); |
|
|
|
SSL_library_init(); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"After calling SSL_library_init %d", pegasus_thread_self()); |
| |
} | } |
| |
String CertificateInfo::getSubjectName() const |
_countRep++; |
{ |
} // mutex unlocks here |
return (_subjectName); |
|
|
_randomInit(randomFile); |
|
|
|
_sslContext = _makeSSLContext(); |
|
|
|
PEG_METHOD_EXIT(); |
} | } |
| |
String CertificateInfo::getIssuerName() const |
SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) |
{ | { |
return (_issuerName); |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
} |
|
| |
int CertificateInfo::getErrorDepth() const |
_trustStore = sslContextRep._trustStore; |
|
_certPath = sslContextRep._certPath; |
|
_keyPath = sslContextRep._keyPath; |
|
_crlPath = sslContextRep._crlPath; |
|
_verifyPeer = sslContextRep._verifyPeer; |
|
_certificateVerifyFunction = sslContextRep._certificateVerifyFunction; |
|
_randomFile = sslContextRep._randomFile; |
|
|
|
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
|
{ |
|
AutoMutex autoMut(_countRepMutex); |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Value of Countrep in copy constructor %d", _countRep); |
|
if ( _countRep == 0 ) |
{ | { |
return (_errorDepth); |
init_ssl(); |
} | } |
| |
int CertificateInfo::getErrorCode() const |
_countRep++; |
{ |
} // mutex unlocks here |
return (_errorCode); |
|
|
_sslContext = _makeSSLContext(); |
|
PEG_METHOD_EXIT(); |
} | } |
| |
void CertificateInfo::setResponseCode(const int respCode) |
// |
{ |
// Destructor |
_respCode = respCode; |
// |
|
|
|
SSLContextRep::~SSLContextRep() |
|
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::~SSLContextRep()"); |
|
|
|
SSL_CTX_free(_sslContext); |
|
|
|
// Decrement the SSLContextRep object _counter. |
|
{ |
|
AutoMutex autoMut(_countRepMutex); |
|
_countRep--; |
|
// Free SSL locks if no instances of SSLContextRep exist. |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Value of Countrep in destructor %d", _countRep); |
|
if ( _countRep == 0 ) |
|
{ |
|
free_ssl(); |
|
} |
|
|
|
} |
|
PEG_METHOD_EXIT(); |
|
} |
|
|
|
// |
|
// initialize OpenSSL's PRNG |
|
// |
|
void SSLContextRep::_randomInit(const String& randomFile) |
|
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_randomInit()"); |
|
|
|
Boolean ret; |
|
int retVal = 0; |
|
|
|
#ifdef PEGASUS_SSL_RANDOMFILE |
|
if ( RAND_status() == 0 ) |
|
{ |
|
// |
|
// Initialise OpenSSL random number generator. |
|
// |
|
if ( randomFile == String::EMPTY ) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
|
"Random seed file is required."); |
|
PEG_METHOD_EXIT(); |
|
//l10n |
|
//throw( SSLException("Random seed file required")); |
|
MessageLoaderParms parms("Common.SSLContext.RANDOM_SEED_FILE_REQUIRED", |
|
"Random seed file required"); |
|
throw SSLException(parms); |
|
} |
|
|
|
// |
|
// Try the given random seed file |
|
// |
|
ret = FileSystem::exists(randomFile); |
|
if( ret ) |
|
{ |
|
retVal = RAND_load_file(randomFile.getCString(), -1); |
|
if ( retVal < 0 ) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
|
"Not enough seed data in seed file: " + randomFile); |
|
PEG_METHOD_EXIT(); |
|
//l10n |
|
// do not put in $0 in default message, but pass in filename for bundle message |
|
//throw( SSLException("Not enough seed data in random seed file.")); |
|
MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE", |
|
"Not enough seed data in random seed file.", |
|
randomFile); |
|
throw SSLException(parms); |
|
} |
|
} |
|
else |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
|
"seed file - " + randomFile + " does not exist."); |
|
PEG_METHOD_EXIT(); |
|
//l10n |
|
//throw( SSLException("Seed file '" + randomFile + "' does not exist.")); |
|
MessageLoaderParms parms("Common.SSLContext.SEED_FILE_DOES_NOT_EXIST", |
|
"Seed file '$0' does not exist.", |
|
randomFile); |
|
throw SSLException(parms); |
|
} |
|
|
|
if ( RAND_status() == 0 ) |
|
{ |
|
// |
|
// Try to do more seeding |
|
// |
|
long seedNumber; |
|
#if defined(PEGASUS_PLATFORM_WIN32_IX86_MSVC) |
|
srand((unsigned int)time(NULL)); // Initialize |
|
seedNumber = rand(); |
|
#else |
|
srandom((unsigned int)time(NULL)); // Initialize |
|
seedNumber = random(); |
|
#endif |
|
RAND_seed((unsigned char *) &seedNumber, sizeof(seedNumber)); |
|
|
|
int seedRet = RAND_status(); |
|
if ( seedRet == 0 ) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
|
"Not enough seed data in random seed file, RAND_status = " + |
|
seedRet); |
|
PEG_METHOD_EXIT(); |
|
//l10n 485 |
|
// do not put in $0 in default message, but pass in filename for bundle message |
|
//throw( SSLException("Not enough seed data in random seed file.")); |
|
MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE", |
|
"Not enough seed data in random seed file.", |
|
randomFile); |
|
throw SSLException(parms); |
|
} |
|
} |
|
} |
|
#endif /* PEGASUS_SSL_RANDOMFILE */ |
|
|
|
int seedRet = RAND_status(); |
|
if ( seedRet == 0 ) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
|
"Not enough seed data , RAND_status = " + seedRet ); |
|
PEG_METHOD_EXIT(); |
|
//l10n |
|
//throw( SSLException("Not enough seed data.")); |
|
MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA", |
|
"Not enough seed data."); |
|
throw SSLException(parms); |
|
} |
|
|
|
PEG_METHOD_EXIT(); |
|
} |
|
|
|
SSL_CTX * SSLContextRep::_makeSSLContext() |
|
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_makeSSLContext()"); |
|
|
|
SSL_CTX * sslContext = 0; |
|
|
|
// |
|
// create SSL Context Area |
|
// |
|
|
|
if (!( sslContext = SSL_CTX_new(SSLv23_method()) )) |
|
{ |
|
PEG_METHOD_EXIT(); |
|
//l10n |
|
//throw( SSLException("Could not get SSL CTX")); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET", |
|
"Could not get SSL CTX"); |
|
throw SSLException(parms); |
|
} |
|
|
|
#ifdef PEGASUS_SSL_WEAKENCRYPTION |
|
if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40))){ |
|
//l10n |
|
//throw( SSLException("Could not set the cipher list")); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_SET_CIPHER_LIST", |
|
"Could not set the cipher list"); |
|
throw SSLException(parms); |
|
} |
|
#endif |
|
|
|
// |
|
// set overall SSL Context flags |
|
// |
|
|
|
SSL_CTX_set_quiet_shutdown(sslContext, 1); |
|
SSL_CTX_set_mode(sslContext, SSL_MODE_AUTO_RETRY); |
|
SSL_CTX_set_options(sslContext,SSL_OP_ALL); |
|
SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF); |
|
|
|
if (_verifyPeer) |
|
{ |
|
//ATTN: We might still need a flag to specify SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
|
// If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be terminated |
|
// if the client sends no certificate or sends an untrusted certificate. The |
|
// callback function is not called in this case; the handshake is simply terminated. |
|
// This value has NO effect in from a client perspective |
|
|
|
if (_certificateVerifyFunction != NULL) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: certificate verification callback specified"); |
|
SSL_CTX_set_verify(sslContext, |
|
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback); |
|
} |
|
else |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: Trust Store specified"); |
|
SSL_CTX_set_verify(sslContext, |
|
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, |
|
prepareForCallback); |
|
} |
|
} |
|
else |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Trust Store and certificate verification callback are NOT specified"); |
|
SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL); |
|
} |
|
|
|
// |
|
// Check if there is CA certificate file or directory specified. If specified, |
|
// and is not empty, load the certificates from the Trust store. |
|
// |
|
if (_trustStore != String::EMPTY) |
|
{ |
|
// |
|
// The truststore may be a single file of CA certificates OR |
|
// a directory containing multiple CA certificates. |
|
// Check which one it is, and call the load_verify_locations function |
|
// with the appropriate parameter. Note: It is possible to have both |
|
// options, in which case the CA file takes precedence over the CA path. |
|
// However, since there is currently only one trust parameter to the |
|
// SSL functions, only allow one choice here. |
|
// |
|
if (FileSystem::isDirectory(_trustStore)) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Truststore is a directory"); |
|
// |
|
// load certificates from the trust store |
|
// |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Loading certificates from the trust store: " + _trustStore); |
|
|
|
if ((!SSL_CTX_load_verify_locations(sslContext, NULL, _trustStore.getCString())) || |
|
(!SSL_CTX_set_default_verify_paths(sslContext))) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Could not load certificates from the trust store: " + _trustStore); |
|
//l10n |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
|
"Could not load certificates in to trust store."); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
|
|
} |
|
else if (FileSystem::exists(_trustStore)) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Truststore is a file"); |
|
// |
|
// Get size of the trust store file: |
|
// |
|
Uint32 fileSize = 0; |
|
|
|
FileSystem::getFileSize(_trustStore, fileSize); |
|
|
|
if (fileSize > 0) |
|
{ |
|
// |
|
// load certificates from the trust store |
|
// |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Loading certificates from the trust store: " + _trustStore); |
|
|
|
if ((!SSL_CTX_load_verify_locations(sslContext, _trustStore.getCString(), NULL)) || |
|
(!SSL_CTX_set_default_verify_paths(sslContext))) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Could not load certificates from the trust store: " + _trustStore); |
|
//l10n |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
|
"Could not load certificates in to trust store."); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
} |
|
else |
|
{ |
|
// |
|
// no certificates found in the trust store |
|
// |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: No certificates to load from the trust store: " + _trustStore); |
|
} |
|
} |
|
} |
|
|
|
if (_crlPath != String::EMPTY) |
|
{ |
|
//need to save this -- can we make it static since there's only one CRL for cimserver? |
|
X509_LOOKUP* pLookup; |
|
|
|
_crlStore = X509_STORE_new(); |
|
|
|
//the validity of the crlstore was checked in ConfigManager during server startup |
|
if (FileSystem::isDirectory(_crlPath)) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: CRL store is a directory in %s", (const char*)_crlPath.getCString()); |
|
|
|
if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_hash_dir())) == NULL) |
|
{ |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS", |
|
"Could not load certificate revocation list."); |
|
X509_STORE_free(_crlStore); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
|
|
X509_LOOKUP_add_dir(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM); |
|
|
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Successfully configured CRL directory"); |
|
|
|
} else |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: CRL store is the file %s", (const char*)_crlPath.getCString()); |
|
|
|
if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_file())) == NULL) |
|
{ |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS", |
|
"Could not load certificate revocation list."); |
|
X509_STORE_free(_crlStore); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
|
|
X509_LOOKUP_load_file(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM); |
|
|
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Successfully configured CRL file"); |
|
} |
|
} |
|
|
|
Boolean keyLoaded = false; |
|
|
|
// |
|
// Check if there is a certificate file (file containing server |
|
// certificate) specified. If specified, validate and load the |
|
// certificate. |
|
// |
|
if (_certPath != String::EMPTY) |
|
{ |
|
// |
|
// load the specified server certificates |
|
// |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Loading server certificate from: " + _certPath); |
|
|
|
if (SSL_CTX_use_certificate_file(sslContext, |
|
_certPath.getCString(), SSL_FILETYPE_PEM) <=0) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: No server certificate found in " + _certPath); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE", |
|
"Could not get server certificate."); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
|
|
// |
|
// If there is no key file (file containing server |
|
// private key) specified, then try loading the key from the certificate file. |
|
// As of 2.4, if a keyfile is specified, its location is verified during server |
|
// startup and will throw an error if the path is invalid. |
|
// |
|
if (_keyPath == String::EMPTY) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: loading private key from: " + _certPath); |
|
// |
|
// load the private key and check for validity |
|
// |
|
if (!_verifyPrivateKey(sslContext, _certPath)) |
|
{ |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", |
|
"Could not get private key."); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
keyLoaded = true; |
|
} |
|
} |
|
|
|
// |
|
// Check if there is a key file (file containing server |
|
// private key) specified and the key was not already loaded. |
|
// If specified, validate and load the key. |
|
// |
|
if (_keyPath != String::EMPTY && !keyLoaded) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: loading private key from: " + _keyPath); |
|
// |
|
// load given private key and check for validity |
|
// |
|
if (!_verifyPrivateKey(sslContext, _keyPath)) |
|
{ |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", |
|
"Could not get private key."); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
keyLoaded = true; |
|
} |
|
|
|
PEG_METHOD_EXIT(); |
|
return sslContext; |
|
} |
|
|
|
Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, const String& keyPath) |
|
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()"); |
|
|
|
if (SSL_CTX_use_PrivateKey_file(ctx, keyPath.getCString(), SSL_FILETYPE_PEM) <= 0) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: no private key found in " + String(keyPath)); |
|
PEG_METHOD_EXIT(); |
|
return false; |
|
} |
|
|
|
if (!SSL_CTX_check_private_key(ctx)) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Private and public key do not match"); |
|
PEG_METHOD_EXIT(); |
|
return false; |
|
} |
|
|
|
PEG_METHOD_EXIT(); |
|
return true; |
|
} |
|
|
|
SSL_CTX * SSLContextRep::getContext() const |
|
{ |
|
return _sslContext; |
|
} |
|
|
|
String SSLContextRep::getTrustStore() const |
|
{ |
|
return _trustStore; |
|
} |
|
|
|
String SSLContextRep::getCertPath() const |
|
{ |
|
return _certPath; |
|
} |
|
|
|
String SSLContextRep::getKeyPath() const |
|
{ |
|
return _keyPath; |
|
} |
|
|
|
String SSLContextRep::getCRLPath() const |
|
{ |
|
return _crlPath; |
|
} |
|
|
|
X509_STORE* SSLContextRep::getCRLStore() const |
|
{ |
|
return _crlStore; |
|
} |
|
|
|
Boolean SSLContextRep::isPeerVerificationEnabled() const |
|
{ |
|
return _verifyPeer; |
|
} |
|
|
|
SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const |
|
{ |
|
return _certificateVerifyFunction; |
|
} |
|
|
|
#else |
|
|
|
// |
|
// these definitions are used if ssl is not available |
|
// |
|
|
|
SSLContextRep::SSLContextRep(const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile) {} |
|
|
|
SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {} |
|
|
|
SSLContextRep::~SSLContextRep() {} |
|
|
|
SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; } |
|
|
|
Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, |
|
const String& keyPath) { return false; } |
|
|
|
SSL_CTX * SSLContextRep::getContext() const { return 0; } |
|
|
|
String SSLContextRep::getTrustStore() const { return String::EMPTY; } |
|
|
|
String SSLContextRep::getCertPath() const { return String::EMPTY; } |
|
|
|
String SSLContextRep::getKeyPath() const { return String::EMPTY; } |
|
|
|
String SSLContextRep::getCRLPath() const { return String::EMPTY; } |
|
|
|
X509_STORE* SSLContextRep::getCRLStore() const { return NULL; } |
|
|
|
Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } |
|
|
|
SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; } |
|
|
|
void SSLContextRep::init_ssl() {} |
|
|
|
void SSLContextRep::free_ssl() {} |
|
|
|
#endif // end of PEGASUS_HAS_SSL |
|
|
|
/////////////////////////////////////////////////////////////////////////////// |
|
// |
|
// SSLContext |
|
// |
|
/////////////////////////////////////////////////////////////////////////////// |
|
|
|
|
|
SSLContext::SSLContext( |
|
const String& trustStore, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile) |
|
{ |
|
_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, String::EMPTY, verifyCert, randomFile); |
|
} |
|
|
|
SSLContext::SSLContext( |
|
const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile) |
|
{ |
|
_rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile); |
|
} |
|
|
|
//PEP187 |
|
SSLContext::SSLContext( |
|
const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
const String& crlPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile) |
|
{ |
|
_rep = new SSLContextRep(trustStore, certPath, keyPath, crlPath, verifyCert, randomFile); |
|
} |
|
|
|
SSLContext::SSLContext(const SSLContext& sslContext) |
|
{ |
|
_rep = new SSLContextRep(*sslContext._rep); |
|
} |
|
|
|
// Dummy constructor made private to disallow default construction |
|
SSLContext::SSLContext() |
|
{ |
|
} |
|
|
|
SSLContext::~SSLContext() |
|
{ |
|
delete _rep; |
|
} |
|
|
|
String SSLContext::getTrustStore() const |
|
{ |
|
return (_rep->getTrustStore()); |
|
} |
|
|
|
String SSLContext::getCertPath() const |
|
{ |
|
return (_rep->getCertPath()); |
|
} |
|
|
|
String SSLContext::getKeyPath() const |
|
{ |
|
return (_rep->getKeyPath()); |
|
} |
|
|
|
String SSLContext::getCRLPath() const |
|
{ |
|
return (_rep->getCRLPath()); |
|
} |
|
|
|
X509_STORE* SSLContext::getCRLStore() const |
|
{ |
|
return (_rep->getCRLStore()); |
|
} |
|
|
|
Boolean SSLContext::isPeerVerificationEnabled() const |
|
{ |
|
return (_rep->isPeerVerificationEnabled()); |
|
} |
|
|
|
SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const |
|
{ |
|
return (_rep->getSSLCertificateVerifyFunction()); |
|
} |
|
|
|
/////////////////////////////////////////////////////////////////////////////// |
|
// |
|
// SSLCertificateInfo |
|
// |
|
/////////////////////////////////////////////////////////////////////////////// |
|
// |
|
// Certificate validation result codes. |
|
// |
|
const int SSLCertificateInfo::V_OK = 0; |
|
|
|
const int SSLCertificateInfo::V_ERR_UNABLE_TO_GET_ISSUER_CERT = 2; |
|
const int SSLCertificateInfo::V_ERR_UNABLE_TO_GET_CRL = 3; |
|
const int SSLCertificateInfo::V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE = 4; |
|
const int SSLCertificateInfo::V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE = 5; |
|
const int SSLCertificateInfo::V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY = 6; |
|
const int SSLCertificateInfo::V_ERR_CERT_SIGNATURE_FAILURE = 7; |
|
const int SSLCertificateInfo::V_ERR_CRL_SIGNATURE_FAILURE = 8; |
|
const int SSLCertificateInfo::V_ERR_CERT_NOT_YET_VALID = 9; |
|
const int SSLCertificateInfo::V_ERR_CERT_HAS_EXPIRED = 10; |
|
const int SSLCertificateInfo::V_ERR_CRL_NOT_YET_VALID = 11; |
|
const int SSLCertificateInfo::V_ERR_CRL_HAS_EXPIRED = 12; |
|
const int SSLCertificateInfo::V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD = 13; |
|
const int SSLCertificateInfo::V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD = 14; |
|
const int SSLCertificateInfo::V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD = 15; |
|
const int SSLCertificateInfo::V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD = 16; |
|
const int SSLCertificateInfo::V_ERR_OUT_OF_MEM = 17; |
|
const int SSLCertificateInfo::V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT = 18; |
|
const int SSLCertificateInfo::V_ERR_SELF_SIGNED_CERT_IN_CHAIN = 19; |
|
const int SSLCertificateInfo::V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY = 20; |
|
const int SSLCertificateInfo::V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE = 21; |
|
const int SSLCertificateInfo::V_ERR_CERT_CHAIN_TOO_LONG = 22; |
|
const int SSLCertificateInfo::V_ERR_CERT_REVOKED = 23; |
|
const int SSLCertificateInfo::V_ERR_INVALID_CA = 24; |
|
const int SSLCertificateInfo::V_ERR_PATH_LENGTH_EXCEEDED = 25; |
|
const int SSLCertificateInfo::V_ERR_INVALID_PURPOSE = 26; |
|
const int SSLCertificateInfo::V_ERR_CERT_UNTRUSTED = 27; |
|
const int SSLCertificateInfo::V_ERR_CERT_REJECTED = 28; |
|
const int SSLCertificateInfo::V_ERR_SUBJECT_ISSUER_MISMATCH = 29; |
|
const int SSLCertificateInfo::V_ERR_AKID_SKID_MISMATCH = 30; |
|
const int SSLCertificateInfo::V_ERR_AKID_ISSUER_SERIAL_MISMATCH = 31; |
|
const int SSLCertificateInfo::V_ERR_KEYUSAGE_NO_CERTSIGN = 32; |
|
|
|
const int SSLCertificateInfo::V_ERR_APPLICATION_VERIFICATION = 50; |
|
|
|
class SSLCertificateInfoRep |
|
{ |
|
public: |
|
String subjectName; |
|
String issuerName; |
|
Uint32 depth; |
|
Uint32 errorCode; |
|
Uint32 respCode; |
|
String errorString; |
|
Uint32 versionNumber; |
|
long serialNumber; |
|
CIMDateTime notBefore; |
|
CIMDateTime notAfter; |
|
}; |
|
|
|
|
|
SSLCertificateInfo::SSLCertificateInfo( |
|
const String subjectName, |
|
const String issuerName, |
|
const int errorDepth, |
|
const int errorCode, |
|
const int respCode) |
|
{ |
|
_rep = new SSLCertificateInfoRep(); |
|
_rep->subjectName = subjectName; |
|
_rep->issuerName = issuerName; |
|
_rep->versionNumber = 0; |
|
_rep->serialNumber = 0; |
|
_rep->notBefore = CIMDateTime(); |
|
_rep->notAfter = CIMDateTime(); |
|
_rep->depth = errorDepth; |
|
_rep->errorCode = errorCode; |
|
_rep->errorString = String::EMPTY; |
|
_rep->respCode = respCode; |
|
} |
|
|
|
SSLCertificateInfo::SSLCertificateInfo( |
|
const String subjectName, |
|
const String issuerName, |
|
const Uint32 versionNumber, |
|
const long serialNumber, |
|
const CIMDateTime notBefore, |
|
const CIMDateTime notAfter, |
|
const Uint32 depth, |
|
const Uint32 errorCode, |
|
const String errorString, |
|
const Uint32 respCode) |
|
{ |
|
_rep = new SSLCertificateInfoRep(); |
|
_rep->subjectName = subjectName; |
|
_rep->issuerName = issuerName; |
|
_rep->versionNumber = versionNumber; |
|
_rep->serialNumber = serialNumber; |
|
_rep->notBefore = notBefore; |
|
_rep->notAfter = notAfter; |
|
_rep->depth = depth; |
|
_rep->errorCode = errorCode; |
|
_rep->errorString = errorString; |
|
_rep->respCode = respCode; |
|
} |
|
|
|
SSLCertificateInfo::SSLCertificateInfo( |
|
const SSLCertificateInfo& certificateInfo) |
|
{ |
|
_rep = new SSLCertificateInfoRep(); |
|
_rep->subjectName = certificateInfo._rep->subjectName; |
|
_rep->issuerName = certificateInfo._rep->issuerName; |
|
_rep->versionNumber = certificateInfo._rep->versionNumber; |
|
_rep->serialNumber = certificateInfo._rep->serialNumber; |
|
_rep->notBefore = certificateInfo._rep->notBefore; |
|
_rep->notAfter = certificateInfo._rep->notAfter; |
|
_rep->depth = certificateInfo._rep->depth; |
|
_rep->errorCode = certificateInfo._rep->errorCode; |
|
_rep->errorString = certificateInfo._rep->errorString; |
|
_rep->respCode = certificateInfo._rep->respCode; |
|
} |
|
|
|
// Dummy constructor made private to disallow default construction |
|
SSLCertificateInfo::SSLCertificateInfo() |
|
{ |
|
} |
|
|
|
SSLCertificateInfo::~SSLCertificateInfo() |
|
{ |
|
delete _rep; |
|
} |
|
|
|
String SSLCertificateInfo::getSubjectName() const |
|
{ |
|
return (_rep->subjectName); |
|
} |
|
|
|
String SSLCertificateInfo::getIssuerName() const |
|
{ |
|
return (_rep->issuerName); |
|
} |
|
|
|
Uint32 SSLCertificateInfo::getVersionNumber() const |
|
{ |
|
return (_rep->versionNumber); |
|
} |
|
|
|
long SSLCertificateInfo::getSerialNumber() const |
|
{ |
|
return (_rep->serialNumber); |
|
} |
|
|
|
CIMDateTime SSLCertificateInfo::getNotBefore() const |
|
{ |
|
return (_rep->notBefore); |
|
} |
|
|
|
CIMDateTime SSLCertificateInfo::getNotAfter() const |
|
{ |
|
return (_rep->notAfter); |
|
} |
|
|
|
Uint32 SSLCertificateInfo::getErrorDepth() const |
|
{ |
|
return (_rep->depth); |
|
} |
|
|
|
Uint32 SSLCertificateInfo::getErrorCode() const |
|
{ |
|
return (_rep->errorCode); |
|
} |
|
|
|
void SSLCertificateInfo::setErrorCode(const int errorCode) |
|
{ |
|
_rep->errorCode = errorCode; |
|
} |
|
|
|
String SSLCertificateInfo::getErrorString() const |
|
{ |
|
return (_rep->errorString); |
|
} |
|
|
|
Uint32 SSLCertificateInfo::getResponseCode() const |
|
{ |
|
return (_rep->respCode); |
|
} |
|
|
|
void SSLCertificateInfo::setResponseCode(const int respCode) |
|
{ |
|
_rep->respCode = respCode; |
|
} |
|
|
|
String SSLCertificateInfo::toString() const |
|
{ |
|
char buf[1024]; |
|
|
|
String s; |
|
|
|
s.append("Subject Name:\n\t"); |
|
s.append(_rep->subjectName); |
|
s.append("\n"); |
|
|
|
s.append("Issuer Name:\n\t"); |
|
s.append(_rep->issuerName); |
|
s.append("\n"); |
|
|
|
sprintf(buf, "Depth: %d\n", _rep->depth); |
|
s.append(buf); |
|
|
|
sprintf(buf, "Error code: %d\n", _rep->errorCode); |
|
s.append(buf); |
|
|
|
sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode); |
|
s.append(buf); |
|
|
|
s.append("Error string: "); |
|
s.append(_rep->errorString); |
|
s.append("\n"); |
|
|
|
sprintf(buf, "Version number: %d\n", _rep->versionNumber); |
|
s.append(buf); |
|
|
|
sprintf(buf, "Serial number: %ld\n", _rep->serialNumber); |
|
s.append(buf); |
|
|
|
s.append("Not before date: "); |
|
s.append((_rep->notBefore).toString()); |
|
s.append("\n"); |
|
|
|
s.append("Not after date: "); |
|
s.append((_rep->notAfter).toString()); |
|
s.append("\n"); |
|
|
|
return s; |
|
} |
|
|
|
SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert, X509_STORE* crlStore) |
|
{ |
|
verifyCertificateCallback = verifyCert; |
|
_crlStore = crlStore; |
|
_peerCertificate = NULL; |
|
} |
|
|
|
SSLCallbackInfo::~SSLCallbackInfo() |
|
{ |
|
if (_peerCertificate) |
|
{ |
|
delete _peerCertificate; |
|
} |
} | } |
| |
PEGASUS_NAMESPACE_END | PEGASUS_NAMESPACE_END |