version 1.48, 2005/03/08 23:19:31
|
version 1.118, 2013/08/07 07:05:27
|
|
|
//%2005//////////////////////////////////////////////////////////////////////// |
//%LICENSE//////////////////////////////////////////////////////////////// |
// | // |
// Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development |
// Licensed to The Open Group (TOG) under one or more contributor license |
// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems. |
// agreements. Refer to the OpenPegasusNOTICE.txt file distributed with |
// Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L.P.; |
// this work for additional information regarding copyright ownership. |
// IBM Corp.; EMC Corporation, The Open Group. |
// Each contributor licenses this file to you under the OpenPegasus Open |
// Copyright (c) 2004 BMC Software; Hewlett-Packard Development Company, L.P.; |
// Source License; you may not use this file except in compliance with the |
// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group. |
// License. |
// Copyright (c) 2005 Hewlett-Packard Development Company, L.P.; IBM Corp.; |
// |
// EMC Corporation; VERITAS Software Corporation; The Open Group. |
// Permission is hereby granted, free of charge, to any person obtaining a |
// |
// copy of this software and associated documentation files (the "Software"), |
// Permission is hereby granted, free of charge, to any person obtaining a copy |
// to deal in the Software without restriction, including without limitation |
// of this software and associated documentation files (the "Software"), to |
// the rights to use, copy, modify, merge, publish, distribute, sublicense, |
// deal in the Software without restriction, including without limitation the |
// and/or sell copies of the Software, and to permit persons to whom the |
// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or |
// Software is furnished to do so, subject to the following conditions: |
// sell copies of the Software, and to permit persons to whom the Software is |
// |
// furnished to do so, subject to the following conditions: |
// The above copyright notice and this permission notice shall be included |
// |
// in all copies or substantial portions of the Software. |
// THE ABOVE COPYRIGHT NOTICE AND THIS PERMISSION NOTICE SHALL BE INCLUDED IN |
// |
// ALL COPIES OR SUBSTANTIAL PORTIONS OF THE SOFTWARE. THE SOFTWARE IS PROVIDED |
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS |
// "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT |
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
// LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR |
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. |
// PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT |
// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY |
// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN |
// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, |
// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION |
// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE |
// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
// |
// |
//============================================================================== |
////////////////////////////////////////////////////////////////////////// |
// |
|
// Author: Markus Mueller (sedgewick_de@yahoo.de) |
|
// |
|
// Modified By: Nag Boranna, Hewlett-Packard Company (nagaraja_boranna@hp.com) |
|
// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com) |
|
// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com) |
|
// Heather Sterling, IBM (hsterl@us.ibm.com) |
|
// Amit K Arora, IBM (amita@in.ibm.com) for Bug#1090 |
|
// | // |
//%///////////////////////////////////////////////////////////////////////////// | //%///////////////////////////////////////////////////////////////////////////// |
| |
#ifdef PEGASUS_HAS_SSL | #ifdef PEGASUS_HAS_SSL |
|
# include <Pegasus/Common/Config.h> |
#ifdef PEGASUS_PLATFORM_WIN32_IX86_MSVC |
# include <Pegasus/Common/Executor.h> |
//Bugzilla 2366 |
# include <Pegasus/Common/Network.h> |
//Use the X509_NAME in wincrypt.h on Windows. See X509.h for more info. |
|
#include <windows.h> |
|
#include <wincrypt.h> |
|
#endif |
|
|
|
#define OPENSSL_NO_KRB5 1 | #define OPENSSL_NO_KRB5 1 |
#include <openssl/err.h> | #include <openssl/err.h> |
#include <openssl/ssl.h> | #include <openssl/ssl.h> |
#include <openssl/rand.h> | #include <openssl/rand.h> |
|
# include <openssl/tls1.h> |
#else | #else |
#define SSL_CTX void | #define SSL_CTX void |
#endif // end of PEGASUS_HAS_SSL | #endif // end of PEGASUS_HAS_SSL |
#include <Pegasus/Common/Destroyer.h> |
|
|
#include <time.h> |
#include <Pegasus/Common/Socket.h> | #include <Pegasus/Common/Socket.h> |
#include <Pegasus/Common/Tracer.h> | #include <Pegasus/Common/Tracer.h> |
#include <Pegasus/Common/FileSystem.h> | #include <Pegasus/Common/FileSystem.h> |
#include <time.h> |
#include <Pegasus/Common/MessageLoader.h> |
#include <Pegasus/Common/MessageLoader.h> //l10n |
|
#include <Pegasus/Common/Formatter.h> |
|
| |
#include "SSLContext.h" | #include "SSLContext.h" |
#include "SSLContextRep.h" | #include "SSLContextRep.h" |
| |
|
#ifdef PEGASUS_OS_PASE |
// |
# include <ILEWrapper/ILEUtilities.h> |
// Typedef's for OpenSSL callback functions. |
#endif |
// |
|
extern "C" |
|
{ |
|
typedef void (* CRYPTO_SET_LOCKING_CALLBACK)(int, int, const char *, int); |
|
typedef unsigned long (* CRYPTO_SET_ID_CALLBACK)(void); |
|
}; |
|
| |
typedef struct x509_store_ctx_st X509_STORE_CTX; | typedef struct x509_store_ctx_st X509_STORE_CTX; |
| |
typedef struct Timestamp |
|
{ |
|
char year[4]; |
|
char month[2]; |
|
char day[2]; |
|
char hour[2]; |
|
char minutes[2]; |
|
char seconds[2]; |
|
char dot; |
|
char microSeconds[6]; |
|
char plusOrMinus; |
|
char utcOffset[3]; |
|
char padding[3]; |
|
} Timestamp_t; |
|
|
|
PEGASUS_USING_STD; | PEGASUS_USING_STD; |
| |
PEGASUS_NAMESPACE_BEGIN | PEGASUS_NAMESPACE_BEGIN |
| |
const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0; | const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0; |
| |
|
class SSLCertificateInfoRep |
|
{ |
|
public: |
|
String subjectName; |
|
String issuerName; |
|
Uint32 depth; |
|
Uint32 errorCode; |
|
Uint32 respCode; |
|
String errorString; |
|
Uint32 versionNumber; |
|
long serialNumber; |
|
CIMDateTime notBefore; |
|
CIMDateTime notAfter; |
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
String peerCertificate; |
|
#endif |
|
}; |
|
|
// | // |
// use the following definitions only if SSL is available | // use the following definitions only if SSL is available |
// | // |
#ifdef PEGASUS_HAS_SSL | #ifdef PEGASUS_HAS_SSL |
| |
// Mutex for SSL locks. |
AutoArrayPtr<Mutex> SSLEnvironmentInitializer::_sslLocks; |
Mutex* SSLContextRep::_sslLocks = 0; |
int SSLEnvironmentInitializer::_instanceCount = 0; |
|
Mutex SSLEnvironmentInitializer::_instanceCountMutex; |
// Mutex for _countRep. |
|
Mutex SSLContextRep::_countRepMutex; |
|
|
|
// Initialise _count for SSLContextRep objects. |
|
int SSLContextRep::_countRep = 0; |
|
| |
| |
// | // |
|
|
{ | { |
struct tm time; | struct tm time; |
int offset; | int offset; |
Timestamp_t timeStamp; |
|
char tempString[80]; |
|
char plusOrMinus = '+'; | char plusOrMinus = '+'; |
unsigned char* utcTimeData = utcTime->data; | unsigned char* utcTimeData = utcTime->data; |
| |
|
|
} | } |
#undef g2 | #undef g2 |
| |
memset((void *)&timeStamp, 0, sizeof(Timestamp_t)); |
|
| |
// Format the date. |
if (plusOrMinus == '-') |
sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d", |
{ |
|
offset = -offset; |
|
} |
|
|
|
CIMDateTime dateTime = CIMDateTime( |
time.tm_year, | time.tm_year, |
time.tm_mon + 1, | time.tm_mon + 1, |
time.tm_mday, | time.tm_mday, |
|
|
time.tm_min, | time.tm_min, |
time.tm_sec, | time.tm_sec, |
0, | 0, |
|
6, |
offset); | offset); |
| |
timeStamp.plusOrMinus = plusOrMinus; |
return dateTime; |
|
|
CIMDateTime dateTime; |
|
|
|
dateTime.clear(); |
|
strcpy(tempString, (char *)&timeStamp); |
|
dateTime.set(tempString); |
|
|
|
return (dateTime); |
|
} | } |
| |
// | // |
|
|
{ | { |
| |
public: | public: |
static int verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx); |
static int verificationCallback( |
static int verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore); |
int preVerifyOk, |
|
X509_STORE_CTX* ctx); |
|
static int verificationCRLCallback( |
|
int ok, |
|
X509_STORE_CTX* ctx, |
|
X509_STORE* sslCRLStore); |
}; | }; |
| |
// | // |
|
|
// | // |
// return 1 if revoked, 0 otherwise | // return 1 if revoked, 0 otherwise |
// | // |
int SSLCallback::verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore) |
int SSLCallback::verificationCRLCallback( |
|
int, |
|
X509_STORE_CTX* ctx, |
|
X509_STORE* sslCRLStore) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::verificationCRLCallback"); | PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::verificationCRLCallback"); |
| |
|
|
//check whether a CRL store was specified | //check whether a CRL store was specified |
if (sslCRLStore == NULL) | if (sslCRLStore == NULL) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: CRL store is NULL"); |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: CRL store is NULL"); |
|
PEG_METHOD_EXIT(); |
return 0; | return 0; |
} | } |
| |
|
|
//log certificate information | //log certificate information |
//this is information in the "public" key, so it does no harm to log it | //this is information in the "public" key, so it does no harm to log it |
X509_NAME_oneline(issuerName, buf, sizeof(buf)); | X509_NAME_oneline(issuerName, buf, sizeof(buf)); |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Certificate Data: Issuer/Subject"); |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, buf); |
"---> SSL: Certificate Data: Issuer/Subject"); |
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, buf); |
X509_NAME_oneline(subjectName, buf, sizeof(buf)); | X509_NAME_oneline(subjectName, buf, sizeof(buf)); |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, buf); |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, buf); |
| |
//initialize the CRL store | //initialize the CRL store |
X509_STORE_CTX crlStoreCtx; | X509_STORE_CTX crlStoreCtx; |
X509_STORE_CTX_init(&crlStoreCtx, sslCRLStore, NULL, NULL); | X509_STORE_CTX_init(&crlStoreCtx, sslCRLStore, NULL, NULL); |
| |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Initialized CRL store"); |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
|
"---> SSL: Initialized CRL store"); |
| |
//attempt to get a CRL issued by the certificate's issuer | //attempt to get a CRL issued by the certificate's issuer |
X509_OBJECT obj; | X509_OBJECT obj; |
if (X509_STORE_get_by_subject(&crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0) |
if (X509_STORE_get_by_subject( |
|
&crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: No CRL by that issuer"); |
X509_STORE_CTX_cleanup(&crlStoreCtx); |
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: No CRL by that issuer"); |
|
PEG_METHOD_EXIT(); |
return 0; | return 0; |
} | } |
X509_STORE_CTX_cleanup(&crlStoreCtx); | X509_STORE_CTX_cleanup(&crlStoreCtx); |
|
|
X509_CRL* crl = obj.data.crl; | X509_CRL* crl = obj.data.crl; |
if (crl == NULL) | if (crl == NULL) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL is null"); |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL is null"); |
|
PEG_METHOD_EXIT(); |
return 0; | return 0; |
} else |
} |
|
else |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Found CRL by that issuer"); |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
|
"---> SSL: Found CRL by that issuer"); |
} | } |
| |
//get revoked certificates | //get revoked certificates |
STACK_OF(X509_REVOKED)* revokedCerts = NULL; | STACK_OF(X509_REVOKED)* revokedCerts = NULL; |
revokedCerts = X509_CRL_get_REVOKED(crl); | revokedCerts = X509_CRL_get_REVOKED(crl); |
int numRevoked = sk_X509_REVOKED_num(revokedCerts); | int numRevoked = sk_X509_REVOKED_num(revokedCerts); |
Tracer::trace(TRC_SSL, Tracer::LEVEL4,"---> SSL: Number of certificates revoked by the issuer %d\n", numRevoked); |
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
|
"---> SSL: Number of certificates revoked by the issuer %d\n", |
|
numRevoked)); |
| |
//check whether the subject's certificate is revoked | //check whether the subject's certificate is revoked |
X509_REVOKED* revokedCert = NULL; | X509_REVOKED* revokedCert = NULL; |
for (int i = 0; i < sk_X509_REVOKED_num(revokedCerts); i++) |
for (int i = 0; i < numRevoked; i++) |
{ | { |
revokedCert = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i); |
revokedCert = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i); |
|
|
//a matching serial number indicates revocation | //a matching serial number indicates revocation |
if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0) | if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, "---> SSL: Certificate is revoked"); |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Certificate is revoked"); |
X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED); | X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED); |
|
X509_CRL_free(crl); |
|
PEG_METHOD_EXIT(); |
return 1; | return 1; |
} | } |
} | } |
| |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Certificate is not revoked at this level"); |
X509_CRL_free(crl); |
|
|
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
|
"---> SSL: Certificate is not revoked at this level"); |
| |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return 0; | return 0; |
|
|
// Callback function that is called by the OpenSSL library. This function | // Callback function that is called by the OpenSSL library. This function |
// extracts X509 certficate information and pass that on to client application | // extracts X509 certficate information and pass that on to client application |
// callback function. | // callback function. |
// We HAVE to build the certificate in all cases since it's needed to get the associated username out of the repository |
// We HAVE to build the certificate in all cases since it's needed to get |
// later in the transaction |
// the associated username out of the repository later in the transaction. |
// | // |
int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx) | int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()"); |
|
|
char buf[256]; | char buf[256]; |
X509 *currentCert; | X509 *currentCert; |
SSL *ssl; | SSL *ssl; |
int verifyError = X509_V_OK; |
|
int revoked = -1; | int revoked = -1; |
| |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
"--->SSL: Preverify Error %d", verifyError); |
"--->SSL: Preverify result %d", preVerifyOk)); |
| |
// | // |
// get the verification callback info specific to each SSL connection | // get the verification callback info specific to each SSL connection |
// | // |
ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); |
ssl = (SSL*) X509_STORE_CTX_get_ex_data( |
SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX); |
ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); |
|
SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data( |
// |
ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX); |
// If the SSLContext does not have an additional callback |
|
// simply return the preverification error (or check the CRL) |
|
// We do not need to go through the additional steps. |
|
// |
|
if (exData->verifyCertificateCallback == NULL) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"--->SSL: No verification callback specified"); |
|
|
|
if (exData->_crlStore != NULL) |
|
{ |
|
revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_crlStore); |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL callback returned %d", revoked); |
|
|
|
if (revoked) //with the SSL callbacks '0' indicates failure |
|
{ |
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
} |
|
} |
|
| |
|
#ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
// | // |
// Check to see if a CRL path is defined | // Check to see if a CRL path is defined |
// | // |
if (exData->_crlStore != NULL) |
if (exData->_rep->crlStore != NULL) |
{ | { |
revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_crlStore); |
revoked = verificationCRLCallback( |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL callback returned %d", revoked); |
preVerifyOk,ctx,exData->_rep->crlStore); |
|
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
|
"---> SSL: CRL callback returned %d", revoked)); |
| |
if (revoked) //with the SSL callbacks '0' indicates failure | if (revoked) //with the SSL callbacks '0' indicates failure |
{ | { |
|
|
} | } |
} | } |
| |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL callback returned %d", revoked); |
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
|
"---> SSL: CRL callback returned %d", revoked)); |
|
#endif |
| |
// | // |
// get the current certificate | // get the current certificate |
|
|
// | // |
if (!preVerifyOk) | if (!preVerifyOk) |
{ | { |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL2, |
"---> SSL: certificate default verification error: %s", (const char*)errorStr.getCString()); |
"---> SSL: certificate default verification error: %s", |
|
(const char*)errorStr.getCString())); |
} | } |
| |
// | // |
// get the issuer name on the certificate | // get the issuer name on the certificate |
// | // |
if (!preVerifyOk && (errorCode == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)) |
|
{ |
|
X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, 256); |
|
} |
|
else |
|
{ |
|
X509_NAME_oneline(X509_get_issuer_name(currentCert), buf, 256); | X509_NAME_oneline(X509_get_issuer_name(currentCert), buf, 256); |
} |
|
String issuerName = String(buf); | String issuerName = String(buf); |
| |
// | // |
// Create the certificate object | // Create the certificate object |
// | // |
exData->_peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber, |
|
notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk); |
|
| |
// |
// insert at the beginning of the array so that the peer certificate is |
// Call the application callback. |
// first and the root CA is last |
// Note that the verification result does not automatically get set to X509_V_OK if the callback is successful. |
SSLCertificateInfo *certInfo = new SSLCertificateInfo( |
// This is because OpenSSL retains the original default error in case we want to use it later. |
subjectName, |
// To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here. |
issuerName, |
// |
version, |
if (exData->verifyCertificateCallback(*exData->_peerCertificate)) |
serialNumber, |
{ |
notBefore, |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
notAfter, |
"--> SSL: verifyCertificateCallback() returned X509_V_OK"); |
depth, |
|
errorCode, |
|
errorStr, |
|
preVerifyOk); |
|
|
|
String peerCertificate; |
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
// |
|
// Get Base64 encoded DER (PEM) certificate |
|
// |
|
char *data = 0; |
|
long length = 0; |
| |
PEG_METHOD_EXIT(); |
BIO *bio = BIO_new(BIO_s_mem()); |
return 1; |
if (bio) |
|
{ |
|
if (PEM_write_bio_X509(bio, currentCert) == 0) |
|
{ |
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1, |
|
"PEM converion failed."); |
} | } |
else // verification failed, handshake will be immediately terminated |
else |
{ | { |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
length = BIO_get_mem_data(bio, &data); |
"--> SSL: verifyCertificateCallback() returned error %d", exData->_peerCertificate->getErrorCode()); |
peerCertificate.assign(data, (Uint32)length); |
|
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} | } |
|
BIO_free_all(bio); |
} | } |
|
certInfo->_rep->peerCertificate = peerCertificate; |
|
#endif |
| |
// |
exData->_rep->peerCertificate.insert(0, certInfo); |
// Callback function called by OpenSSL. This request is merely forwarded to the static |
|
// function SSLCallback::callback(). The SSLCallback class is a friend class of the |
|
// Pegasus SSL related classes needed to complete the callback. |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, "Created SSLCertificateInfo"); |
// |
|
extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
// NOT_YET_VALID checks do not work correctly on subsequent tries -- |
|
// Bugzilla#4283 |
|
// call this prior to calling the user-specified callback in case they |
|
// want to override it |
|
if (errorCode == X509_V_OK && |
|
(CIMDateTime::getDifference( |
|
CIMDateTime::getCurrentDateTime(), notBefore) > 0)) |
{ | { |
return SSLCallback::verificationCallback(preVerifyOk, ctx); |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2, |
|
"Certificate was not yet valid."); |
|
|
|
X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_NOT_YET_VALID); |
} | } |
| |
// | // |
// Implement OpenSSL locking callback. |
// Call the user-specified application callback if it is specified. |
|
// If it is null, return OpenSSL's verification code. |
|
// Note that the verification result does not automatically get set |
|
// to X509_V_OK if the callback is successful. |
|
// This is because OpenSSL retains the original default error in case |
|
// we want to use it later. |
|
// To set the error, we could use X509_STORE_CTX_set_error(ctx, |
|
// X509_V_OK); but there is no real benefit to doing that here. |
// | // |
void pegasus_locking_callback( int mode, |
if (exData->_rep->verifyCertificateCallback == NULL) |
int type, |
|
const char* file, |
|
int line) |
|
{ |
|
// Check whether the mode is lock or unlock. |
|
|
|
if ( mode & CRYPTO_LOCK ) |
|
{ | { |
/*Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
PEG_METHOD_EXIT(); |
"Now locking for %d", pegasus_thread_self());*/ |
return preVerifyOk; |
SSLContextRep::_sslLocks[type].lock( pegasus_thread_self() ); |
|
} | } |
else | else |
{ | { |
/*Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
if (exData->_rep->verifyCertificateCallback( |
"Now unlocking for %d", pegasus_thread_self());*/ |
*exData->_rep->peerCertificate[0])) |
SSLContextRep::_sslLocks[type].unlock( ); |
{ |
} |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
|
"--> SSL: _rep->verifyCertificateCallback() returned " |
|
"X509_V_OK"); |
|
PEG_METHOD_EXIT(); |
|
return 1; |
} | } |
|
else // verification failed, handshake will be immediately terminated |
// |
|
// Initialize OpenSSL Locking and id callbacks. |
|
// |
|
void SSLContextRep::init_ssl() |
|
{ | { |
// Allocate Memory for _sslLocks. SSL locks needs to be able to handle |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
// up to CRYPTO_num_locks() different mutex locks. |
"--> SSL: _rep->verifyCertificateCallback() returned error %d", |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
exData->_rep->peerCertificate[0]->getErrorCode())); |
"Initialized SSL callback."); |
|
|
|
_sslLocks= new Mutex[CRYPTO_num_locks()]; |
|
|
|
// Set the ID callback. The ID callback returns a thread ID. |
|
|
|
CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK) pegasus_thread_self); |
|
|
|
// Set the locking callback to pegasus_locking_callback. |
|
|
|
CRYPTO_set_locking_callback((CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback); |
|
| |
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
} |
} | } |
| |
// Free OpenSSL Locking and id callbacks. |
// |
void SSLContextRep::free_ssl() |
// Callback function called by OpenSSL. This request is merely forwarded |
|
// to the static function SSLCallback::callback(). The SSLCallback class |
|
// is a friend class of the Pegasus SSL related classes needed to complete |
|
// the callback. |
|
// |
|
extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
{ | { |
// Cleanup _sslLocks and set locking & id callback to NULL. |
return SSLCallback::verificationCallback(preVerifyOk, ctx); |
|
|
CRYPTO_set_locking_callback(NULL); |
|
CRYPTO_set_id_callback (NULL); |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
|
"Freed SSL callback."); |
|
|
|
delete []_sslLocks; |
|
} | } |
| |
|
|
// | // |
// SSL context area | // SSL context area |
// | // |
|
|
const String& keyPath, | const String& keyPath, |
const String& crlPath, | const String& crlPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) |
const String& randomFile, |
|
const String& cipherSuite, |
|
const Boolean& sslCompatibility) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
| |
_trustStore = trustStore; | _trustStore = trustStore; |
|
|
_certPath = certPath; | _certPath = certPath; |
|
|
_keyPath = keyPath; | _keyPath = keyPath; |
|
|
_crlPath = crlPath; | _crlPath = crlPath; |
|
|
_crlStore = NULL; |
|
|
|
_certificateVerifyFunction = verifyCert; | _certificateVerifyFunction = verifyCert; |
|
_cipherSuite = cipherSuite; |
|
_sslCompatibility = sslCompatibility; |
// | // |
// If a truststore and/or peer verification function is specified, enable peer verification |
// If a truststore and/or peer verification function is specified, |
|
// enable peer verification |
// | // |
if (trustStore != String::EMPTY || verifyCert != NULL) |
_verifyPeer = (trustStore != String::EMPTY || verifyCert != NULL); |
{ |
|
_verifyPeer = true; |
|
} |
|
else |
|
{ |
|
_verifyPeer = false; |
|
} |
|
|
|
// |
|
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
|
// |
|
{ |
|
AutoMutex autoMut(_countRepMutex); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Value of Countrep in constructor %d", _countRep); |
|
if ( _countRep == 0 ) |
|
{ |
|
init_ssl(); |
|
|
|
// |
|
// load SSL library |
|
// |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Before calling SSL_load_error_strings %d", pegasus_thread_self()); |
|
|
|
SSL_load_error_strings(); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"After calling SSL_load_error_strings %d", pegasus_thread_self()); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Before calling SSL_library_init %d", pegasus_thread_self()); |
|
|
|
SSL_library_init(); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"After calling SSL_library_init %d", pegasus_thread_self()); |
|
|
|
} |
|
|
|
_countRep++; |
|
} // mutex unlocks here |
|
| |
_randomInit(randomFile); | _randomInit(randomFile); |
| |
|
|
_certPath = sslContextRep._certPath; | _certPath = sslContextRep._certPath; |
_keyPath = sslContextRep._keyPath; | _keyPath = sslContextRep._keyPath; |
_crlPath = sslContextRep._crlPath; | _crlPath = sslContextRep._crlPath; |
_crlStore = sslContextRep._crlStore; |
|
_verifyPeer = sslContextRep._verifyPeer; | _verifyPeer = sslContextRep._verifyPeer; |
_certificateVerifyFunction = sslContextRep._certificateVerifyFunction; | _certificateVerifyFunction = sslContextRep._certificateVerifyFunction; |
_randomFile = sslContextRep._randomFile; | _randomFile = sslContextRep._randomFile; |
|
_cipherSuite = sslContextRep._cipherSuite; |
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
_sslCompatibility = sslContextRep._sslCompatibility; |
{ |
|
AutoMutex autoMut(_countRepMutex); |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Value of Countrep in copy constructor %d", _countRep); |
|
if ( _countRep == 0 ) |
|
{ |
|
init_ssl(); |
|
} |
|
|
|
_countRep++; |
|
} // mutex unlocks here |
|
|
|
_sslContext = _makeSSLContext(); | _sslContext = _makeSSLContext(); |
|
|
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
} | } |
| |
|
|
| |
SSL_CTX_free(_sslContext); | SSL_CTX_free(_sslContext); |
| |
// Decrement the SSLContextRep object _counter. |
|
{ |
|
AutoMutex autoMut(_countRepMutex); |
|
_countRep--; |
|
// Free SSL locks if no instances of SSLContextRep exist. |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Value of Countrep in destructor %d", _countRep); |
|
if ( _countRep == 0 ) |
|
{ |
|
free_ssl(); |
|
} |
|
|
|
} |
|
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
} | } |
| |
|
|
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_randomInit()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_randomInit()"); |
| |
Boolean ret; |
|
int retVal = 0; |
|
| |
#ifdef PEGASUS_SSL_RANDOMFILE |
#if defined(PEGASUS_SSL_RANDOMFILE) && !defined(PEGASUS_OS_PASE) |
if ( RAND_status() == 0 ) | if ( RAND_status() == 0 ) |
{ | { |
// | // |
|
|
// | // |
if ( randomFile == String::EMPTY ) | if ( randomFile == String::EMPTY ) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1, |
"Random seed file is required."); | "Random seed file is required."); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
//l10n |
MessageLoaderParms parms( |
//throw( SSLException("Random seed file required")); |
"Common.SSLContext.RANDOM_SEED_FILE_REQUIRED", |
MessageLoaderParms parms("Common.SSLContext.RANDOM_SEED_FILE_REQUIRED", |
|
"Random seed file required"); | "Random seed file required"); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
|
|
// | // |
// Try the given random seed file | // Try the given random seed file |
// | // |
ret = FileSystem::exists(randomFile); |
Boolean ret = FileSystem::exists(randomFile); |
if( ret ) | if( ret ) |
{ | { |
retVal = RAND_load_file(randomFile.getCString(), -1); |
int retVal = RAND_load_file(randomFile.getCString(), -1); |
if ( retVal < 0 ) | if ( retVal < 0 ) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"Not enough seed data in seed file: " + randomFile); |
"Not enough seed data in seed file: %s", |
PEG_METHOD_EXIT(); |
(const char*)randomFile.getCString())); |
//l10n |
PEG_METHOD_EXIT(); |
// do not put in $0 in default message, but pass in filename for bundle message |
// do not put in $0 in default message, but pass in filename |
//throw( SSLException("Not enough seed data in random seed file.")); |
// for bundle message |
MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE", |
MessageLoaderParms parms( |
|
"Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE", |
"Not enough seed data in random seed file.", | "Not enough seed data in random seed file.", |
randomFile); | randomFile); |
throw SSLException(parms); | throw SSLException(parms); |
|
|
} | } |
else | else |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"seed file - " + randomFile + " does not exist."); |
"Seed file \'%s\' does not exist.", |
|
(const char*)randomFile.getCString())); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
//l10n |
MessageLoaderParms parms( |
//throw( SSLException("Seed file '" + randomFile + "' does not exist.")); |
"Common.SSLContext.SEED_FILE_DOES_NOT_EXIST", |
MessageLoaderParms parms("Common.SSLContext.SEED_FILE_DOES_NOT_EXIST", |
|
"Seed file '$0' does not exist.", | "Seed file '$0' does not exist.", |
randomFile); | randomFile); |
throw SSLException(parms); | throw SSLException(parms); |
|
|
// Try to do more seeding | // Try to do more seeding |
// | // |
long seedNumber; | long seedNumber; |
#if defined(PEGASUS_PLATFORM_WIN32_IX86_MSVC) |
# if defined(PEGASUS_COMPILER_MSVC) |
srand((unsigned int)time(NULL)); // Initialize | srand((unsigned int)time(NULL)); // Initialize |
seedNumber = rand(); | seedNumber = rand(); |
#else | #else |
|
|
int seedRet = RAND_status(); | int seedRet = RAND_status(); |
if ( seedRet == 0 ) | if ( seedRet == 0 ) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"Not enough seed data in random seed file, RAND_status = " + |
"Not enough seed data in random seed file, " |
seedRet); |
"RAND_status = %d", |
PEG_METHOD_EXIT(); |
seedRet)); |
//l10n 485 |
PEG_METHOD_EXIT(); |
// do not put in $0 in default message, but pass in filename for bundle message |
// do not put in $0 in default message, but pass in filename |
//throw( SSLException("Not enough seed data in random seed file.")); |
// for bundle message |
MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE", |
MessageLoaderParms parms( |
|
"Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE", |
"Not enough seed data in random seed file.", | "Not enough seed data in random seed file.", |
randomFile); | randomFile); |
throw SSLException(parms); | throw SSLException(parms); |
|
|
} | } |
#endif /* PEGASUS_SSL_RANDOMFILE */ | #endif /* PEGASUS_SSL_RANDOMFILE */ |
| |
|
#ifdef PEGASUS_OS_PASE |
|
if (RAND_status() == 0) |
|
{ |
|
// generate random number for pase must use specify function |
|
unsigned char prn[1024]; |
|
umeGenerateRandomNumber(prn, sizeof(prn)); |
|
RAND_seed(prn, 1024); |
|
} |
|
#endif |
|
|
int seedRet = RAND_status(); | int seedRet = RAND_status(); |
if ( seedRet == 0 ) | if ( seedRet == 0 ) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"Not enough seed data , RAND_status = " + seedRet ); |
"Not enough seed data, RAND_status = %d", |
|
seedRet)); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
//l10n |
MessageLoaderParms parms( |
//throw( SSLException("Not enough seed data.")); |
"Common.SSLContext.NOT_ENOUGH_SEED_DATA", |
MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA", |
|
"Not enough seed data."); | "Not enough seed data."); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
|
|
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_makeSSLContext()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_makeSSLContext()"); |
| |
SSL_CTX * sslContext = 0; | SSL_CTX * sslContext = 0; |
|
const SSL_METHOD *sslProtocolMethod = SSLv23_method() ; |
|
int options = SSL_OP_ALL; |
|
|
| |
// | // |
// create SSL Context Area | // create SSL Context Area |
// | // |
| |
if (!( sslContext = SSL_CTX_new(SSLv23_method()) )) |
if ( _sslCompatibility == false ) |
|
{ |
|
|
|
#ifdef TLS1_2_VERSION |
|
// Enable only TLSv1.2 and disable all other protocol (SSL v2, SSL v3, |
|
// TLS v1.0, TLSv1.1) |
|
sslProtocolMethod = TLSv1_2_method(); |
|
options = SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1; |
|
#ifndef OPENSSL_NO_SSL3 |
|
options |= SSL_OP_NO_SSLv3; |
|
#endif |
|
#endif |
|
} |
|
|
|
if (!(sslContext = SSL_CTX_new(sslProtocolMethod))) |
{ | { |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
//l10n |
MessageLoaderParms parms( |
//throw( SSLException("Could not get SSL CTX")); |
"Common.SSLContext.COULD_NOT_GET", |
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET", |
|
"Could not get SSL CTX"); | "Could not get SSL CTX"); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
| |
#ifdef PEGASUS_SSL_WEAKENCRYPTION | #ifdef PEGASUS_SSL_WEAKENCRYPTION |
if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40))){ |
if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40))) |
//l10n |
{ |
//throw( SSLException("Could not set the cipher list")); |
SSL_CTX_free(sslContext); |
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_SET_CIPHER_LIST", |
|
|
MessageLoaderParms parms( |
|
"Common.SSLContext.COULD_NOT_SET_CIPHER_LIST", |
"Could not set the cipher list"); | "Could not set the cipher list"); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
#endif | #endif |
| |
|
if (_cipherSuite != String::EMPTY) |
|
{ |
|
if (!(SSL_CTX_set_cipher_list(sslContext, _cipherSuite.getCString()))) |
|
{ |
|
SSL_CTX_free(sslContext); |
|
|
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Cipher Suite could not be specified"); |
|
MessageLoaderParms parms( |
|
"Common.SSLContext.COULD_NOT_SET_CIPHER_LIST", |
|
"Could not set the cipher list"); |
|
throw SSLException(parms); |
|
} |
|
else |
|
{ |
|
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Cipher suite set to %s", |
|
(const char *)_cipherSuite.getCString())); |
|
} |
|
} |
|
|
// | // |
// set overall SSL Context flags | // set overall SSL Context flags |
// | // |
|
// For OpenSSLversion >1.0.0 use SSL_OP_NO_COMPRESSION to disable the |
|
// compression For TLS 1.2 version, compression does not suffer from |
|
// CRIME attack so don.t disable compression For other OpenSSL versions |
|
// zero out the compression methods. |
|
#ifdef SSL_OP_NO_COMPRESSION |
|
#ifndef TLS1_2_VERSION |
|
SSL_CTX_set_options(sslContext, SSL_OP_NO_COMPRESSION); |
|
#endif |
|
#elif OPENSSL_VERSION_NUMBER >= 0x00908000L |
|
sk_SSL_COMP_zero(SSL_COMP_get_compression_methods()); |
|
#endif |
SSL_CTX_set_quiet_shutdown(sslContext, 1); | SSL_CTX_set_quiet_shutdown(sslContext, 1); |
SSL_CTX_set_mode(sslContext, SSL_MODE_AUTO_RETRY); | SSL_CTX_set_mode(sslContext, SSL_MODE_AUTO_RETRY); |
SSL_CTX_set_options(sslContext,SSL_OP_ALL); |
SSL_CTX_set_mode(sslContext, SSL_MODE_ENABLE_PARTIAL_WRITE); |
SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF); | SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF); |
| |
|
#ifdef SSL_MODE_RELEASE_BUFFERS |
|
// Keep memory usage as low as possible |
|
SSL_CTX_set_mode (sslContext, SSL_MODE_RELEASE_BUFFERS); |
|
#endif |
|
|
|
#ifndef PEGASUS_ENABLE_SSLV2 //SSLv2 is disabled by default |
|
options |= SSL_OP_NO_SSLv2; |
|
#endif |
|
SSL_CTX_set_options(sslContext, options); |
|
|
if (_verifyPeer) | if (_verifyPeer) |
{ | { |
//ATTN: We might still need a flag to specify SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
// ATTN: We might still need a flag to specify |
// If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be terminated |
// SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
// if the client sends no certificate or sends an untrusted certificate. The |
// If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be |
// callback function is not called in this case; the handshake is simply terminated. |
// terminated if the client sends no certificate or sends an |
|
// untrusted certificate. The callback function is not called in |
|
// this case; the handshake is simply terminated. |
// This value has NO effect in from a client perspective | // This value has NO effect in from a client perspective |
| |
if (_certificateVerifyFunction != NULL) | if (_certificateVerifyFunction != NULL) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
"---> SSL: certificate verification callback specified"); | "---> SSL: certificate verification callback specified"); |
SSL_CTX_set_verify(sslContext, | SSL_CTX_set_verify(sslContext, |
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback); | SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback); |
} | } |
else | else |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: Trust Store specified"); |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Trust Store specified"); |
SSL_CTX_set_verify(sslContext, | SSL_CTX_set_verify(sslContext, |
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, |
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | |
|
SSL_VERIFY_FAIL_IF_NO_PEER_CERT, |
prepareForCallback); | prepareForCallback); |
} | } |
} | } |
else | else |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
"---> SSL: Trust Store and certificate verification callback are NOT specified"); |
"---> SSL: Trust Store and certificate verification callback " |
|
"are NOT specified"); |
SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL); | SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL); |
} | } |
| |
// | // |
// Check if there is CA certificate file or directory specified. If specified, |
// Check if there is CA certificate file or directory specified. If |
// and is not empty, load the certificates from the Trust store. |
// specified, and is not empty, load the certificates from the Trust store. |
// | // |
if (_trustStore != String::EMPTY) | if (_trustStore != String::EMPTY) |
{ | { |
|
|
// | // |
if (FileSystem::isDirectory(_trustStore)) | if (FileSystem::isDirectory(_trustStore)) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
"---> SSL: Truststore is a directory"); | "---> SSL: Truststore is a directory"); |
// | // |
// load certificates from the trust store | // load certificates from the trust store |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
"---> SSL: Loading certificates from the trust store: " + _trustStore); |
"---> SSL: Loading certificates from the trust store: %s", |
|
(const char*)_trustStore.getCString())); |
| |
if ((!SSL_CTX_load_verify_locations(sslContext, NULL, _trustStore.getCString())) || |
if ((!SSL_CTX_load_verify_locations( |
|
sslContext, NULL, _trustStore.getCString())) || |
(!SSL_CTX_set_default_verify_paths(sslContext))) | (!SSL_CTX_set_default_verify_paths(sslContext))) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"---> SSL: Could not load certificates from the trust store: " + _trustStore); |
"---> SSL: Could not load certificates from the " |
//l10n |
"trust store: %s ",(const char*)_trustStore.getCString())); |
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
MessageLoaderParms parms( |
|
"Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
"Could not load certificates in to trust store."); | "Could not load certificates in to trust store."); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
|
|
} | } |
else if (FileSystem::exists(_trustStore)) | else if (FileSystem::exists(_trustStore)) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
"---> SSL: Truststore is a file"); | "---> SSL: Truststore is a file"); |
// | // |
// Get size of the trust store file: | // Get size of the trust store file: |
|
|
// | // |
// load certificates from the trust store | // load certificates from the trust store |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
"---> SSL: Loading certificates from the trust store: " + _trustStore); |
"---> SSL: Loading certificates from the trust store: %s", |
|
(const char*)_trustStore.getCString())); |
| |
if ((!SSL_CTX_load_verify_locations(sslContext, _trustStore.getCString(), NULL)) || |
if ((!SSL_CTX_load_verify_locations( |
|
sslContext, _trustStore.getCString(), NULL)) || |
(!SSL_CTX_set_default_verify_paths(sslContext))) | (!SSL_CTX_set_default_verify_paths(sslContext))) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"---> SSL: Could not load certificates from the trust store: " + _trustStore); |
"---> SSL: Could not load certificates from the " |
//l10n |
"trust store: %s", |
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
(const char*)_trustStore.getCString())); |
|
MessageLoaderParms parms( |
|
"Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
"Could not load certificates in to trust store."); | "Could not load certificates in to trust store."); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
|
|
// | // |
// no certificates found in the trust store | // no certificates found in the trust store |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL2, |
"---> SSL: No certificates to load from the trust store: " + _trustStore); |
"---> SSL: No certificates to load from the " |
|
"trust store: %s",(const char*)_trustStore.getCString())); |
} | } |
} | } |
} | } |
| |
if (_crlPath != String::EMPTY) | if (_crlPath != String::EMPTY) |
{ | { |
//need to save this -- can we make it static since there's only one CRL for cimserver? |
// need to save this -- can we make it static since there's only |
|
// one CRL for cimserver? |
X509_LOOKUP* pLookup; | X509_LOOKUP* pLookup; |
| |
_crlStore = X509_STORE_new(); |
_crlStore.reset(X509_STORE_new()); |
|
if (_crlStore.get() == NULL) |
|
{ |
|
PEG_METHOD_EXIT(); |
|
throw PEGASUS_STD(bad_alloc)(); |
|
} |
| |
//the validity of the crlstore was checked in ConfigManager during server startup |
// the validity of the crlstore was checked in ConfigManager |
|
// during server startup |
if (FileSystem::isDirectory(_crlPath)) | if (FileSystem::isDirectory(_crlPath)) |
{ | { |
Tracer::trace(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
"---> SSL: CRL store is a directory in %s", (const char*)_crlPath.getCString()); |
"---> SSL: CRL store is a directory in %s", |
|
(const char*)_crlPath.getCString())); |
| |
if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_hash_dir())) == NULL) |
if ((pLookup = X509_STORE_add_lookup( |
|
_crlStore.get(), X509_LOOKUP_hash_dir())) == NULL) |
{ | { |
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS", |
MessageLoaderParms parms( |
|
"Common.SSLContext.COULD_NOT_LOAD_CRLS", |
"Could not load certificate revocation list."); | "Could not load certificate revocation list."); |
X509_STORE_free(_crlStore); |
_crlStore.reset(); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
| |
X509_LOOKUP_add_dir(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM); |
X509_LOOKUP_add_dir( |
|
pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM); |
| |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
"---> SSL: Successfully configured CRL directory"); | "---> SSL: Successfully configured CRL directory"); |
|
} |
} else |
else |
{ | { |
Tracer::trace(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
"---> SSL: CRL store is the file %s", (const char*)_crlPath.getCString()); |
"---> SSL: CRL store is the file %s", |
|
(const char*)_crlPath.getCString())); |
| |
if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_file())) == NULL) |
if ((pLookup = X509_STORE_add_lookup( |
|
_crlStore.get(), X509_LOOKUP_file())) == NULL) |
{ | { |
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS", |
MessageLoaderParms parms( |
|
"Common.SSLContext.COULD_NOT_LOAD_CRLS", |
"Could not load certificate revocation list."); | "Could not load certificate revocation list."); |
X509_STORE_free(_crlStore); |
_crlStore.reset(); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
| |
X509_LOOKUP_load_file(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM); |
X509_LOOKUP_load_file( |
|
pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM); |
| |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
"---> SSL: Successfully configured CRL file"); | "---> SSL: Successfully configured CRL file"); |
} | } |
} | } |
|
|
// | // |
// load the specified server certificates | // load the specified server certificates |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
"---> SSL: Loading server certificate from: " + _certPath); |
"---> SSL: Loading server certificate from: %s", |
|
(const char*)_certPath.getCString())); |
| |
if (SSL_CTX_use_certificate_file(sslContext, | if (SSL_CTX_use_certificate_file(sslContext, |
_certPath.getCString(), SSL_FILETYPE_PEM) <=0) | _certPath.getCString(), SSL_FILETYPE_PEM) <=0) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"---> SSL: No server certificate found in " + _certPath); |
"---> SSL: No server certificate found in %s", |
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE", |
(const char*)_certPath.getCString())); |
"Could not get server certificate."); |
MessageLoaderParms parms( |
|
"Common.SSLContext.COULD_NOT_ACCESS_SERVER_CERTIFICATE", |
|
"Could not access server certificate in $0.", |
|
(const char*)_certPath.getCString()); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
| |
// | // |
// If there is no key file (file containing server | // If there is no key file (file containing server |
// private key) specified, then try loading the key from the certificate file. |
// private key) specified, then try loading the key from the |
// As of 2.4, if a keyfile is specified, its location is verified during server |
// certificate file. |
// startup and will throw an error if the path is invalid. |
// As of 2.4, if a keyfile is specified, its location is verified |
|
// during server startup and will throw an error if the path is invalid. |
// | // |
if (_keyPath == String::EMPTY) | if (_keyPath == String::EMPTY) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
"---> SSL: loading private key from: " + _certPath); |
"---> SSL: Key file empty, loading private key from " |
|
"certificate file: %s",(const char*)_certPath.getCString())); |
// | // |
// load the private key and check for validity | // load the private key and check for validity |
// | // |
if (!_verifyPrivateKey(sslContext, _certPath)) | if (!_verifyPrivateKey(sslContext, _certPath)) |
{ | { |
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", |
MessageLoaderParms parms( |
|
"Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", |
"Could not get private key."); | "Could not get private key."); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
|
|
// | // |
if (_keyPath != String::EMPTY && !keyLoaded) | if (_keyPath != String::EMPTY && !keyLoaded) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
"---> SSL: loading private key from: " + _keyPath); |
"---> SSL: loading private key from: %s", |
|
(const char*)_keyPath.getCString())); |
// | // |
// load given private key and check for validity | // load given private key and check for validity |
// | // |
if (!_verifyPrivateKey(sslContext, _keyPath)) | if (!_verifyPrivateKey(sslContext, _keyPath)) |
{ | { |
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", |
MessageLoaderParms parms( |
|
"Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", |
"Could not get private key."); | "Could not get private key."); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
|
|
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()"); | PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()"); |
| |
if (SSL_CTX_use_PrivateKey_file(ctx, keyPath.getCString(), SSL_FILETYPE_PEM) <= 0) |
// Open the private key file. |
|
|
|
FILE* is = Executor::openFile(keyPath.getCString(), 'r'); |
|
|
|
if (!is) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"---> SSL: no private key found in " + String(keyPath)); |
"---> SSL: failed to open private key file: %s", |
|
(const char*)keyPath.getCString())); |
|
return false; |
|
} |
|
|
|
// Read the private key from the input stream. |
|
|
|
EVP_PKEY* pkey; |
|
pkey = PEM_read_PrivateKey(is, NULL, NULL, NULL); |
|
|
|
if (!pkey) |
|
{ |
|
PEG_TRACE_CSTRING( |
|
TRC_SSL, Tracer::LEVEL1, "---> SSL: failed to create private key"); |
|
return false; |
|
} |
|
|
|
// Close the input stream. |
|
|
|
fclose(is); |
|
|
|
// Associate the new private key with the SSL context object. |
|
|
|
if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) |
|
{ |
|
EVP_PKEY_free(pkey); |
|
PEG_TRACE((TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: no private key found in %s", |
|
(const char*)keyPath.getCString())); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return false; | return false; |
} | } |
| |
|
EVP_PKEY_free(pkey); |
|
|
|
// Check private key for validity. |
|
|
if (!SSL_CTX_check_private_key(ctx)) | if (!SSL_CTX_check_private_key(ctx)) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1, |
"---> SSL: Private and public key do not match"); | "---> SSL: Private and public key do not match"); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return false; | return false; |
|
|
return _keyPath; | return _keyPath; |
} | } |
| |
|
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
|
String SSLContextRep::getTrustStoreUserName() const |
|
{ |
|
return String::EMPTY; |
|
} |
|
#endif |
|
|
|
String SSLContextRep::getCipherSuite() const |
|
{ |
|
return _cipherSuite; |
|
} |
|
|
String SSLContextRep::getCRLPath() const | String SSLContextRep::getCRLPath() const |
{ | { |
return _crlPath; | return _crlPath; |
} | } |
| |
X509_STORE* SSLContextRep::getCRLStore() const |
SharedPtr<X509_STORE, FreeX509STOREPtr> SSLContextRep::getCRLStore() const |
{ | { |
return _crlStore; | return _crlStore; |
} | } |
| |
|
void SSLContextRep::setCRLStore(X509_STORE* store) |
|
{ |
|
_crlStore.reset(store); |
|
} |
|
|
Boolean SSLContextRep::isPeerVerificationEnabled() const | Boolean SSLContextRep::isPeerVerificationEnabled() const |
{ | { |
return _verifyPeer; | return _verifyPeer; |
} | } |
| |
SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const |
SSLCertificateVerifyFunction* |
|
SSLContextRep::getSSLCertificateVerifyFunction() const |
{ | { |
return _certificateVerifyFunction; | return _certificateVerifyFunction; |
} | } |
| |
|
void SSLContextRep::validateCertificate() |
|
{ |
|
BIO* in = BIO_new_file(_certPath.getCString(), "r"); |
|
PEGASUS_ASSERT(in != NULL); |
|
X509* cert = PEM_read_bio_X509(in, NULL, 0, NULL); |
|
BIO_free(in); |
|
PEGASUS_ASSERT(cert != NULL); |
|
|
|
if (X509_cmp_current_time(X509_get_notBefore(cert)) > 0) |
|
{ |
|
X509_free(cert); |
|
MessageLoaderParms parms( |
|
"Common.SSLContext.CERTIFICATE_NOT_YET_VALID", |
|
"Certificate $0 is not yet valid.", |
|
_certPath); |
|
throw SSLException(parms); |
|
} |
|
|
|
if (X509_cmp_current_time(X509_get_notAfter(cert)) < 0) |
|
{ |
|
X509_free(cert); |
|
MessageLoaderParms parms( |
|
"Common.SSLContext.CERTIFICATE_EXPIRED", |
|
"Certificate $0 has expired.", |
|
_certPath); |
|
throw SSLException(parms); |
|
} |
|
|
|
X509_free(cert); |
|
} |
|
|
#else | #else |
| |
// | // |
// these definitions are used if ssl is not available | // these definitions are used if ssl is not available |
// | // |
| |
SSLContextRep::SSLContextRep(const String& trustStore, |
SSLContextRep::SSLContextRep( |
const String& certPath, |
const String&, |
const String& keyPath, |
const String&, |
const String& crlPath, |
const String&, |
SSLCertificateVerifyFunction* verifyCert, |
const String&, |
const String& randomFile) |
SSLCertificateVerifyFunction*, |
{} |
const String&, |
|
const String&, |
|
const Boolean&) |
|
{ |
|
} |
| |
SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {} |
SSLContextRep::SSLContextRep(const SSLContextRep&) {} |
| |
SSLContextRep::~SSLContextRep() {} | SSLContextRep::~SSLContextRep() {} |
| |
SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; } | SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; } |
| |
Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, |
Boolean SSLContextRep::_verifyPrivateKey( |
const String& keyPath) { return false; } |
SSL_CTX*, |
|
const String&) |
|
{ |
|
return false; |
|
} |
| |
SSL_CTX * SSLContextRep::getContext() const { return 0; } | SSL_CTX * SSLContextRep::getContext() const { return 0; } |
| |
|
|
| |
String SSLContextRep::getKeyPath() const { return String::EMPTY; } | String SSLContextRep::getKeyPath() const { return String::EMPTY; } |
| |
|
String SSLContextRep::getCipherSuite() const { return String::EMPTY; } |
|
|
|
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
|
String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; } |
|
#endif |
|
|
String SSLContextRep::getCRLPath() const { return String::EMPTY; } | String SSLContextRep::getCRLPath() const { return String::EMPTY; } |
| |
X509_STORE* SSLContextRep::getCRLStore() const { return NULL; } |
SharedPtr<X509_STORE, FreeX509STOREPtr> SSLContextRep::getCRLStore() const |
|
{ |
|
return SharedPtr<X509_STORE, FreeX509STOREPtr>(); |
|
} |
| |
Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } |
void SSLContextRep::setCRLStore(X509_STORE*) { } |
| |
SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; } |
Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } |
| |
void SSLContextRep::init_ssl() {} |
SSLCertificateVerifyFunction* |
|
SSLContextRep::getSSLCertificateVerifyFunction() const |
|
{ |
|
return NULL; |
|
} |
| |
void SSLContextRep::free_ssl() {} |
void SSLContextRep::validateCertificate() { } |
| |
#endif // end of PEGASUS_HAS_SSL | #endif // end of PEGASUS_HAS_SSL |
| |
|
|
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, String::EMPTY, verifyCert, randomFile); |
_rep = new SSLContextRep( |
|
trustStore, |
|
String::EMPTY, |
|
String::EMPTY, |
|
String::EMPTY, |
|
verifyCert, |
|
randomFile, |
|
String::EMPTY, |
|
false); |
} | } |
| |
SSLContext::SSLContext( | SSLContext::SSLContext( |
|
|
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile); |
_rep = new SSLContextRep( |
|
trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile); |
} | } |
| |
//PEP187 | //PEP187 |
|
|
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep(trustStore, certPath, keyPath, crlPath, verifyCert, randomFile); |
#ifndef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
|
if (crlPath.size() > 0) |
|
{ |
|
MessageLoaderParms parms( |
|
"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", |
|
"SSL CRL verification is not enabled."); |
|
throw Exception(parms); |
|
} |
|
#endif |
|
_rep = new SSLContextRep( |
|
trustStore, certPath, keyPath, crlPath, verifyCert, randomFile); |
|
} |
|
|
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
SSLContext::SSLContext( |
|
const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
const String& crlPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile, |
|
const String& cipherSuite) |
|
{ |
|
#ifndef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
|
if (crlPath.size() > 0) |
|
{ |
|
MessageLoaderParms parms( |
|
"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", |
|
"SSL CRL verification is not enabled."); |
|
throw Exception(parms); |
|
} |
|
#endif |
|
_rep = new SSLContextRep( |
|
trustStore, certPath, keyPath, crlPath, verifyCert, randomFile, |
|
cipherSuite); |
} | } |
| |
|
SSLContext::SSLContext( |
|
const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
const String& crlPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile, |
|
const String& cipherSuite, |
|
const Boolean& sslCompatibility) |
|
{ |
|
#ifndef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
|
if (crlPath.size() > 0) |
|
{ |
|
MessageLoaderParms parms( |
|
"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", |
|
"SSL CRL verification is not enabled."); |
|
throw Exception(parms); |
|
} |
|
#endif |
|
_rep = new SSLContextRep( |
|
trustStore, certPath, keyPath, crlPath, verifyCert, randomFile, |
|
cipherSuite,sslCompatibility); |
|
} |
|
#endif |
|
|
|
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
|
SSLContext::SSLContext( |
|
const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
String, |
|
const String& randomFile) |
|
{ |
|
_rep = new SSLContextRep( |
|
trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile); |
|
} |
|
#endif |
|
|
SSLContext::SSLContext(const SSLContext& sslContext) | SSLContext::SSLContext(const SSLContext& sslContext) |
{ | { |
_rep = new SSLContextRep(*sslContext._rep); | _rep = new SSLContextRep(*sslContext._rep); |
|
|
| |
String SSLContext::getTrustStore() const | String SSLContext::getTrustStore() const |
{ | { |
return (_rep->getTrustStore()); |
return _rep->getTrustStore(); |
} | } |
| |
String SSLContext::getCertPath() const | String SSLContext::getCertPath() const |
{ | { |
return (_rep->getCertPath()); |
return _rep->getCertPath(); |
} | } |
| |
String SSLContext::getKeyPath() const | String SSLContext::getKeyPath() const |
{ | { |
return (_rep->getKeyPath()); |
return _rep->getKeyPath(); |
} | } |
| |
String SSLContext::getCRLPath() const | String SSLContext::getCRLPath() const |
{ | { |
return (_rep->getCRLPath()); |
#ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
|
return _rep->getCRLPath(); |
|
#else |
|
MessageLoaderParms parms( |
|
"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", |
|
"SSL CRL verification is not enabled."); |
|
throw Exception(parms); |
|
PEGASUS_UNREACHABLE(return String::EMPTY;) |
|
#endif |
} | } |
| |
X509_STORE* SSLContext::getCRLStore() const | X509_STORE* SSLContext::getCRLStore() const |
{ | { |
return (_rep->getCRLStore()); |
#ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
|
return _rep->getCRLStore().get(); |
|
#else |
|
MessageLoaderParms parms( |
|
"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", |
|
"SSL CRL verification is not enabled."); |
|
throw Exception(parms); |
|
PEGASUS_UNREACHABLE(return 0;) |
|
#endif |
} | } |
| |
Boolean SSLContext::isPeerVerificationEnabled() const | Boolean SSLContext::isPeerVerificationEnabled() const |
{ | { |
return (_rep->isPeerVerificationEnabled()); |
return _rep->isPeerVerificationEnabled(); |
} | } |
| |
SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const |
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
|
String SSLContext::getTrustStoreUserName() const |
{ | { |
return (_rep->getSSLCertificateVerifyFunction()); |
return _rep->getTrustStoreUserName(); |
|
} |
|
#endif |
|
|
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
String SSLContext::getCipherSuite() const |
|
{ |
|
return _rep->getCipherSuite(); |
|
} |
|
#endif |
|
|
|
SSLCertificateVerifyFunction* |
|
SSLContext::getSSLCertificateVerifyFunction() const |
|
{ |
|
return _rep->getSSLCertificateVerifyFunction(); |
|
} |
|
|
|
void SSLContext::_validateCertificate() |
|
{ |
|
_rep->validateCertificate(); |
} | } |
| |
/////////////////////////////////////////////////////////////////////////////// | /////////////////////////////////////////////////////////////////////////////// |
|
|
| |
const int SSLCertificateInfo::V_ERR_APPLICATION_VERIFICATION = 50; | const int SSLCertificateInfo::V_ERR_APPLICATION_VERIFICATION = 50; |
| |
class SSLCertificateInfoRep |
|
{ |
|
public: |
|
String subjectName; |
|
String issuerName; |
|
Uint32 depth; |
|
Uint32 errorCode; |
|
Uint32 respCode; |
|
String errorString; |
|
Uint32 versionNumber; |
|
long serialNumber; |
|
CIMDateTime notBefore; |
|
CIMDateTime notAfter; |
|
}; |
|
|
|
|
|
SSLCertificateInfo::SSLCertificateInfo( | SSLCertificateInfo::SSLCertificateInfo( |
const String subjectName, | const String subjectName, |
const String issuerName, | const String issuerName, |
|
|
_rep->errorCode = certificateInfo._rep->errorCode; | _rep->errorCode = certificateInfo._rep->errorCode; |
_rep->errorString = certificateInfo._rep->errorString; | _rep->errorString = certificateInfo._rep->errorString; |
_rep->respCode = certificateInfo._rep->respCode; | _rep->respCode = certificateInfo._rep->respCode; |
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
_rep->peerCertificate = certificateInfo._rep->peerCertificate; |
|
#endif |
} | } |
| |
// Dummy constructor made private to disallow default construction | // Dummy constructor made private to disallow default construction |
|
|
| |
String SSLCertificateInfo::getSubjectName() const | String SSLCertificateInfo::getSubjectName() const |
{ | { |
return (_rep->subjectName); |
return _rep->subjectName; |
} | } |
| |
String SSLCertificateInfo::getIssuerName() const | String SSLCertificateInfo::getIssuerName() const |
{ | { |
return (_rep->issuerName); |
return _rep->issuerName; |
} | } |
| |
Uint32 SSLCertificateInfo::getVersionNumber() const | Uint32 SSLCertificateInfo::getVersionNumber() const |
{ | { |
return (_rep->versionNumber); |
return _rep->versionNumber; |
} | } |
| |
long SSLCertificateInfo::getSerialNumber() const | long SSLCertificateInfo::getSerialNumber() const |
{ | { |
return (_rep->serialNumber); |
return _rep->serialNumber; |
} | } |
| |
CIMDateTime SSLCertificateInfo::getNotBefore() const | CIMDateTime SSLCertificateInfo::getNotBefore() const |
{ | { |
return (_rep->notBefore); |
return _rep->notBefore; |
} | } |
| |
CIMDateTime SSLCertificateInfo::getNotAfter() const | CIMDateTime SSLCertificateInfo::getNotAfter() const |
{ | { |
return (_rep->notAfter); |
return _rep->notAfter; |
} | } |
| |
Uint32 SSLCertificateInfo::getErrorDepth() const | Uint32 SSLCertificateInfo::getErrorDepth() const |
{ | { |
return (_rep->depth); |
return _rep->depth; |
} | } |
| |
Uint32 SSLCertificateInfo::getErrorCode() const | Uint32 SSLCertificateInfo::getErrorCode() const |
{ | { |
return (_rep->errorCode); |
return _rep->errorCode; |
} | } |
| |
void SSLCertificateInfo::setErrorCode(const int errorCode) | void SSLCertificateInfo::setErrorCode(const int errorCode) |
|
|
| |
String SSLCertificateInfo::getErrorString() const | String SSLCertificateInfo::getErrorString() const |
{ | { |
return (_rep->errorString); |
return _rep->errorString; |
} | } |
| |
Uint32 SSLCertificateInfo::getResponseCode() const | Uint32 SSLCertificateInfo::getResponseCode() const |
{ | { |
return (_rep->respCode); |
return _rep->respCode; |
} | } |
| |
void SSLCertificateInfo::setResponseCode(const int respCode) | void SSLCertificateInfo::setResponseCode(const int respCode) |
|
|
_rep->respCode = respCode; | _rep->respCode = respCode; |
} | } |
| |
|
#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES |
|
const String &SSLCertificateInfo::getPeerCertificate() const |
|
{ |
|
return _rep->peerCertificate; |
|
} |
|
#endif |
|
|
String SSLCertificateInfo::toString() const | String SSLCertificateInfo::toString() const |
{ | { |
char buf[1024]; | char buf[1024]; |
|
|
s.append(_rep->issuerName); | s.append(_rep->issuerName); |
s.append("\n"); | s.append("\n"); |
| |
sprintf(buf, "Depth: %d\n", _rep->depth); |
sprintf(buf, "Depth: %u\n", _rep->depth); |
s.append(buf); | s.append(buf); |
| |
sprintf(buf, "Error code: %d\n", _rep->errorCode); |
sprintf(buf, "Error code: %u\n", _rep->errorCode); |
s.append(buf); | s.append(buf); |
| |
sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode); |
sprintf(buf, "Response (preverify) code: %u\n", _rep->respCode); |
s.append(buf); | s.append(buf); |
| |
s.append("Error string: "); | s.append("Error string: "); |
s.append(_rep->errorString); | s.append(_rep->errorString); |
s.append("\n"); | s.append("\n"); |
| |
sprintf(buf, "Version number: %d\n", _rep->versionNumber); |
sprintf(buf, "Version number: %u\n", _rep->versionNumber); |
s.append(buf); | s.append(buf); |
| |
sprintf(buf, "Serial number: %ld\n", _rep->serialNumber); |
sprintf(buf, "Serial number: %lu\n", (unsigned long)_rep->serialNumber); |
s.append(buf); | s.append(buf); |
| |
s.append("Not before date: "); | s.append("Not before date: "); |
|
|
return s; | return s; |
} | } |
| |
SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert, X509_STORE* crlStore) |
/////////////////////////////////////////////////////////////////////////////// |
|
// |
|
// SSLCallbackInfo |
|
// |
|
/////////////////////////////////////////////////////////////////////////////// |
|
|
|
SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert) |
{ | { |
verifyCertificateCallback = verifyCert; |
_rep = new SSLCallbackInfoRep(); |
_crlStore = crlStore; |
_rep->verifyCertificateCallback = verifyCert; |
_peerCertificate = NULL; |
_rep->crlStore = NULL; |
|
} |
|
|
|
SSLCallbackInfo::SSLCallbackInfo( |
|
SSLCertificateVerifyFunction* verifyCert, |
|
X509_STORE* crlStore) |
|
{ |
|
_rep = new SSLCallbackInfoRep(); |
|
_rep->verifyCertificateCallback = verifyCert; |
|
_rep->crlStore = crlStore; |
|
} |
|
|
|
SSLCallbackInfo::SSLCallbackInfo( |
|
SSLCertificateVerifyFunction* verifyCert, |
|
X509_STORE* crlStore, |
|
String ipAddress) |
|
{ |
|
_rep = new SSLCallbackInfoRep(); |
|
_rep->verifyCertificateCallback = verifyCert; |
|
_rep->crlStore = crlStore; |
|
_rep->ipAddress = ipAddress; |
} | } |
| |
SSLCallbackInfo::~SSLCallbackInfo() | SSLCallbackInfo::~SSLCallbackInfo() |
{ | { |
if (_peerCertificate) |
PEG_METHOD_ENTER(TRC_SSL, "SSLCallbackInfo::~SSLCallbackInfo"); |
|
for (Uint32 i = 0; i < _rep->peerCertificate.size(); i++) |
{ | { |
delete _peerCertificate; |
delete _rep->peerCertificate[i]; |
} | } |
|
delete _rep; |
|
PEG_METHOD_EXIT(); |
} | } |
| |
PEGASUS_NAMESPACE_END | PEGASUS_NAMESPACE_END |