pegasus/src/Pegasus/Common/SSLContext.cpp - diff

Return to SSLContext.cpp CVS log

Up to [Pegasus] / pegasus / src / Pegasus / Common

Diff for /pegasus/src/Pegasus/Common/SSLContext.cpp between version 1.72 and 1.116.10.4

version 1.72, 2006/08/22 17:49:09

version 1.116.10.4, 2013/08/27 07:42:48

Line 1

//%2006////////////////////////////////////////////////////////////////////////

//%LICENSE////////////////////////////////////////////////////////////////

// Licensed to The Open Group (TOG) under one or more contributor license

// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.

// agreements. Refer to the OpenPegasusNOTICE.txt file distributed with

// this work for additional information regarding copyright ownership.

// IBM Corp.; EMC Corporation, The Open Group.

// Each contributor licenses this file to you under the OpenPegasus Open

// Source License; you may not use this file except in compliance with the

// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.

// License.

// EMC Corporation; VERITAS Software Corporation; The Open Group.

// Permission is hereby granted, free of charge, to any person obtaining a

// copy of this software and associated documentation files (the "Software"),

// EMC Corporation; Symantec Corporation; The Open Group.

// to deal in the Software without restriction, including without limitation

// the rights to use, copy, modify, merge, publish, distribute, sublicense,

// Permission is hereby granted, free of charge, to any person obtaining a copy

// and/or sell copies of the Software, and to permit persons to whom the

// of this software and associated documentation files (the "Software"), to

// Software is furnished to do so, subject to the following conditions:

// deal in the Software without restriction, including without limitation the

// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or

// The above copyright notice and this permission notice shall be included

// sell copies of the Software, and to permit persons to whom the Software is

// in all copies or substantial portions of the Software.

// furnished to do so, subject to the following conditions:

// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

// THE ABOVE COPYRIGHT NOTICE AND THIS PERMISSION NOTICE SHALL BE INCLUDED IN

// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

// ALL COPIES OR SUBSTANTIAL PORTIONS OF THE SOFTWARE. THE SOFTWARE IS PROVIDED

// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

// "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT

// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY

// LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR

// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,

// PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT

// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION

// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

//////////////////////////////////////////////////////////////////////////

//==============================================================================

// Author: Markus Mueller (sedgewick_de@yahoo.de)

// Modified By: Nag Boranna, Hewlett-Packard Company (nagaraja_boranna@hp.com)

// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com)

// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com)

// Heather Sterling, IBM (hsterl@us.ibm.com)

// Amit K Arora, IBM (amita@in.ibm.com) for Bug#1090

// David Dillard, Symantec Corp. (david_dillard@symantec.com)

// Aruran, IBM (ashanmug@in.ibm.com) for Bug#4422

//%/////////////////////////////////////////////////////////////////////////////

#ifdef PEGASUS_HAS_SSL

#include <Pegasus/Common/Config.h>

# include <Pegasus/Common/Executor.h>

#include "Network.h"

# include <Pegasus/Common/Network.h>

#define OPENSSL_NO_KRB5 1

#include <openssl/err.h>

#include <openssl/ssl.h>

#include <openssl/rand.h>

# include <openssl/tls1.h>

#else

#define SSL_CTX void

#endif // end of PEGASUS_HAS_SSL

#include <time.h>

#include <Pegasus/Common/Socket.h>

#include <Pegasus/Common/Tracer.h>

#include <Pegasus/Common/FileSystem.h>

#include <time.h>

#include <Pegasus/Common/MessageLoader.h>

#include <Pegasus/Common/MessageLoader.h> //l10n

#include <Pegasus/Common/Formatter.h>

#include "SSLContext.h"

#include "SSLContextRep.h"

#ifdef PEGASUS_OS_OS400

#ifdef PEGASUS_OS_PASE

#include "SSLWrapperOS400.h"

# include <ILEWrapper/ILEUtilities.h>

#endif

// Typedef's for OpenSSL callback functions.

extern "C"

{

typedef void (* CRYPTO_SET_LOCKING_CALLBACK)(int, int, const char *, int);

typedef unsigned long (* CRYPTO_SET_ID_CALLBACK)(void);

};

typedef struct x509_store_ctx_st X509_STORE_CTX;

typedef struct Timestamp

{

char year[4];

char month[2];

char day[2];

char hour[2];

char minutes[2];

char seconds[2];

char dot;

char microSeconds[6];

char plusOrMinus;

char utcOffset[3];

char padding[3];

} Timestamp_t;

PEGASUS_USING_STD;

PEGASUS_NAMESPACE_BEGIN

const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0;

class SSLCertificateInfoRep

{

public:

String subjectName;

String issuerName;

Uint32 depth;

Uint32 errorCode;

Uint32 respCode;

String errorString;

Uint32 versionNumber;

long serialNumber;

CIMDateTime notBefore;

CIMDateTime notAfter;

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

String peerCertificate;

#endif

};

// use the following definitions only if SSL is available

#ifdef PEGASUS_HAS_SSL

// Mutex for SSL locks which will get initialized by AutoArrayPtr constructor.

AutoArrayPtr<Mutex> SSLEnvironmentInitializer::_sslLocks;

AutoArrayPtr<Mutex> SSLContextRep::_sslLocks;

int SSLEnvironmentInitializer::_instanceCount = 0;

Mutex SSLEnvironmentInitializer::_instanceCountMutex;

// Mutex for _countRep.

Mutex SSLContextRep::_countRepMutex;

// Initialise _count for SSLContextRep objects.

int SSLContextRep::_countRep = 0;

Line 122

Line 98

{

struct tm time;

int offset;

Timestamp_t timeStamp;

char tempString[80];

char plusOrMinus = '+';

unsigned char* utcTimeData = utcTime->data;

Line 170

Line 144

}

#undef g2

memset((void *)&timeStamp, 0, sizeof(Timestamp_t));

// Format the date.

if (plusOrMinus == '-')

sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d",

{

offset = -offset;

}

CIMDateTime dateTime = CIMDateTime(

time.tm_year,

time.tm_mon + 1,

time.tm_mday,

Line 181

Line 158

time.tm_min,

time.tm_sec,

offset);

timeStamp.plusOrMinus = plusOrMinus;

return dateTime;

CIMDateTime dateTime;

dateTime.clear();

strcpy(tempString, (char *)&timeStamp);

dateTime.set(tempString);

return (dateTime);

}

Line 201

Line 171

{

public:

static int verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx);

static int verificationCallback(

static int verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore);

int preVerifyOk,

X509_STORE_CTX* ctx);

static int verificationCRLCallback(

int ok,

X509_STORE_CTX* ctx,

X509_STORE* sslCRLStore);

};

Line 211

Line 186

// return 1 if revoked, 0 otherwise

int SSLCallback::verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore)

int SSLCallback::verificationCRLCallback(

int,

X509_STORE_CTX* ctx,

X509_STORE* sslCRLStore)

{

PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::verificationCRLCallback");

Line 220

Line 198

//check whether a CRL store was specified

if (sslCRLStore == NULL)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: CRL store is NULL");

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: CRL store is NULL");

PEG_METHOD_EXIT();

return 0;

}

Line 239

Line 218

//log certificate information

//this is information in the "public" key, so it does no harm to log it

X509_NAME_oneline(issuerName, buf, sizeof(buf));

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Certificate Data: Issuer/Subject");

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, buf);

"---> SSL: Certificate Data: Issuer/Subject");

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, buf);

X509_NAME_oneline(subjectName, buf, sizeof(buf));

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, buf);

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, buf);

//initialize the CRL store

X509_STORE_CTX crlStoreCtx;

X509_STORE_CTX_init(&crlStoreCtx, sslCRLStore, NULL, NULL);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Initialized CRL store");

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,

"---> SSL: Initialized CRL store");

//attempt to get a CRL issued by the certificate's issuer

X509_OBJECT obj;

if (X509_STORE_get_by_subject(&crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0)

if (X509_STORE_get_by_subject(

&crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: No CRL by that issuer");

X509_STORE_CTX_cleanup(&crlStoreCtx);

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: No CRL by that issuer");

PEG_METHOD_EXIT();

return 0;

}

Line 264

Line 248

X509_CRL* crl = obj.data.crl;

if (crl == NULL)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL is null");

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL is null");

PEG_METHOD_EXIT();

return 0;

} else

}

else

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Found CRL by that issuer");

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,

"---> SSL: Found CRL by that issuer");

}

//get revoked certificates

STACK_OF(X509_REVOKED)* revokedCerts = NULL;

revokedCerts = X509_CRL_get_REVOKED(crl);

int numRevoked = sk_X509_REVOKED_num(revokedCerts);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,"---> SSL: Number of certificates revoked by the issuer %d\n", numRevoked);

PEG_TRACE((TRC_SSL, Tracer::LEVEL4,

"---> SSL: Number of certificates revoked by the issuer %d\n",

numRevoked));

//check whether the subject's certificate is revoked

X509_REVOKED* revokedCert = NULL;

for (int i = 0; i < sk_X509_REVOKED_num(revokedCerts); i++)

for (int i = 0; i < numRevoked; i++)

{

revokedCert = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i);

revokedCert = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i);

//a matching serial number indicates revocation

if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, "---> SSL: Certificate is revoked");

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2,

"---> SSL: Certificate is revoked");

X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED);

X509_CRL_free(crl);

PEG_METHOD_EXIT();

return 1;

}

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Certificate is not revoked at this level");

X509_CRL_free(crl);

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,

"---> SSL: Certificate is not revoked at this level");

PEG_METHOD_EXIT();

return 0;

Line 304

Line 296

// Callback function that is called by the OpenSSL library. This function

// extracts X509 certficate information and pass that on to client application

// callback function.

// We HAVE to build the certificate in all cases since it's needed to get the associated username out of the repository

// We HAVE to build the certificate in all cases since it's needed to get

// later in the transaction

// the associated username out of the repository later in the transaction.

int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx)

{

PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()");

char buf[256];

X509 *currentCert;

SSL *ssl;

int verifyError = X509_V_OK;

int revoked = -1;

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE((TRC_SSL, Tracer::LEVEL4,

"--->SSL: Preverify Error %d", verifyError);

"--->SSL: Preverify result %d", preVerifyOk));

// get the verification callback info specific to each SSL connection

ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());

ssl = (SSL*) X509_STORE_CTX_get_ex_data(

SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX);

ctx, SSL_get_ex_data_X509_STORE_CTX_idx());

SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(

ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX);

#ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION

Line 333

Line 324

if (exData->_rep->crlStore != NULL)

{

revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_rep->crlStore);

revoked = verificationCRLCallback(

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL callback returned %d", revoked);

preVerifyOk,ctx,exData->_rep->crlStore);

PEG_TRACE((TRC_SSL, Tracer::LEVEL4,

"---> SSL: CRL callback returned %d", revoked));

if (revoked) //with the SSL callbacks '0' indicates failure

{

Line 343

Line 336

}

Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL callback returned %d", revoked);

PEG_TRACE((TRC_SSL, Tracer::LEVEL4,

"---> SSL: CRL callback returned %d", revoked));

#endif

Line 394

Line 388

if (!preVerifyOk)

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE((TRC_SSL, Tracer::LEVEL2,

"---> SSL: certificate default verification error: %s", (const char*)errorStr.getCString());

"---> SSL: certificate default verification error: %s",

(const char*)errorStr.getCString()));

}

Line 408

Line 403

// Create the certificate object

//insert at the beginning of the array so that the peer certificate is first and the root CA is last

// insert at the beginning of the array so that the peer certificate is

exData->_rep->peerCertificate.insert(0, new SSLCertificateInfo(subjectName, issuerName, version, serialNumber,

// first and the root CA is last

notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk));

SSLCertificateInfo *certInfo = new SSLCertificateInfo(

subjectName,

issuerName,

version,

serialNumber,

notBefore,

notAfter,

depth,

errorCode,

errorStr,

preVerifyOk);

String peerCertificate;

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

// Get Base64 encoded DER (PEM) certificate

char *data = 0;

long length = 0;

BIO *bio = BIO_new(BIO_s_mem());

if (bio)

{

if (PEM_write_bio_X509(bio, currentCert) == 0)

{

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1,

"PEM converion failed.");

}

else

{

length = BIO_get_mem_data(bio, &data);

peerCertificate.assign(data, (Uint32)length);

}

BIO_free_all(bio);

}

certInfo->_rep->peerCertificate = peerCertificate;

#endif

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "Created SSLCertificateInfo");

exData->_rep->peerCertificate.insert(0, certInfo);

// NOT_YET_VALID checks do not work correctly on subsequent tries -- Bugzilla#4283

// call this prior to calling the user-specified callback in case they want to override it

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, "Created SSLCertificateInfo");

if (errorCode == X509_V_OK && (CIMDateTime::getDifference(CIMDateTime::getCurrentDateTime(), notBefore) > 0))

// NOT_YET_VALID checks do not work correctly on subsequent tries --

// Bugzilla#4283

// call this prior to calling the user-specified callback in case they

// want to override it

if (errorCode == X509_V_OK &&

(CIMDateTime::getDifference(

CIMDateTime::getCurrentDateTime(), notBefore) > 0))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "Certificate was not yet valid.");

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2,

"Certificate was not yet valid.");

X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_NOT_YET_VALID);

}

// Call the user-specified application callback if it is specified. If it is null, return OpenSSL's verification code.

// Call the user-specified application callback if it is specified.

// Note that the verification result does not automatically get set to X509_V_OK if the callback is successful.

// If it is null, return OpenSSL's verification code.

// This is because OpenSSL retains the original default error in case we want to use it later.

// Note that the verification result does not automatically get set

// To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here.

// to X509_V_OK if the callback is successful.

// This is because OpenSSL retains the original default error in case

// we want to use it later.

// To set the error, we could use X509_STORE_CTX_set_error(ctx,

// X509_V_OK); but there is no real benefit to doing that here.

if (exData->_rep->verifyCertificateCallback == NULL)

{

PEG_METHOD_EXIT();

return preVerifyOk;

}

} else

else

{

if (exData->_rep->verifyCertificateCallback(*exData->_rep->peerCertificate[0]))

if (exData->_rep->verifyCertificateCallback(

*exData->_rep->peerCertificate[0]))

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,

"--> SSL: _rep->verifyCertificateCallback() returned X509_V_OK");

"--> SSL: _rep->verifyCertificateCallback() returned "

"X509_V_OK");

PEG_METHOD_EXIT();

return 1;

}

else // verification failed, handshake will be immediately terminated

{

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

"--> SSL: _rep->verifyCertificateCallback() returned error %d", exData->_rep->peerCertificate[0]->getErrorCode());

"--> SSL: _rep->verifyCertificateCallback() returned error %d",

exData->_rep->peerCertificate[0]->getErrorCode()));

PEG_METHOD_EXIT();

return 0;

Line 454

Line 501

}

// Callback function called by OpenSSL. This request is merely forwarded to the static

// Callback function called by OpenSSL. This request is merely forwarded

// function SSLCallback::callback(). The SSLCallback class is a friend class of the

// to the static function SSLCallback::callback(). The SSLCallback class

// Pegasus SSL related classes needed to complete the callback.

// is a friend class of the Pegasus SSL related classes needed to complete

// the callback.

extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx)

{

Line 464

Line 512

}

// Implement OpenSSL locking callback.

void pegasus_locking_callback( int mode,

int type,

const char* file,

int line)

{

// Check whether the mode is lock or unlock.

if ( mode & CRYPTO_LOCK )

{

/*Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Now locking for %d", Threads::id());*/

SSLContextRep::_sslLocks.get()[type].lock( );

}

else

{

/*Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Now unlocking for %d", Threads::id());*/

SSLContextRep::_sslLocks.get()[type].unlock( );

}

static unsigned long _get_thread_id()

{

#if defined(PEGASUS_HAVE_PTHREADS)

return pthread_self();

#else

return 0;

#endif

}

// Initialize OpenSSL Locking and id callbacks.

void SSLContextRep::init_ssl()

{

// Allocate Memory for _sslLocks. SSL locks needs to be able to handle

// up to CRYPTO_num_locks() different mutex locks.

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

"Initialized SSL callback.");

#ifdef PEGASUS_OS_OS400

// Load the OpenSSL library and get the exports

SSL_OS400_Init();

#endif

_sslLocks.reset(new Mutex[CRYPTO_num_locks()]);

// Set the ID callback. The ID callback returns a thread ID.

CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK)_get_thread_id);

// Set the locking callback to pegasus_locking_callback.

CRYPTO_set_locking_callback((CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback);

}

// Free OpenSSL Locking and id callbacks.

void SSLContextRep::free_ssl()

{

// Cleanup _sslLocks and set locking & id callback to NULL.

CRYPTO_set_locking_callback(NULL);

CRYPTO_set_id_callback (NULL);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

"Freed SSL callback.");

_sslLocks.reset();

}

// SSL context area

// For the OSs that don't have /dev/random device file,

Line 548

Line 523

const String& keyPath,

const String& crlPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

const String& randomFile,

const String& cipherSuite,

const Boolean& sslCompatibility)

{

PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()");

_trustStore = trustStore;

_certPath = certPath;

_keyPath = keyPath;

_crlPath = crlPath;

_crlStore = NULL;

_certificateVerifyFunction = verifyCert;

_cipherSuite = cipherSuite;

_sslCompatibility = sslCompatibility;

// If a truststore and/or peer verification function is specified, enable peer verification

if (trustStore != String::EMPTY || verifyCert != NULL)

{

_verifyPeer = true;

}

else

{

_verifyPeer = false;

}

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

{

AutoMutex autoMut(_countRepMutex);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in constructor %d", _countRep);

if ( _countRep == 0 )

{

init_ssl();

// load SSL library

// If a truststore and/or peer verification function is specified,

// enable peer verification

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

_verifyPeer = (trustStore != String::EMPTY || verifyCert != NULL);

"Before calling SSL_load_error_strings %d", Threads::id());

SSL_load_error_strings();

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"After calling SSL_load_error_strings %d", Threads::id());

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Before calling SSL_library_init %d", Threads::id());

SSL_library_init();

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"After calling SSL_library_init %d", Threads::id());

}

_countRep++;

} // mutex unlocks here

_randomInit(randomFile);

Line 626

Line 557

_certPath = sslContextRep._certPath;

_keyPath = sslContextRep._keyPath;

_crlPath = sslContextRep._crlPath;

_crlStore = sslContextRep._crlStore;

_verifyPeer = sslContextRep._verifyPeer;

_certificateVerifyFunction = sslContextRep._certificateVerifyFunction;

_randomFile = sslContextRep._randomFile;

_cipherSuite = sslContextRep._cipherSuite;

// Initialiaze SSL callbacks and increment the SSLContextRep object _counter.

_sslCompatibility = sslContextRep._sslCompatibility;

{

AutoMutex autoMut(_countRepMutex);

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in copy constructor %d", _countRep);

if ( _countRep == 0 )

{

init_ssl();

}

_countRep++;

} // mutex unlocks here

_sslContext = _makeSSLContext();

PEG_METHOD_EXIT();

}

Line 658

Line 577

SSL_CTX_free(_sslContext);

// Decrement the SSLContextRep object _counter.

{

AutoMutex autoMut(_countRepMutex);

_countRep--;

// Free SSL locks if no instances of SSLContextRep exist.

Tracer::trace(TRC_SSL, Tracer::LEVEL4,

"Value of Countrep in destructor %d", _countRep);

if ( _countRep == 0 )

{

free_ssl();

}

PEG_METHOD_EXIT();

}

Line 682

Line 587

{

PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::_randomInit()");

Boolean ret;

int retVal = 0;

#ifdef PEGASUS_SSL_RANDOMFILE

#if defined(PEGASUS_SSL_RANDOMFILE) && !defined(PEGASUS_OS_PASE)

if ( RAND_status() == 0 )

{

Line 693

Line 596

if ( randomFile == String::EMPTY )

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1,

"Random seed file is required.");

PEG_METHOD_EXIT();

//l10n

MessageLoaderParms parms(

//throw( SSLException("Random seed file required"));

"Common.SSLContext.RANDOM_SEED_FILE_REQUIRED",

MessageLoaderParms parms("Common.SSLContext.RANDOM_SEED_FILE_REQUIRED",

"Random seed file required");

throw SSLException(parms);

}

Line 706

Line 608

// Try the given random seed file

ret = FileSystem::exists(randomFile);

Boolean ret = FileSystem::exists(randomFile);

if( ret )

{

retVal = RAND_load_file(randomFile.getCString(), -1);

int retVal = RAND_load_file(randomFile.getCString(), -1);

if ( retVal < 0 )

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

"Not enough seed data in seed file: " + randomFile);

"Not enough seed data in seed file: %s",

PEG_METHOD_EXIT();

(const char*)randomFile.getCString()));

//l10n

PEG_METHOD_EXIT();

// do not put in $0 in default message, but pass in filename for bundle message

// do not put in $0 in default message, but pass in filename

//throw( SSLException("Not enough seed data in random seed file."));

// for bundle message

MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE",

MessageLoaderParms parms(

"Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE",

"Not enough seed data in random seed file.",

randomFile);

throw SSLException(parms);

Line 726

Line 629

}

else

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

"seed file - " + randomFile + " does not exist.");

"Seed file \'%s\' does not exist.",

(const char*)randomFile.getCString()));

PEG_METHOD_EXIT();

//l10n

MessageLoaderParms parms(

//throw( SSLException("Seed file '" + randomFile + "' does not exist."));

"Common.SSLContext.SEED_FILE_DOES_NOT_EXIST",

MessageLoaderParms parms("Common.SSLContext.SEED_FILE_DOES_NOT_EXIST",

"Seed file '$0' does not exist.",

randomFile);

throw SSLException(parms);

Line 755

Line 658

int seedRet = RAND_status();

if ( seedRet == 0 )

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

"Not enough seed data in random seed file, RAND_status = " +

"Not enough seed data in random seed file, "

seedRet);

"RAND_status = %d",

PEG_METHOD_EXIT();

seedRet));

//l10n 485

PEG_METHOD_EXIT();

// do not put in $0 in default message, but pass in filename for bundle message

// do not put in $0 in default message, but pass in filename

//throw( SSLException("Not enough seed data in random seed file."));

// for bundle message

MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE",

MessageLoaderParms parms(

"Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE",

"Not enough seed data in random seed file.",

randomFile);

throw SSLException(parms);

Line 771

Line 675

}

#endif /* PEGASUS_SSL_RANDOMFILE */

#ifdef PEGASUS_OS_PASE

if (RAND_status() == 0)

{

// generate random number for pase must use specify function

unsigned char prn[1024];

umeGenerateRandomNumber(prn, sizeof(prn));

RAND_seed(prn, 1024);

}

#endif

int seedRet = RAND_status();

if ( seedRet == 0 )

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

"Not enough seed data , RAND_status = " + seedRet );

"Not enough seed data, RAND_status = %d",

seedRet));

PEG_METHOD_EXIT();

//l10n

MessageLoaderParms parms(

//throw( SSLException("Not enough seed data."));

"Common.SSLContext.NOT_ENOUGH_SEED_DATA",

MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA",

"Not enough seed data.");

throw SSLException(parms);

}

Line 793

Line 707

SSL_CTX * sslContext = 0;

// OPENSSL_VERSION_NUMBER is defined as 0xnnnnnnnnnL

// MMNNFFPPS: major minor fix patch status

// The change 'const' SSL_METHOD

// was introduced in version 1.0.0

#if (OPENSSL_VERSION_NUMBER < 0x10000000L)

SSL_METHOD *sslProtocolMethod = SSLv23_method() ;

#else

const SSL_METHOD *sslProtocolMethod = SSLv23_method() ;

#endif

int options = SSL_OP_ALL;

// create SSL Context Area

if (!( sslContext = SSL_CTX_new(SSLv23_method()) ))

if ( _sslCompatibility == false )

{

#ifdef TLS1_2_VERSION

// Enable only TLSv1.2 and disable all other protocol (SSL v2, SSL v3,

// TLS v1.0, TLSv1.1)

sslProtocolMethod = TLSv1_2_method();

options = SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1;

#ifndef OPENSSL_NO_SSL3

options |= SSL_OP_NO_SSLv3;

#endif

}

if (!(sslContext = SSL_CTX_new(sslProtocolMethod)))

{

PEG_METHOD_EXIT();

//l10n

MessageLoaderParms parms(

//throw( SSLException("Could not get SSL CTX"));

"Common.SSLContext.COULD_NOT_GET",

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET",

"Could not get SSL CTX");

throw SSLException(parms);

}

#ifdef PEGASUS_SSL_WEAKENCRYPTION

if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40))){

if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40)))

//l10n

{

//throw( SSLException("Could not set the cipher list"));

SSL_CTX_free(sslContext);

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_SET_CIPHER_LIST",

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_SET_CIPHER_LIST",

"Could not set the cipher list");

throw SSLException(parms);

}

#endif

if (_cipherSuite != String::EMPTY)

{

if (!(SSL_CTX_set_cipher_list(sslContext, _cipherSuite.getCString())))

{

SSL_CTX_free(sslContext);

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Cipher Suite could not be specified");

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_SET_CIPHER_LIST",

"Could not set the cipher list");

throw SSLException(parms);

}

else

{

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

"---> SSL: Cipher suite set to %s",

(const char *)_cipherSuite.getCString()));

}

// set overall SSL Context flags

// For OpenSSLversion >1.0.0 use SSL_OP_NO_COMPRESSION to disable the

// compression For TLS 1.2 version, compression does not suffer from

// CRIME attack so don.t disable compression For other OpenSSL versions

// zero out the compression methods.

#ifdef SSL_OP_NO_COMPRESSION

#ifndef TLS1_2_VERSION

SSL_CTX_set_options(sslContext, SSL_OP_NO_COMPRESSION);

#endif

#elif OPENSSL_VERSION_NUMBER >= 0x00908000L

sk_SSL_COMP_zero(SSL_COMP_get_compression_methods());

#endif

SSL_CTX_set_quiet_shutdown(sslContext, 1);

SSL_CTX_set_mode(sslContext, SSL_MODE_AUTO_RETRY);

SSL_CTX_set_mode(sslContext, SSL_MODE_ENABLE_PARTIAL_WRITE);

SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF);

int options = SSL_OP_ALL;

#ifdef SSL_MODE_RELEASE_BUFFERS

// Keep memory usage as low as possible

SSL_CTX_set_mode (sslContext, SSL_MODE_RELEASE_BUFFERS);

#endif

#ifndef PEGASUS_ENABLE_SSLV2 //SSLv2 is disabled by default

options |= SSL_OP_NO_SSLv2;

#endif

Line 834

Line 812

if (_verifyPeer)

{

//ATTN: We might still need a flag to specify SSL_VERIFY_FAIL_IF_NO_PEER_CERT

// ATTN: We might still need a flag to specify

// If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be terminated

// SSL_VERIFY_FAIL_IF_NO_PEER_CERT

// if the client sends no certificate or sends an untrusted certificate. The

// If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be

// callback function is not called in this case; the handshake is simply terminated.

// terminated if the client sends no certificate or sends an

// untrusted certificate. The callback function is not called in

// this case; the handshake is simply terminated.

// This value has NO effect in from a client perspective

if (_certificateVerifyFunction != NULL)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: certificate verification callback specified");

SSL_CTX_set_verify(sslContext,

SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback);

}

else

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: Trust Store specified");

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Trust Store specified");

SSL_CTX_set_verify(sslContext,

SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,

SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE |

SSL_VERIFY_FAIL_IF_NO_PEER_CERT,

prepareForCallback);

}

else

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Trust Store and certificate verification callback are NOT specified");

"---> SSL: Trust Store and certificate verification callback "

"are NOT specified");

SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL);

}

// Check if there is CA certificate file or directory specified. If specified,

// Check if there is CA certificate file or directory specified. If

// and is not empty, load the certificates from the Trust store.

// specified, and is not empty, load the certificates from the Trust store.

if (_trustStore != String::EMPTY)

{

Line 879

Line 862

if (FileSystem::isDirectory(_trustStore))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Truststore is a directory");

// load certificates from the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

"---> SSL: Loading certificates from the trust store: " + _trustStore);

"---> SSL: Loading certificates from the trust store: %s",

(const char*)_trustStore.getCString()));

if ((!SSL_CTX_load_verify_locations(sslContext, NULL, _trustStore.getCString())) ||

if ((!SSL_CTX_load_verify_locations(

sslContext, NULL, _trustStore.getCString())) ||

(!SSL_CTX_set_default_verify_paths(sslContext)))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

"---> SSL: Could not load certificates from the trust store: " + _trustStore);

"---> SSL: Could not load certificates from the "

//l10n

"trust store: %s ",(const char*)_trustStore.getCString()));

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",

"Could not load certificates in to trust store.");

PEG_METHOD_EXIT();

throw SSLException(parms);

Line 902

Line 888

}

else if (FileSystem::exists(_trustStore))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Truststore is a file");

// Get size of the trust store file:

Line 916

Line 902

// load certificates from the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

"---> SSL: Loading certificates from the trust store: " + _trustStore);

"---> SSL: Loading certificates from the trust store: %s",

(const char*)_trustStore.getCString()));

if ((!SSL_CTX_load_verify_locations(sslContext, _trustStore.getCString(), NULL)) ||

if ((!SSL_CTX_load_verify_locations(

sslContext, _trustStore.getCString(), NULL)) ||

(!SSL_CTX_set_default_verify_paths(sslContext)))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

"---> SSL: Could not load certificates from the trust store: " + _trustStore);

"---> SSL: Could not load certificates from the "

//l10n

"trust store: %s",

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",

(const char*)_trustStore.getCString()));

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",

"Could not load certificates in to trust store.");

PEG_METHOD_EXIT();

throw SSLException(parms);

Line 936

Line 926

// no certificates found in the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE((TRC_SSL, Tracer::LEVEL2,

"---> SSL: No certificates to load from the trust store: " + _trustStore);

"---> SSL: No certificates to load from the "

"trust store: %s",(const char*)_trustStore.getCString()));

}

if (_crlPath != String::EMPTY)

{

//need to save this -- can we make it static since there's only one CRL for cimserver?

// need to save this -- can we make it static since there's only

// one CRL for cimserver?

X509_LOOKUP* pLookup;

_crlStore = X509_STORE_new();

_crlStore.reset(X509_STORE_new());

if (_crlStore.get() == NULL)

{

PEG_METHOD_EXIT();

throw PEGASUS_STD(bad_alloc)();

}

//the validity of the crlstore was checked in ConfigManager during server startup

// the validity of the crlstore was checked in ConfigManager

// during server startup

if (FileSystem::isDirectory(_crlPath))

{

Tracer::trace(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

"---> SSL: CRL store is a directory in %s", (const char*)_crlPath.getCString());

"---> SSL: CRL store is a directory in %s",

(const char*)_crlPath.getCString()));

if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_hash_dir())) == NULL)

if ((pLookup = X509_STORE_add_lookup(

_crlStore.get(), X509_LOOKUP_hash_dir())) == NULL)

{

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS",

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_LOAD_CRLS",

"Could not load certificate revocation list.");

X509_STORE_free(_crlStore);

_crlStore.reset();

PEG_METHOD_EXIT();

throw SSLException(parms);

}

X509_LOOKUP_add_dir(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);

X509_LOOKUP_add_dir(

pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Successfully configured CRL directory");

}

} else

else

{

Tracer::trace(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

"---> SSL: CRL store is the file %s", (const char*)_crlPath.getCString());

"---> SSL: CRL store is the file %s",

(const char*)_crlPath.getCString()));

if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_file())) == NULL)

if ((pLookup = X509_STORE_add_lookup(

_crlStore.get(), X509_LOOKUP_file())) == NULL)

{

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS",

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_LOAD_CRLS",

"Could not load certificate revocation list.");

X509_STORE_free(_crlStore);

_crlStore.reset();

PEG_METHOD_EXIT();

throw SSLException(parms);

}

X509_LOOKUP_load_file(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);

X509_LOOKUP_load_file(

pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Successfully configured CRL file");

}

Line 1002

Line 1008

// load the specified server certificates

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

"---> SSL: Loading server certificate from: " + _certPath);

"---> SSL: Loading server certificate from: %s",

(const char*)_certPath.getCString()));

if (SSL_CTX_use_certificate_file(sslContext,

_certPath.getCString(), SSL_FILETYPE_PEM) <=0)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

"---> SSL: No server certificate found in " + _certPath);

"---> SSL: No server certificate found in %s",

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE",

(const char*)_certPath.getCString()));

"Could not get server certificate.");

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_ACCESS_SERVER_CERTIFICATE",

"Could not access server certificate in $0.",

(const char*)_certPath.getCString());

PEG_METHOD_EXIT();

throw SSLException(parms);

}

// If there is no key file (file containing server

// private key) specified, then try loading the key from the certificate file.

// private key) specified, then try loading the key from the

// As of 2.4, if a keyfile is specified, its location is verified during server

// certificate file.

// startup and will throw an error if the path is invalid.

// As of 2.4, if a keyfile is specified, its location is verified

// during server startup and will throw an error if the path is invalid.

if (_keyPath == String::EMPTY)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

"---> SSL: loading private key from: " + _certPath);

"---> SSL: Key file empty, loading private key from "

"certificate file: %s",(const char*)_certPath.getCString()));

// load the private key and check for validity

if (!_verifyPrivateKey(sslContext, _certPath))

{

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",

"Could not get private key.");

PEG_METHOD_EXIT();

throw SSLException(parms);

Line 1047

Line 1060

if (_keyPath != String::EMPTY && !keyLoaded)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

"---> SSL: loading private key from: " + _keyPath);

"---> SSL: loading private key from: %s",

(const char*)_keyPath.getCString()));

// load given private key and check for validity

if (!_verifyPrivateKey(sslContext, _keyPath))

{

MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",

"Could not get private key.");

PEG_METHOD_EXIT();

throw SSLException(parms);

Line 1070

Line 1085

{

PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()");

if (SSL_CTX_use_PrivateKey_file(ctx, keyPath.getCString(), SSL_FILETYPE_PEM) <= 0)

// Open the private key file.

FILE* is = Executor::openFile(keyPath.getCString(), 'r');

if (!is)

{

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

"---> SSL: failed to open private key file: %s",

(const char*)keyPath.getCString()));

return false;

}

// Read the private key from the input stream.

EVP_PKEY* pkey;

pkey = PEM_read_PrivateKey(is, NULL, NULL, NULL);

if (!pkey)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE_CSTRING(

"---> SSL: no private key found in " + String(keyPath));

TRC_SSL, Tracer::LEVEL1, "---> SSL: failed to create private key");

return false;

}

// Close the input stream.

fclose(is);

// Associate the new private key with the SSL context object.

if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0)

{

EVP_PKEY_free(pkey);

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

"---> SSL: no private key found in %s",

(const char*)keyPath.getCString()));

PEG_METHOD_EXIT();

return false;

}

EVP_PKEY_free(pkey);

// Check private key for validity.

if (!SSL_CTX_check_private_key(ctx))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1,

"---> SSL: Private and public key do not match");

PEG_METHOD_EXIT();

return false;

Line 1117

Line 1168

}

#endif

String SSLContextRep::getCipherSuite() const

{

return _cipherSuite;

}

String SSLContextRep::getCRLPath() const

{

return _crlPath;

}

X509_STORE* SSLContextRep::getCRLStore() const

SharedPtr<X509_STORE, FreeX509STOREPtr> SSLContextRep::getCRLStore() const

{

return _crlStore;

}

void SSLContextRep::setCRLStore(X509_STORE* store)

{

_crlStore = store;

_crlStore.reset(store);

}

Boolean SSLContextRep::isPeerVerificationEnabled() const

Line 1137

Line 1193

return _verifyPeer;

}

SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const

SSLCertificateVerifyFunction*

SSLContextRep::getSSLCertificateVerifyFunction() const

{

return _certificateVerifyFunction;

}

void SSLContextRep::validateCertificate()

{

BIO* in = BIO_new_file(_certPath.getCString(), "r");

PEGASUS_ASSERT(in != NULL);

X509* cert = PEM_read_bio_X509(in, NULL, 0, NULL);

BIO_free(in);

PEGASUS_ASSERT(cert != NULL);

if (X509_cmp_current_time(X509_get_notBefore(cert)) > 0)

{

X509_free(cert);

MessageLoaderParms parms(

"Common.SSLContext.CERTIFICATE_NOT_YET_VALID",

"Certificate $0 is not yet valid.",

_certPath);

throw SSLException(parms);

}

if (X509_cmp_current_time(X509_get_notAfter(cert)) < 0)

{

X509_free(cert);

MessageLoaderParms parms(

"Common.SSLContext.CERTIFICATE_EXPIRED",

"Certificate $0 has expired.",

_certPath);

throw SSLException(parms);

}

X509_free(cert);

}

#else

// these definitions are used if ssl is not available

SSLContextRep::SSLContextRep(const String& trustStore,

SSLContextRep::SSLContextRep(

const String& certPath,

const String&,

const String& keyPath,

const String&,

const String& crlPath,

const String&,

SSLCertificateVerifyFunction* verifyCert,

const String&,

const String& randomFile)

SSLCertificateVerifyFunction*,

{}

const String&,

const Boolean&)

{

}

SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {}

SSLContextRep::SSLContextRep(const SSLContextRep&) {}

SSLContextRep::~SSLContextRep() {}

SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; }

Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx,

Boolean SSLContextRep::_verifyPrivateKey(

const String& keyPath) { return false; }

SSL_CTX*,

const String&)

{

return false;

}

SSL_CTX * SSLContextRep::getContext() const { return 0; }

Line 1173

Line 1269

String SSLContextRep::getKeyPath() const { return String::EMPTY; }

String SSLContextRep::getCipherSuite() const { return String::EMPTY; }

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; }

#endif

String SSLContextRep::getCRLPath() const { return String::EMPTY; }

X509_STORE* SSLContextRep::getCRLStore() const { return NULL; }

SharedPtr<X509_STORE, FreeX509STOREPtr> SSLContextRep::getCRLStore() const

{

return SharedPtr<X509_STORE, FreeX509STOREPtr>();

}

void SSLContextRep::setCRLStore(X509_STORE* store) { }

void SSLContextRep::setCRLStore(X509_STORE*) { }

Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; }

SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; }

SSLCertificateVerifyFunction*

SSLContextRep::getSSLCertificateVerifyFunction() const

void SSLContextRep::init_ssl() {}

{

return NULL;

}

void SSLContextRep::free_ssl() {}

void SSLContextRep::validateCertificate() { }

#endif // end of PEGASUS_HAS_SSL

Line 1205

Line 1308

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, String::EMPTY, verifyCert, randomFile);

_rep = new SSLContextRep(

trustStore,

String::EMPTY,

verifyCert,

randomFile,

String::EMPTY,

false);

}

SSLContext::SSLContext(

Line 1215

Line 1326

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

{

_rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile);

_rep = new SSLContextRep(

trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile);

}

//PEP187

Line 1230

Line 1342

#ifndef PEGASUS_ENABLE_SSL_CRL_VERIFICATION

if ( crlPath.size() > 0 )

{

MessageLoaderParms parms("Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",

MessageLoaderParms parms(

"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",

"SSL CRL verification is not enabled.");

throw Exception(parms);

}

#endif

_rep = new SSLContextRep(trustStore, certPath, keyPath, crlPath, verifyCert, randomFile);

_rep = new SSLContextRep(

trustStore, certPath, keyPath, crlPath, verifyCert, randomFile);

}

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

const String& keyPath,

const String& crlPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile,

const String& cipherSuite,

const Boolean& sslCompatibility)

{

#ifndef PEGASUS_ENABLE_SSL_CRL_VERIFICATION

if (crlPath.size() > 0)

{

MessageLoaderParms parms(

"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",

"SSL CRL verification is not enabled.");

throw Exception(parms);

}

#endif

_rep = new SSLContextRep(

trustStore, certPath, keyPath, crlPath, verifyCert, randomFile,

cipherSuite,sslCompatibility);

}

#endif

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

const String& keyPath,

SSLCertificateVerifyFunction* verifyCert,

String trustStoreUserName,

String,

const String& randomFile)

{

_rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile);

_rep = new SSLContextRep(

trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile);

}

#endif

Line 1268

Line 1409

String SSLContext::getTrustStore() const

{

return (_rep->getTrustStore());

return _rep->getTrustStore();

}

String SSLContext::getCertPath() const

{

return (_rep->getCertPath());

return _rep->getCertPath();

}

String SSLContext::getKeyPath() const

{

return (_rep->getKeyPath());

return _rep->getKeyPath();

}

String SSLContext::getCRLPath() const

{

#ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION

return (_rep->getCRLPath());

return _rep->getCRLPath();

#else

MessageLoaderParms parms("Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",

MessageLoaderParms parms(

"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",

"SSL CRL verification is not enabled.");

throw Exception(parms);

PEGASUS_UNREACHABLE(return String::EMPTY;)

#endif

}

X509_STORE* SSLContext::getCRLStore() const

{

#ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION

return (_rep->getCRLStore());

return _rep->getCRLStore().get();

#else

MessageLoaderParms parms("Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",

MessageLoaderParms parms(

"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",

"SSL CRL verification is not enabled.");

throw Exception(parms);

PEGASUS_UNREACHABLE(return 0;)

#endif

}

Boolean SSLContext::isPeerVerificationEnabled() const

{

return (_rep->isPeerVerificationEnabled());

return _rep->isPeerVerificationEnabled();

}

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

String SSLContext::getTrustStoreUserName() const

{

return (_rep->getTrustStoreUserName());

return _rep->getTrustStoreUserName();

}

#endif

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

String SSLContext::getCipherSuite() const

{

return _rep->getCipherSuite();

}

#endif

SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const

SSLCertificateVerifyFunction*

SSLContext::getSSLCertificateVerifyFunction() const

{

return (_rep->getSSLCertificateVerifyFunction());

return _rep->getSSLCertificateVerifyFunction();

}

void SSLContext::_validateCertificate()

{

_rep->validateCertificate();

}

///////////////////////////////////////////////////////////////////////////////

Line 1364

Line 1522

const int SSLCertificateInfo::V_ERR_APPLICATION_VERIFICATION = 50;

class SSLCertificateInfoRep

{

public:

String subjectName;

String issuerName;

Uint32 depth;

Uint32 errorCode;

Uint32 respCode;

String errorString;

Uint32 versionNumber;

long serialNumber;

CIMDateTime notBefore;

CIMDateTime notAfter;

};

SSLCertificateInfo::SSLCertificateInfo(

const String subjectName,

const String issuerName,

Line 1439

Line 1581

_rep->errorCode = certificateInfo._rep->errorCode;

_rep->errorString = certificateInfo._rep->errorString;

_rep->respCode = certificateInfo._rep->respCode;

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

_rep->peerCertificate = certificateInfo._rep->peerCertificate;

#endif

}

// Dummy constructor made private to disallow default construction

Line 1453

Line 1598

String SSLCertificateInfo::getSubjectName() const

{

return (_rep->subjectName);

return _rep->subjectName;

}

String SSLCertificateInfo::getIssuerName() const

{

return (_rep->issuerName);

return _rep->issuerName;

}

Uint32 SSLCertificateInfo::getVersionNumber() const

{

return (_rep->versionNumber);

return _rep->versionNumber;

}

long SSLCertificateInfo::getSerialNumber() const

{

return (_rep->serialNumber);

return _rep->serialNumber;

}

CIMDateTime SSLCertificateInfo::getNotBefore() const

{

return (_rep->notBefore);

return _rep->notBefore;

}

CIMDateTime SSLCertificateInfo::getNotAfter() const

{

return (_rep->notAfter);

return _rep->notAfter;

}

Uint32 SSLCertificateInfo::getErrorDepth() const

{

return (_rep->depth);

return _rep->depth;

}

Uint32 SSLCertificateInfo::getErrorCode() const

{

return (_rep->errorCode);

return _rep->errorCode;

}

void SSLCertificateInfo::setErrorCode(const int errorCode)

Line 1498

Line 1643

String SSLCertificateInfo::getErrorString() const

{

return (_rep->errorString);

return _rep->errorString;

}

Uint32 SSLCertificateInfo::getResponseCode() const

{

return (_rep->respCode);

return _rep->respCode;

}

void SSLCertificateInfo::setResponseCode(const int respCode)

Line 1511

Line 1656

_rep->respCode = respCode;

}

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

const String &SSLCertificateInfo::getPeerCertificate() const

{

return _rep->peerCertificate;

}

#endif

String SSLCertificateInfo::toString() const

{

char buf[1024];

Line 1525

Line 1677

s.append(_rep->issuerName);

s.append("\n");

sprintf(buf, "Depth: %d\n", _rep->depth);

sprintf(buf, "Depth: %u\n", _rep->depth);

s.append(buf);

sprintf(buf, "Error code: %d\n", _rep->errorCode);

sprintf(buf, "Error code: %u\n", _rep->errorCode);

s.append(buf);

sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode);

sprintf(buf, "Response (preverify) code: %u\n", _rep->respCode);

s.append(buf);

s.append("Error string: ");

s.append(_rep->errorString);

s.append("\n");

sprintf(buf, "Version number: %d\n", _rep->versionNumber);

sprintf(buf, "Version number: %u\n", _rep->versionNumber);

s.append(buf);

sprintf(buf, "Serial number: %lu\n", _rep->serialNumber);

sprintf(buf, "Serial number: %lu\n", (unsigned long)_rep->serialNumber);

s.append(buf);

s.append("Not before date: ");

Line 1568

Line 1720

_rep->crlStore = NULL;

}

SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert, X509_STORE* crlStore)

SSLCallbackInfo::SSLCallbackInfo(

SSLCertificateVerifyFunction* verifyCert,

X509_STORE* crlStore)

{

_rep = new SSLCallbackInfoRep();

_rep->verifyCertificateCallback = verifyCert;

_rep->crlStore = crlStore;

}

SSLCallbackInfo::SSLCallbackInfo(

SSLCertificateVerifyFunction* verifyCert,

X509_STORE* crlStore,

String ipAddress)

{

_rep = new SSLCallbackInfoRep();

_rep->verifyCertificateCallback = verifyCert;

_rep->crlStore = crlStore;

_rep->ipAddress = ipAddress;

}

SSLCallbackInfo::~SSLCallbackInfo()

Legend:

Removed from v.1.72
changed lines
	Added in v.1.116.10.4

No CVS admin address has been configured