version 1.25.6.6, 2004/04/26 14:50:45
|
version 1.72, 2006/08/22 17:49:09
|
|
|
//%2003//////////////////////////////////////////////////////////////////////// |
//%2006//////////////////////////////////////////////////////////////////////// |
// | // |
// Copyright (c) 2000, 2001, 2002 BMC Software, Hewlett-Packard Development |
// Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development |
// Company, L. P., IBM Corp., The Open Group, Tivoli Systems. |
// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems. |
// Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L. P.; | // Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L. P.; |
// IBM Corp.; EMC Corporation, The Open Group. | // IBM Corp.; EMC Corporation, The Open Group. |
|
// Copyright (c) 2004 BMC Software; Hewlett-Packard Development Company, L.P.; |
|
// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group. |
|
// Copyright (c) 2005 Hewlett-Packard Development Company, L.P.; IBM Corp.; |
|
// EMC Corporation; VERITAS Software Corporation; The Open Group. |
|
// Copyright (c) 2006 Hewlett-Packard Development Company, L.P.; IBM Corp.; |
|
// EMC Corporation; Symantec Corporation; The Open Group. |
// | // |
// Permission is hereby granted, free of charge, to any person obtaining a copy | // Permission is hereby granted, free of charge, to any person obtaining a copy |
// of this software and associated documentation files (the "Software"), to | // of this software and associated documentation files (the "Software"), to |
|
|
// Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com) | // Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com) |
// Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com) | // Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com) |
// Heather Sterling, IBM (hsterl@us.ibm.com) | // Heather Sterling, IBM (hsterl@us.ibm.com) |
|
// Amit K Arora, IBM (amita@in.ibm.com) for Bug#1090 |
|
// David Dillard, Symantec Corp. (david_dillard@symantec.com) |
|
// Aruran, IBM (ashanmug@in.ibm.com) for Bug#4422 |
// | // |
//%///////////////////////////////////////////////////////////////////////////// | //%///////////////////////////////////////////////////////////////////////////// |
| |
#ifdef PEGASUS_HAS_SSL | #ifdef PEGASUS_HAS_SSL |
|
|
|
#include <Pegasus/Common/Config.h> |
|
|
|
#include "Network.h" |
|
|
#define OPENSSL_NO_KRB5 1 | #define OPENSSL_NO_KRB5 1 |
#include <openssl/err.h> | #include <openssl/err.h> |
#include <openssl/ssl.h> | #include <openssl/ssl.h> |
|
|
#else | #else |
#define SSL_CTX void | #define SSL_CTX void |
#endif // end of PEGASUS_HAS_SSL | #endif // end of PEGASUS_HAS_SSL |
#include <Pegasus/Common/Destroyer.h> |
|
#include <Pegasus/Common/Socket.h> | #include <Pegasus/Common/Socket.h> |
#include <Pegasus/Common/Tracer.h> | #include <Pegasus/Common/Tracer.h> |
#include <Pegasus/Common/FileSystem.h> | #include <Pegasus/Common/FileSystem.h> |
#include <time.h> | #include <time.h> |
#include <Pegasus/Common/MessageLoader.h> //l10n | #include <Pegasus/Common/MessageLoader.h> //l10n |
|
#include <Pegasus/Common/Formatter.h> |
| |
#include "SSLContext.h" | #include "SSLContext.h" |
#include "SSLContextRep.h" | #include "SSLContextRep.h" |
| |
|
#ifdef PEGASUS_OS_OS400 |
|
#include "SSLWrapperOS400.h" |
|
#endif |
|
|
|
// |
|
// Typedef's for OpenSSL callback functions. |
|
// |
|
extern "C" |
|
{ |
|
typedef void (* CRYPTO_SET_LOCKING_CALLBACK)(int, int, const char *, int); |
|
typedef unsigned long (* CRYPTO_SET_ID_CALLBACK)(void); |
|
}; |
|
|
|
typedef struct x509_store_ctx_st X509_STORE_CTX; |
|
|
typedef struct Timestamp | typedef struct Timestamp |
{ | { |
char year[4]; | char year[4]; |
|
|
| |
PEGASUS_NAMESPACE_BEGIN | PEGASUS_NAMESPACE_BEGIN |
| |
|
const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0; |
|
|
// | // |
// use the following definitions only if SSL is available | // use the following definitions only if SSL is available |
// | // |
#ifdef PEGASUS_HAS_SSL | #ifdef PEGASUS_HAS_SSL |
| |
// |
// Mutex for SSL locks which will get initialized by AutoArrayPtr constructor. |
// certificate handling routine |
AutoArrayPtr<Mutex> SSLContextRep::_sslLocks; |
// |
|
|
|
// ATTN-RK-20020905: This global variable is unsafe with multiple SSL contexts |
|
SSLCertificateVerifyFunction* verify_certificate; |
|
|
|
// Mutex for SSL locks. |
|
Mutex* SSLContextRep::_sslLocks = 0; |
|
| |
// Mutex for _countRep. | // Mutex for _countRep. |
Mutex SSLContextRep::_countRepMutex; | Mutex SSLContextRep::_countRepMutex; |
|
|
Timestamp_t timeStamp; | Timestamp_t timeStamp; |
char tempString[80]; | char tempString[80]; |
char plusOrMinus = '+'; | char plusOrMinus = '+'; |
|
unsigned char* utcTimeData = utcTime->data; |
| |
memset(&time, '\0', sizeof(time)); | memset(&time, '\0', sizeof(time)); |
| |
#define g2(p) ( ( (p)[0] - '0' ) * 10 + (p)[1] - '0' ) | #define g2(p) ( ( (p)[0] - '0' ) * 10 + (p)[1] - '0' ) |
| |
time.tm_year = g2(utcTime->data); |
if (utcTime->type == V_ASN1_GENERALIZEDTIME) |
|
{ |
|
time.tm_year = g2(utcTimeData) * 100; |
|
utcTimeData += 2; // Remaining data is equivalent to ASN1_UTCTIME type |
|
time.tm_year += g2(utcTimeData); |
|
} |
|
else |
|
{ |
|
time.tm_year = g2(utcTimeData); |
if(time.tm_year < 50) | if(time.tm_year < 50) |
{ | { |
time.tm_year += 100; |
time.tm_year += 2000; |
|
} |
|
else |
|
{ |
|
time.tm_year += 1900; |
|
} |
} | } |
time.tm_mon = g2(utcTime->data + 2) - 1; |
|
time.tm_mday = g2(utcTime->data + 4); |
|
time.tm_hour = g2(utcTime->data + 6); |
|
time.tm_min = g2(utcTime->data + 8); |
|
time.tm_sec = g2(utcTime->data + 10); |
|
| |
if(utcTime->data[12] == 'Z') |
time.tm_mon = g2(utcTimeData + 2) - 1; |
|
time.tm_mday = g2(utcTimeData + 4); |
|
time.tm_hour = g2(utcTimeData + 6); |
|
time.tm_min = g2(utcTimeData + 8); |
|
time.tm_sec = g2(utcTimeData + 10); |
|
|
|
if (utcTimeData[12] == 'Z') |
{ | { |
offset = 0; | offset = 0; |
} | } |
else | else |
{ | { |
offset = g2(utcTime->data + 13) * 60 + g2(utcTime->data + 15); |
offset = g2(utcTimeData + 13) * 60 + g2(utcTimeData + 15); |
if(utcTime->data[12] == '-') |
if (utcTimeData[12] == '-') |
{ | { |
plusOrMinus = '-'; | plusOrMinus = '-'; |
} | } |
} | } |
#undef g2 | #undef g2 |
| |
int year = 1900; |
|
memset((void *)&timeStamp, 0, sizeof(Timestamp_t)); | memset((void *)&timeStamp, 0, sizeof(Timestamp_t)); |
| |
// Format the date. | // Format the date. |
sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d", | sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d", |
year + time.tm_year, |
time.tm_year, |
time.tm_mon + 1, | time.tm_mon + 1, |
time.tm_mday, | time.tm_mday, |
time.tm_hour, | time.tm_hour, |
|
|
} | } |
| |
// | // |
|
// Static class used to define C++ callback functions for OpenSSL. |
|
// |
|
class SSLCallback |
|
{ |
|
|
|
public: |
|
static int verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx); |
|
static int verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore); |
|
}; |
|
|
|
// |
|
// Callback function that is called by the OpenSSL library. This function |
|
// checks whether the certificate is listed in any of the CRL's |
|
// |
|
// return 1 if revoked, 0 otherwise |
|
// |
|
int SSLCallback::verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore) |
|
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::verificationCRLCallback"); |
|
|
|
char buf[1024]; |
|
|
|
//check whether a CRL store was specified |
|
if (sslCRLStore == NULL) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: CRL store is NULL"); |
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
|
|
//get the current certificate info |
|
X509* currentCert; |
|
X509_NAME* issuerName; |
|
X509_NAME* subjectName; |
|
ASN1_INTEGER* serialNumber; |
|
|
|
currentCert = X509_STORE_CTX_get_current_cert(ctx); |
|
subjectName = X509_get_subject_name(currentCert); |
|
issuerName = X509_get_issuer_name(currentCert); |
|
serialNumber = X509_get_serialNumber(currentCert); |
|
|
|
//log certificate information |
|
//this is information in the "public" key, so it does no harm to log it |
|
X509_NAME_oneline(issuerName, buf, sizeof(buf)); |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Certificate Data: Issuer/Subject"); |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, buf); |
|
X509_NAME_oneline(subjectName, buf, sizeof(buf)); |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, buf); |
|
|
|
//initialize the CRL store |
|
X509_STORE_CTX crlStoreCtx; |
|
X509_STORE_CTX_init(&crlStoreCtx, sslCRLStore, NULL, NULL); |
|
|
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Initialized CRL store"); |
|
|
|
//attempt to get a CRL issued by the certificate's issuer |
|
X509_OBJECT obj; |
|
if (X509_STORE_get_by_subject(&crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: No CRL by that issuer"); |
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
X509_STORE_CTX_cleanup(&crlStoreCtx); |
|
|
|
//get CRL |
|
X509_CRL* crl = obj.data.crl; |
|
if (crl == NULL) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL is null"); |
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} else |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Found CRL by that issuer"); |
|
} |
|
|
|
//get revoked certificates |
|
STACK_OF(X509_REVOKED)* revokedCerts = NULL; |
|
revokedCerts = X509_CRL_get_REVOKED(crl); |
|
int numRevoked = sk_X509_REVOKED_num(revokedCerts); |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4,"---> SSL: Number of certificates revoked by the issuer %d\n", numRevoked); |
|
|
|
//check whether the subject's certificate is revoked |
|
X509_REVOKED* revokedCert = NULL; |
|
for (int i = 0; i < sk_X509_REVOKED_num(revokedCerts); i++) |
|
{ |
|
revokedCert = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i); |
|
|
|
//a matching serial number indicates revocation |
|
if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, "---> SSL: Certificate is revoked"); |
|
X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED); |
|
PEG_METHOD_EXIT(); |
|
return 1; |
|
} |
|
} |
|
|
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: Certificate is not revoked at this level"); |
|
|
|
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
|
|
// |
// Callback function that is called by the OpenSSL library. This function | // Callback function that is called by the OpenSSL library. This function |
// extracts X509 certficate information and pass that on to client application | // extracts X509 certficate information and pass that on to client application |
// callback function. | // callback function. |
|
// We HAVE to build the certificate in all cases since it's needed to get the associated username out of the repository |
|
// later in the transaction |
// | // |
int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "prepareForCallback()"); |
PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::callback()"); |
| |
char buf[256]; | char buf[256]; |
X509 *currentCert; | X509 *currentCert; |
|
SSL *ssl; |
int verifyError = X509_V_OK; | int verifyError = X509_V_OK; |
|
int revoked = -1; |
| |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
// if the SSLContext does not have an additional callback |
"--->SSL: Preverify Error %d", verifyError); |
// simply return the preverification error |
|
// we do not need to go through the additional steps |
// |
if (verify_certificate == NULL) |
// get the verification callback info specific to each SSL connection |
|
// |
|
ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); |
|
SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX); |
|
|
|
|
|
#ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
|
// |
|
// Check to see if a CRL path is defined |
|
// |
|
if (exData->_rep->crlStore != NULL) |
{ | { |
return (preVerifyOk); |
revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_rep->crlStore); |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL callback returned %d", revoked); |
|
|
|
if (revoked) //with the SSL callbacks '0' indicates failure |
|
{ |
|
PEG_METHOD_EXIT(); |
|
return 0; |
} | } |
|
} |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL callback returned %d", revoked); |
#endif | #endif |
| |
// | // |
|
|
// | // |
int depth = X509_STORE_CTX_get_error_depth(ctx); | int depth = X509_STORE_CTX_get_error_depth(ctx); |
| |
//FUTURE: Not sure what to do with these...? |
|
//ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); |
|
//mydata = SSL_get_ex_data(ssl, mydata_index); |
|
|
|
// | // |
// get the version on the certificate | // get the version on the certificate |
// | // |
|
|
// | // |
if (!preVerifyOk) | if (!preVerifyOk) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"---> SSL: certificate default verification error: " + errorStr); |
"---> SSL: certificate default verification error: %s", (const char*)errorStr.getCString()); |
} | } |
| |
// | // |
// get the issuer name on the certificate | // get the issuer name on the certificate |
// | // |
if (!preVerifyOk && (errorCode == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)) |
|
{ |
|
X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, 256); |
|
} |
|
else |
|
{ |
|
X509_NAME_oneline(X509_get_issuer_name(currentCert), buf, 256); | X509_NAME_oneline(X509_get_issuer_name(currentCert), buf, 256); |
} |
|
String issuerName = String(buf); | String issuerName = String(buf); |
| |
// | // |
// Call the verify_certificate() application callback |
// Create the certificate object |
// | // |
SSLCertificateInfo certInfo(subjectName, issuerName, version, serialNumber, |
|
notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk); |
|
| |
if (verify_certificate(certInfo)) |
//insert at the beginning of the array so that the peer certificate is first and the root CA is last |
{ |
exData->_rep->peerCertificate.insert(0, new SSLCertificateInfo(subjectName, issuerName, version, serialNumber, |
#ifndef PEGASUS_USE_232_CLIENT_VERIFICATION |
notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk)); |
verifyError = X509_V_OK; |
|
#endif |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "Created SSLCertificateInfo"); |
preVerifyOk = 1; |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
// NOT_YET_VALID checks do not work correctly on subsequent tries -- Bugzilla#4283 |
"--> SSL: verify_certificate() returned X509_V_OK"); |
// call this prior to calling the user-specified callback in case they want to override it |
} |
if (errorCode == X509_V_OK && (CIMDateTime::getDifference(CIMDateTime::getCurrentDateTime(), notBefore) > 0)) |
else |
|
{ | { |
#ifndef PEGASUS_USE_232_CLIENT_VERIFICATION |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, "Certificate was not yet valid."); |
verifyError = certInfo.getErrorCode(); |
X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_NOT_YET_VALID); |
#endif |
|
preVerifyOk = 0; |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"--> SSL: verify_certificate() returned error %d", verifyError); |
|
} | } |
| |
// We need a way for the server to retain the verification result, |
|
// so that in 'optional' settings, we can still continue the connection. |
|
// We can then give the verification result to a consumer and let them |
|
// decide whether to accept or reject the request. |
|
// |
|
// The problem is that if we don't reset the error, the server verification |
|
// gets messed up on the client side. |
|
// |
|
// If SSL client verification is disabled, do things the old way, |
|
// since the server will never even use the callback. |
|
// |
|
// If SSL client verification is enabled, do not set the error code explicitly. |
|
// Instead, require the client to set the error code within its callback. |
|
// i.e. |
|
// Boolean verifyCertificate(SSLCertificateInfo cert) |
|
// { |
|
// cert.setErrorCode(SSLCertificateInfo::V_OK); |
|
// return true; |
|
// } |
|
// |
|
// If clients do not do this w/ PEGASUS_USE_232_CLIENT_VERIFICATION enabled, |
|
// the server verification will fail because the error code will be the original result. |
|
// This is sort of a kluge, but I cannot figure out a better way to do this w/o |
|
// some storage tactic. |
|
// | // |
// This will definitely be fixed in 2.4. For 2.3.2, it shouldn't matter since we |
// Call the user-specified application callback if it is specified. If it is null, return OpenSSL's verification code. |
// are not using server verification. |
// Note that the verification result does not automatically get set to X509_V_OK if the callback is successful. |
|
// This is because OpenSSL retains the original default error in case we want to use it later. |
|
// To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here. |
|
// |
|
if (exData->_rep->verifyCertificateCallback == NULL) |
|
{ |
|
return preVerifyOk; |
| |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
} else |
X509_STORE_CTX_set_error(ctx, certInfo.getErrorCode()); |
{ |
#else |
if (exData->_rep->verifyCertificateCallback(*exData->_rep->peerCertificate[0])) |
X509_STORE_CTX_set_error(ctx, verifyError); |
{ |
#endif |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"--> SSL: _rep->verifyCertificateCallback() returned X509_V_OK"); |
| |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
|
return 1; |
|
} |
|
else // verification failed, handshake will be immediately terminated |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"--> SSL: _rep->verifyCertificateCallback() returned error %d", exData->_rep->peerCertificate[0]->getErrorCode()); |
| |
return(preVerifyOk); |
PEG_METHOD_EXIT(); |
|
return 0; |
|
} |
|
} |
|
} |
|
|
|
// |
|
// Callback function called by OpenSSL. This request is merely forwarded to the static |
|
// function SSLCallback::callback(). The SSLCallback class is a friend class of the |
|
// Pegasus SSL related classes needed to complete the callback. |
|
// |
|
extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx) |
|
{ |
|
return SSLCallback::verificationCallback(preVerifyOk, ctx); |
} | } |
| |
// | // |
|
|
if ( mode & CRYPTO_LOCK ) | if ( mode & CRYPTO_LOCK ) |
{ | { |
/*Tracer::trace(TRC_SSL, Tracer::LEVEL4, | /*Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Now locking for %d", pegasus_thread_self());*/ |
"Now locking for %d", Threads::id());*/ |
SSLContextRep::_sslLocks[type].lock( pegasus_thread_self() ); |
SSLContextRep::_sslLocks.get()[type].lock( ); |
} | } |
else | else |
{ | { |
/*Tracer::trace(TRC_SSL, Tracer::LEVEL4, | /*Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Now unlocking for %d", pegasus_thread_self());*/ |
"Now unlocking for %d", Threads::id());*/ |
SSLContextRep::_sslLocks[type].unlock( ); |
SSLContextRep::_sslLocks.get()[type].unlock( ); |
} | } |
} | } |
| |
|
static unsigned long _get_thread_id() |
|
{ |
|
#if defined(PEGASUS_HAVE_PTHREADS) |
|
return pthread_self(); |
|
#else |
|
return 0; |
|
#endif |
|
} |
|
|
// | // |
// Initialize OpenSSL Locking and id callbacks. | // Initialize OpenSSL Locking and id callbacks. |
// | // |
|
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, | PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
"Initialized SSL callback."); | "Initialized SSL callback."); |
| |
_sslLocks= new Mutex[CRYPTO_num_locks()]; |
#ifdef PEGASUS_OS_OS400 |
|
// Load the OpenSSL library and get the exports |
|
SSL_OS400_Init(); |
|
#endif |
|
|
|
_sslLocks.reset(new Mutex[CRYPTO_num_locks()]); |
| |
// Set the ID callback. The ID callback returns a thread ID. | // Set the ID callback. The ID callback returns a thread ID. |
| |
CRYPTO_set_id_callback((unsigned long (*)())pegasus_thread_self); |
CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK)_get_thread_id); |
| |
// Set the locking callback to pegasus_locking_callback. | // Set the locking callback to pegasus_locking_callback. |
| |
CRYPTO_set_locking_callback((void (*)(int,int,const char *,int))pegasus_locking_callback); |
CRYPTO_set_locking_callback((CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback); |
| |
} | } |
| |
|
|
CRYPTO_set_id_callback (NULL); | CRYPTO_set_id_callback (NULL); |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, | PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
"Freed SSL callback."); | "Freed SSL callback."); |
|
_sslLocks.reset(); |
delete []_sslLocks; |
|
} | } |
| |
| |
|
|
// For the OSs that don't have /dev/random device file, | // For the OSs that don't have /dev/random device file, |
// must enable PEGASUS_SSL_RANDOMFILE flag. | // must enable PEGASUS_SSL_RANDOMFILE flag. |
// | // |
SSLContextRep::SSLContextRep(const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile) |
|
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
|
|
|
_trustStore = trustStore.getCString(); |
|
|
|
_certPath = certPath.getCString(); |
|
|
|
_keyPath = keyPath.getCString(); |
|
|
|
verify_certificate = verifyCert; |
|
|
|
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
|
_countRepMutex.lock(pegasus_thread_self()); |
|
|
|
try |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Value of Countrep in constructor %d", _countRep); |
|
if ( _countRep == 0 ) |
|
{ |
|
init_ssl(); |
|
|
|
// |
|
// load SSL library |
|
// |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Before calling SSL_load_error_strings %d", pegasus_thread_self()); |
|
|
|
SSL_load_error_strings(); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"After calling SSL_load_error_strings %d", pegasus_thread_self()); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"Before calling SSL_library_init %d", pegasus_thread_self()); |
|
|
|
SSL_library_init(); |
|
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
|
"After calling SSL_library_init %d", pegasus_thread_self()); |
|
|
|
} |
|
} |
|
catch(...) |
|
{ |
|
_countRepMutex.unlock(); |
|
throw; |
|
} |
|
_countRep++; |
|
_countRepMutex.unlock(); |
|
|
|
_randomInit(randomFile); |
|
|
|
_sslContext = _makeSSLContext(); |
|
|
|
PEG_METHOD_EXIT(); |
|
} |
|
|
|
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
|
SSLContextRep::SSLContextRep( | SSLContextRep::SSLContextRep( |
const String& trustStore, | const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
|
const String& crlPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
Boolean trustStoreAutoUpdate, |
|
Boolean failIfNoPeerCert, |
|
const String& randomFile) | const String& randomFile) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
| |
_trustStore = trustStore.getCString(); |
_trustStore = trustStore; |
| |
_certPath = certPath.getCString(); |
_certPath = certPath; |
| |
_keyPath = keyPath.getCString(); |
_keyPath = keyPath; |
| |
verify_certificate = verifyCert; |
_crlPath = crlPath; |
| |
_trustStoreAutoUpdate = trustStoreAutoUpdate; |
_crlStore = NULL; |
| |
_failIfNoPeerCert = failIfNoPeerCert; |
_certificateVerifyFunction = verifyCert; |
| |
// if no truststore is specified and no callback is specified, |
// |
// do not enable peer verification |
// If a truststore and/or peer verification function is specified, enable peer verification |
|
// |
if (trustStore != String::EMPTY || verifyCert != NULL) | if (trustStore != String::EMPTY || verifyCert != NULL) |
{ | { |
_verifyPeer = true; | _verifyPeer = true; |
|
|
_verifyPeer = false; | _verifyPeer = false; |
} | } |
| |
|
// |
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. | // Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
_countRepMutex.lock(pegasus_thread_self()); |
// |
|
|
try |
|
{ | { |
|
AutoMutex autoMut(_countRepMutex); |
|
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Value of Countrep in constructor %d", _countRep); | "Value of Countrep in constructor %d", _countRep); |
if ( _countRep == 0 ) | if ( _countRep == 0 ) |
|
|
// load SSL library | // load SSL library |
// | // |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Before calling SSL_load_error_strings %d", pegasus_thread_self()); |
"Before calling SSL_load_error_strings %d", Threads::id()); |
| |
SSL_load_error_strings(); | SSL_load_error_strings(); |
| |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"After calling SSL_load_error_strings %d", pegasus_thread_self()); |
"After calling SSL_load_error_strings %d", Threads::id()); |
| |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Before calling SSL_library_init %d", pegasus_thread_self()); |
"Before calling SSL_library_init %d", Threads::id()); |
| |
SSL_library_init(); | SSL_library_init(); |
| |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"After calling SSL_library_init %d", pegasus_thread_self()); |
"After calling SSL_library_init %d", Threads::id()); |
|
|
} |
|
} |
|
catch(...) |
|
{ |
|
_countRepMutex.unlock(); |
|
throw; |
|
} | } |
|
|
_countRep++; | _countRep++; |
_countRepMutex.unlock(); |
} // mutex unlocks here |
| |
_randomInit(randomFile); | _randomInit(randomFile); |
| |
|
|
| |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
} | } |
#endif |
|
| |
SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) | SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) |
{ | { |
|
|
_trustStore = sslContextRep._trustStore; | _trustStore = sslContextRep._trustStore; |
_certPath = sslContextRep._certPath; | _certPath = sslContextRep._certPath; |
_keyPath = sslContextRep._keyPath; | _keyPath = sslContextRep._keyPath; |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
_crlPath = sslContextRep._crlPath; |
|
_crlStore = sslContextRep._crlStore; |
_verifyPeer = sslContextRep._verifyPeer; | _verifyPeer = sslContextRep._verifyPeer; |
_trustStoreAutoUpdate = sslContextRep._trustStoreAutoUpdate; |
_certificateVerifyFunction = sslContextRep._certificateVerifyFunction; |
_failIfNoPeerCert = sslContextRep._failIfNoPeerCert; |
|
#endif |
|
|
|
// ATTN: verify_certificate is set implicitly in global variable |
|
_randomFile = sslContextRep._randomFile; | _randomFile = sslContextRep._randomFile; |
| |
// Initialiaze SSL callbacks and increment the SSLContextRep object _counter. | // Initialiaze SSL callbacks and increment the SSLContextRep object _counter. |
_countRepMutex.lock(pegasus_thread_self()); |
|
try |
|
{ | { |
|
AutoMutex autoMut(_countRepMutex); |
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Value of Countrep in copy constructor %d", _countRep); | "Value of Countrep in copy constructor %d", _countRep); |
if ( _countRep == 0 ) | if ( _countRep == 0 ) |
{ | { |
init_ssl(); | init_ssl(); |
} | } |
} |
|
catch(...) |
|
{ |
|
_countRepMutex.unlock(); |
|
throw; |
|
} |
|
_countRep++; | _countRep++; |
_countRepMutex.unlock(); |
} // mutex unlocks here |
| |
_sslContext = _makeSSLContext(); | _sslContext = _makeSSLContext(); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
|
|
SSL_CTX_free(_sslContext); | SSL_CTX_free(_sslContext); |
| |
// Decrement the SSLContextRep object _counter. | // Decrement the SSLContextRep object _counter. |
_countRepMutex.lock(pegasus_thread_self()); |
{ |
|
AutoMutex autoMut(_countRepMutex); |
_countRep--; | _countRep--; |
// Free SSL locks if no instances of SSLContextRep exist. | // Free SSL locks if no instances of SSLContextRep exist. |
try |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL4, | Tracer::trace(TRC_SSL, Tracer::LEVEL4, |
"Value of Countrep in destructor %d", _countRep); | "Value of Countrep in destructor %d", _countRep); |
if ( _countRep == 0 ) | if ( _countRep == 0 ) |
{ | { |
free_ssl(); | free_ssl(); |
} | } |
|
|
} | } |
catch(...) |
|
{ |
|
_countRepMutex.unlock(); |
|
throw; |
|
} |
|
_countRepMutex.unlock(); |
|
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
} | } |
| |
|
|
Boolean ret; | Boolean ret; |
int retVal = 0; | int retVal = 0; |
| |
const int DEV_RANDOM_BYTES = 64; /* how many bytes to read */ |
|
const String devRandom = "/dev/random"; /* random device name */ |
|
const String devUrandom = "/dev/urandom"; /* pseudo-random device name */ |
|
|
|
#ifdef PEGASUS_SSL_DEVRANDOM |
|
|
|
if ( FileSystem::exists(devRandom) ) |
|
{ |
|
while ( RAND_status() == 0 ) |
|
{ |
|
// |
|
// Always attempt to seed from good entropy sources, first |
|
// try /dev/random |
|
// |
|
retVal = RAND_load_file(devRandom.getCString(), DEV_RANDOM_BYTES); |
|
if (retVal <= 0) |
|
{ |
|
break; |
|
} |
|
} |
|
} |
|
|
|
if ( FileSystem::exists(devUrandom) ) |
|
{ |
|
while ( RAND_status() == 0 ) |
|
{ |
|
// |
|
// If there isn't /dev/random try /dev/urandom |
|
// |
|
retVal = RAND_load_file(devUrandom.getCString(), DEV_RANDOM_BYTES); |
|
if (retVal <= 0) |
|
{ |
|
break; |
|
} |
|
} |
|
} |
|
#endif /* PEGASUS_SSL_DEVRANDOM */ |
|
|
|
|
|
#ifdef PEGASUS_SSL_RANDOMFILE | #ifdef PEGASUS_SSL_RANDOMFILE |
if ( RAND_status() == 0 ) | if ( RAND_status() == 0 ) |
{ | { |
|
|
// Try to do more seeding | // Try to do more seeding |
// | // |
long seedNumber; | long seedNumber; |
#if defined(PEGASUS_PLATFORM_WIN32_IX86_MSVC) |
#if defined(PEGASUS_COMPILER_MSVC) |
srand((unsigned int)time(NULL)); // Initialize | srand((unsigned int)time(NULL)); // Initialize |
seedNumber = rand(); | seedNumber = rand(); |
#else | #else |
|
|
| |
SSL_CTX_set_quiet_shutdown(sslContext, 1); | SSL_CTX_set_quiet_shutdown(sslContext, 1); |
SSL_CTX_set_mode(sslContext, SSL_MODE_AUTO_RETRY); | SSL_CTX_set_mode(sslContext, SSL_MODE_AUTO_RETRY); |
SSL_CTX_set_options(sslContext,SSL_OP_ALL); |
SSL_CTX_set_mode(sslContext, SSL_MODE_ENABLE_PARTIAL_WRITE); |
SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF); | SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF); |
| |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
int options = SSL_OP_ALL; |
|
#ifndef PEGASUS_ENABLE_SSLV2 //SSLv2 is disabled by default |
|
options |= SSL_OP_NO_SSLv2; |
|
#endif |
|
SSL_CTX_set_options(sslContext, options); |
|
|
if (_verifyPeer) | if (_verifyPeer) |
{ | { |
// If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be terminated if the client sends no certificate |
//ATTN: We might still need a flag to specify SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
// or sends an untrusted certificate. The callback function is not called in this case; the handshake is simply terminated. |
// If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be terminated |
|
// if the client sends no certificate or sends an untrusted certificate. The |
|
// callback function is not called in this case; the handshake is simply terminated. |
// This value has NO effect in from a client perspective | // This value has NO effect in from a client perspective |
if (_failIfNoPeerCert) |
|
{ |
if (_certificateVerifyFunction != NULL) |
SSL_CTX_set_verify(sslContext, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, prepareForCallback); |
|
} |
|
else |
|
{ | { |
SSL_CTX_set_verify(sslContext, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback); |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
} |
"---> SSL: certificate verification callback specified"); |
|
SSL_CTX_set_verify(sslContext, |
|
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback); |
} | } |
else | else |
{ | { |
SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL); |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: Trust Store specified"); |
|
SSL_CTX_set_verify(sslContext, |
|
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, |
|
prepareForCallback); |
} | } |
#else |
|
if (verify_certificate != NULL || (strncmp(_trustStore, "", 1) != 0)) |
|
{ |
|
SSL_CTX_set_verify(sslContext, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback); |
|
} | } |
else | else |
{ | { |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Trust Store and certificate verification callback are NOT specified"); |
SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL); | SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL); |
} | } |
#endif |
|
| |
// | // |
// Check if there is CA certificate file specified. If specified, |
// Check if there is CA certificate file or directory specified. If specified, |
// load the certificates from the file in to the CA trust store. |
// and is not empty, load the certificates from the Trust store. |
// | // |
if (strncmp(_trustStore, "", 1) != 0) |
if (_trustStore != String::EMPTY) |
{ | { |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
|
// | // |
// The truststore may be a single file of CA certificates OR | // The truststore may be a single file of CA certificates OR |
// a directory containing multiple CA certificates. | // a directory containing multiple CA certificates. |
// Check which one it is, and call the load_verify_locations function | // Check which one it is, and call the load_verify_locations function |
// with the appropriate parameter. Note: It is possible to have both | // with the appropriate parameter. Note: It is possible to have both |
// options, in which the CA file takes precedence over the CA path. |
// options, in which case the CA file takes precedence over the CA path. |
// However, since there is currently only one trust parameter to the | // However, since there is currently only one trust parameter to the |
// SSL functions, only allow one choice here. | // SSL functions, only allow one choice here. |
// modified by hns for client ssl auth |
// |
const char* CA_Directory = NULL; |
if (FileSystem::isDirectory(_trustStore)) |
const char* CA_File = NULL; |
|
|
|
if (FileSystem::isDirectory((const char*)_trustStore)) |
|
{ | { |
CA_Directory = _trustStore; |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,"Truststore is a directory"); |
"---> SSL: Truststore is a directory"); |
|
// |
|
// load certificates from the trust store |
|
// |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Loading certificates from the trust store: " + _trustStore); |
| |
} else if (FileSystem::exists((const char*)_trustStore)) //ATTN: need to do nocase? |
if ((!SSL_CTX_load_verify_locations(sslContext, NULL, _trustStore.getCString())) || |
|
(!SSL_CTX_set_default_verify_paths(sslContext))) |
{ | { |
CA_File = _trustStore; |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,"Truststore is a file"); |
"---> SSL: Could not load certificates from the trust store: " + _trustStore); |
|
//l10n |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
|
"Could not load certificates in to trust store."); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
} | } |
#endif |
|
|
} |
|
else if (FileSystem::exists(_trustStore)) |
|
{ |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Truststore is a file"); |
// | // |
// load certificates in to trust store |
// Get size of the trust store file: |
// | // |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
Uint32 fileSize = 0; |
if ((!SSL_CTX_load_verify_locations(sslContext, CA_File, CA_Directory)) || |
|
#else |
FileSystem::getFileSize(_trustStore, fileSize); |
if ((!SSL_CTX_load_verify_locations(sslContext, _trustStore, NULL)) || |
|
#endif |
if (fileSize > 0) |
|
{ |
|
// |
|
// load certificates from the trust store |
|
// |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Loading certificates from the trust store: " + _trustStore); |
|
|
|
if ((!SSL_CTX_load_verify_locations(sslContext, _trustStore.getCString(), NULL)) || |
(!SSL_CTX_set_default_verify_paths(sslContext))) | (!SSL_CTX_set_default_verify_paths(sslContext))) |
{ | { |
PEG_METHOD_EXIT(); |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Could not load certificates from the trust store: " + _trustStore); |
//l10n | //l10n |
//throw( SSLException("Could not load certificates in to trust store.")); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", | MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES", |
"Could not load certificates in to trust store."); | "Could not load certificates in to trust store."); |
|
PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
} | } |
|
else |
|
{ |
|
// |
|
// no certificates found in the trust store |
|
// |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: No certificates to load from the trust store: " + _trustStore); |
|
} |
|
} |
|
} |
|
|
|
if (_crlPath != String::EMPTY) |
|
{ |
|
//need to save this -- can we make it static since there's only one CRL for cimserver? |
|
X509_LOOKUP* pLookup; |
|
|
|
_crlStore = X509_STORE_new(); |
|
|
|
//the validity of the crlstore was checked in ConfigManager during server startup |
|
if (FileSystem::isDirectory(_crlPath)) |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: CRL store is a directory in %s", (const char*)_crlPath.getCString()); |
|
|
|
if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_hash_dir())) == NULL) |
|
{ |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS", |
|
"Could not load certificate revocation list."); |
|
X509_STORE_free(_crlStore); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
|
|
X509_LOOKUP_add_dir(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM); |
|
|
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Successfully configured CRL directory"); |
|
|
|
} else |
|
{ |
|
Tracer::trace(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: CRL store is the file %s", (const char*)_crlPath.getCString()); |
|
|
|
if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_file())) == NULL) |
|
{ |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS", |
|
"Could not load certificate revocation list."); |
|
X509_STORE_free(_crlStore); |
|
PEG_METHOD_EXIT(); |
|
throw SSLException(parms); |
|
} |
|
|
|
X509_LOOKUP_load_file(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM); |
|
|
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
|
"---> SSL: Successfully configured CRL file"); |
|
} |
|
} |
| |
Boolean keyLoaded = false; | Boolean keyLoaded = false; |
|
|
// | // |
// Check if there is a certificate file (file containing server | // Check if there is a certificate file (file containing server |
// certificate) specified. If specified, validate and load the | // certificate) specified. If specified, validate and load the |
// certificate. | // certificate. |
// | // |
if (strncmp(_certPath, "", 1) != 0) |
if (_certPath != String::EMPTY) |
{ | { |
// | // |
// load the specified server certificates | // load the specified server certificates |
// | // |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
|
"---> SSL: Loading server certificate from: " + _certPath); |
| |
if (SSL_CTX_use_certificate_file(sslContext, | if (SSL_CTX_use_certificate_file(sslContext, |
_certPath, SSL_FILETYPE_PEM) <=0) |
_certPath.getCString(), SSL_FILETYPE_PEM) <=0) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: no certificate found in " + String(_certPath)); |
"---> SSL: No server certificate found in " + _certPath); |
PEG_METHOD_EXIT(); |
|
//l10n |
|
//throw( SSLException("Could not get server certificate.")); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE", | MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE", |
"Could not get server certificate."); | "Could not get server certificate."); |
|
PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
| |
// | // |
// If there is no key file (file containing server | // If there is no key file (file containing server |
// private key) specified or the specified file does not exist, |
// private key) specified, then try loading the key from the certificate file. |
// then try loading the key from the certificate file. |
// As of 2.4, if a keyfile is specified, its location is verified during server |
|
// startup and will throw an error if the path is invalid. |
// | // |
if ( strncmp(_keyPath, "", 1) == 0 || |
if (_keyPath == String::EMPTY) |
!FileSystem::exists(String(_keyPath)) ) |
|
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: loading key from" + String(_certPath)); |
"---> SSL: loading private key from: " + _certPath); |
// | // |
// load the private key and check for validity | // load the private key and check for validity |
// | // |
if (!_verifyPrivateKey(sslContext, _certPath)) | if (!_verifyPrivateKey(sslContext, _certPath)) |
{ | { |
PEG_METHOD_EXIT(); |
|
//l10n |
|
//throw( SSLException("Could not get private key.")); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", | MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", |
"Could not get private key."); | "Could not get private key."); |
|
PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
keyLoaded = true; | keyLoaded = true; |
|
|
// private key) specified and the key was not already loaded. | // private key) specified and the key was not already loaded. |
// If specified, validate and load the key. | // If specified, validate and load the key. |
// | // |
if (strncmp(_keyPath, "", 1) != 0 && !keyLoaded) |
if (_keyPath != String::EMPTY && !keyLoaded) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: loading key from" + String(_keyPath)); |
"---> SSL: loading private key from: " + _keyPath); |
// | // |
// load given private key and check for validity | // load given private key and check for validity |
// | // |
if (!_verifyPrivateKey(sslContext, _keyPath)) | if (!_verifyPrivateKey(sslContext, _keyPath)) |
{ | { |
PEG_METHOD_EXIT(); |
|
//l10n |
|
//throw( SSLException("Could not get private key.")); |
|
MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", | MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY", |
"Could not get private key."); | "Could not get private key."); |
|
PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
keyLoaded = true; | keyLoaded = true; |
|
|
return sslContext; | return sslContext; |
} | } |
| |
Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, const char *keyPath) |
Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, const String& keyPath) |
{ | { |
PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()"); | PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()"); |
| |
if (SSL_CTX_use_PrivateKey_file(ctx, keyPath, SSL_FILETYPE_PEM) <= 0) |
if (SSL_CTX_use_PrivateKey_file(ctx, keyPath.getCString(), SSL_FILETYPE_PEM) <= 0) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: no private key found in " + String(keyPath)); | "---> SSL: no private key found in " + String(keyPath)); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return false; | return false; |
|
|
| |
if (!SSL_CTX_check_private_key(ctx)) | if (!SSL_CTX_check_private_key(ctx)) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: Private and public key do not match"); | "---> SSL: Private and public key do not match"); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return false; | return false; |
|
|
return _sslContext; | return _sslContext; |
} | } |
| |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
String SSLContextRep::getTrustStore() const |
CString SSLContextRep::getTrustStore() const |
|
{ | { |
return _trustStore; | return _trustStore; |
} | } |
| |
CString SSLContextRep::getCertPath() const |
String SSLContextRep::getCertPath() const |
{ | { |
return _certPath; | return _certPath; |
} | } |
| |
CString SSLContextRep::getKeyPath() const |
String SSLContextRep::getKeyPath() const |
{ | { |
return _keyPath; | return _keyPath; |
} | } |
| |
|
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
|
String SSLContextRep::getTrustStoreUserName() const |
|
{ |
|
return String::EMPTY; |
|
} |
|
#endif |
|
|
|
String SSLContextRep::getCRLPath() const |
|
{ |
|
return _crlPath; |
|
} |
|
|
|
X509_STORE* SSLContextRep::getCRLStore() const |
|
{ |
|
return _crlStore; |
|
} |
|
|
|
void SSLContextRep::setCRLStore(X509_STORE* store) |
|
{ |
|
_crlStore = store; |
|
} |
|
|
Boolean SSLContextRep::isPeerVerificationEnabled() const | Boolean SSLContextRep::isPeerVerificationEnabled() const |
{ | { |
return _verifyPeer; | return _verifyPeer; |
} | } |
| |
Boolean SSLContextRep::isTrustStoreAutoUpdateEnabled() const |
SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const |
{ | { |
return _trustStoreAutoUpdate; |
return _certificateVerifyFunction; |
} | } |
| |
#endif |
|
|
|
#else | #else |
| |
// | // |
|
|
SSLContextRep::SSLContextRep(const String& trustStore, | SSLContextRep::SSLContextRep(const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
|
const String& crlPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) {} |
const String& randomFile) |
|
{} |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
|
SSLContextRep::SSLContextRep(const String& trustStore, |
|
const String& certPath, |
|
const String& keyPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
Boolean trustStoreAutoUpdate, |
|
Boolean failIfNoPeerCert, |
|
const String& randomFile) {} |
|
#endif |
|
| |
SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {} | SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {} |
| |
|
|
SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; } | SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; } |
| |
Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, | Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx, |
const char *keyPath) { return false; } |
const String& keyPath) { return false; } |
| |
SSL_CTX * SSLContextRep::getContext() const { return 0; } | SSL_CTX * SSLContextRep::getContext() const { return 0; } |
| |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
String SSLContextRep::getTrustStore() const { return String::EMPTY; } |
CString SSLContextRep::getTrustStore() const { return String::EMPTY.getCString(); } |
|
|
String SSLContextRep::getCertPath() const { return String::EMPTY; } |
| |
CString SSLContextRep::getCertPath() const { return String::EMPTY.getCString(); } |
String SSLContextRep::getKeyPath() const { return String::EMPTY; } |
|
|
|
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
|
String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; } |
|
#endif |
| |
CString SSLContextRep::getKeyPath() const { return String::EMPTY.getCString(); } |
String SSLContextRep::getCRLPath() const { return String::EMPTY; } |
|
|
|
X509_STORE* SSLContextRep::getCRLStore() const { return NULL; } |
|
|
|
void SSLContextRep::setCRLStore(X509_STORE* store) { } |
| |
Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } | Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } |
| |
Boolean SSLContextRep::isTrustStoreAutoUpdateEnabled() const { return false; } |
SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; } |
#endif |
|
| |
void SSLContextRep::init_ssl() {} | void SSLContextRep::init_ssl() {} |
| |
|
|
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) | const String& randomFile) |
{ | { |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, String::EMPTY, verifyCert, randomFile); |
_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, verifyCert, false, false, randomFile); |
|
#else |
|
_rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, verifyCert, randomFile); |
|
#endif |
|
} |
|
|
|
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
|
SSLContext::SSLContext( |
|
const String& certPath, |
|
SSLCertificateVerifyFunction* verifyCert, |
|
const String& randomFile, |
|
Boolean isCIMClient) |
|
{ |
|
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
|
_rep = new SSLContextRep(certPath, String::EMPTY, String::EMPTY, verifyCert, false, false, randomFile); |
|
#else |
|
_rep = new SSLContextRep(certPath, String::EMPTY, String::EMPTY, verifyCert, randomFile); |
|
#endif |
|
} | } |
| |
SSLContext::SSLContext( | SSLContext::SSLContext( |
|
const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& certKeyPath, |
const String& keyPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) | const String& randomFile) |
{ | { |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
_rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile); |
_rep = new SSLContextRep(certPath, certKeyPath, String::EMPTY, verifyCert, false, false, randomFile); |
|
#else |
|
_rep = new SSLContextRep(certPath, certKeyPath, String::EMPTY, verifyCert, randomFile); |
|
#endif |
|
} | } |
#endif |
|
| |
|
//PEP187 |
SSLContext::SSLContext( | SSLContext::SSLContext( |
const String& trustStore, | const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
|
const String& crlPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
const String& randomFile) | const String& randomFile) |
{ | { |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
#ifndef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, false, false, randomFile); |
if ( crlPath.size() > 0 ) |
#else |
{ |
_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, randomFile); |
MessageLoaderParms parms("Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", |
|
"SSL CRL verification is not enabled."); |
|
throw Exception(parms); |
|
} |
#endif | #endif |
|
_rep = new SSLContextRep(trustStore, certPath, keyPath, crlPath, verifyCert, randomFile); |
} | } |
| |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
SSLContext::SSLContext( | SSLContext::SSLContext( |
const String& trustStore, | const String& trustStore, |
const String& certPath, | const String& certPath, |
const String& keyPath, | const String& keyPath, |
SSLCertificateVerifyFunction* verifyCert, | SSLCertificateVerifyFunction* verifyCert, |
Boolean trustStoreAutoUpdate, |
String trustStoreUserName, |
Boolean failIfNoPeerCert, |
|
const String& randomFile) | const String& randomFile) |
{ | { |
_rep = new SSLContextRep(trustStore, certPath, keyPath, verifyCert, trustStoreAutoUpdate, failIfNoPeerCert, randomFile); |
_rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile); |
} | } |
#endif | #endif |
| |
|
|
SSLContext::SSLContext(const SSLContext& sslContext) | SSLContext::SSLContext(const SSLContext& sslContext) |
{ | { |
_rep = new SSLContextRep(*sslContext._rep); | _rep = new SSLContextRep(*sslContext._rep); |
|
|
delete _rep; | delete _rep; |
} | } |
| |
#ifdef PEGASUS_USE_232_CLIENT_VERIFICATION |
|
String SSLContext::getTrustStore() const | String SSLContext::getTrustStore() const |
{ | { |
CString trustStore = _rep->getTrustStore(); |
return (_rep->getTrustStore()); |
if (strncmp(trustStore, "", 1) == 0) |
|
{ |
|
return (String::EMPTY); |
|
} |
|
|
|
return (String((const char*) trustStore)); |
|
} | } |
| |
String SSLContext::getCertPath() const | String SSLContext::getCertPath() const |
{ | { |
CString certPath = _rep->getCertPath(); |
return (_rep->getCertPath()); |
if (strncmp(certPath, "", 1) == 0) |
|
{ |
|
return (String::EMPTY); |
|
} |
|
|
|
return (String((const char*) certPath)); |
|
} | } |
| |
String SSLContext::getKeyPath() const | String SSLContext::getKeyPath() const |
{ | { |
CString keyPath = _rep->getKeyPath(); |
return (_rep->getKeyPath()); |
if (strncmp(keyPath, "", 1) == 0) |
} |
|
|
|
String SSLContext::getCRLPath() const |
{ | { |
return (String::EMPTY); |
#ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
|
return (_rep->getCRLPath()); |
|
#else |
|
MessageLoaderParms parms("Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", |
|
"SSL CRL verification is not enabled."); |
|
throw Exception(parms); |
|
#endif |
} | } |
| |
return (String((const char*) keyPath)); |
X509_STORE* SSLContext::getCRLStore() const |
|
{ |
|
#ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
|
return (_rep->getCRLStore()); |
|
#else |
|
MessageLoaderParms parms("Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", |
|
"SSL CRL verification is not enabled."); |
|
throw Exception(parms); |
|
#endif |
} | } |
| |
Boolean SSLContext::isPeerVerificationEnabled() const | Boolean SSLContext::isPeerVerificationEnabled() const |
|
|
return (_rep->isPeerVerificationEnabled()); | return (_rep->isPeerVerificationEnabled()); |
} | } |
| |
Boolean SSLContext::isTrustStoreAutoUpdateEnabled() const |
#ifdef PEGASUS_USE_DEPRECATED_INTERFACES |
|
String SSLContext::getTrustStoreUserName() const |
{ | { |
return (_rep->isTrustStoreAutoUpdateEnabled()); |
return (_rep->getTrustStoreUserName()); |
} | } |
|
|
#endif | #endif |
| |
|
SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const |
|
{ |
|
return (_rep->getSSLCertificateVerifyFunction()); |
|
} |
|
|
/////////////////////////////////////////////////////////////////////////////// | /////////////////////////////////////////////////////////////////////////////// |
// | // |
// SSLCertificateInfo | // SSLCertificateInfo |
|
|
_rep->respCode = respCode; | _rep->respCode = respCode; |
} | } |
| |
|
String SSLCertificateInfo::toString() const |
|
{ |
|
char buf[1024]; |
|
|
|
String s; |
|
|
|
s.append("Subject Name:\n\t"); |
|
s.append(_rep->subjectName); |
|
s.append("\n"); |
|
|
|
s.append("Issuer Name:\n\t"); |
|
s.append(_rep->issuerName); |
|
s.append("\n"); |
|
|
|
sprintf(buf, "Depth: %d\n", _rep->depth); |
|
s.append(buf); |
|
|
|
sprintf(buf, "Error code: %d\n", _rep->errorCode); |
|
s.append(buf); |
|
|
|
sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode); |
|
s.append(buf); |
|
|
|
s.append("Error string: "); |
|
s.append(_rep->errorString); |
|
s.append("\n"); |
|
|
|
sprintf(buf, "Version number: %d\n", _rep->versionNumber); |
|
s.append(buf); |
|
|
|
sprintf(buf, "Serial number: %lu\n", _rep->serialNumber); |
|
s.append(buf); |
|
|
|
s.append("Not before date: "); |
|
s.append((_rep->notBefore).toString()); |
|
s.append("\n"); |
|
|
|
s.append("Not after date: "); |
|
s.append((_rep->notAfter).toString()); |
|
s.append("\n"); |
|
|
|
return s; |
|
} |
|
|
|
/////////////////////////////////////////////////////////////////////////////// |
|
// |
|
// SSLCallbackInfo |
|
// |
|
/////////////////////////////////////////////////////////////////////////////// |
|
|
|
SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert) |
|
{ |
|
_rep = new SSLCallbackInfoRep(); |
|
_rep->verifyCertificateCallback = verifyCert; |
|
_rep->crlStore = NULL; |
|
} |
|
|
|
SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert, X509_STORE* crlStore) |
|
{ |
|
_rep = new SSLCallbackInfoRep(); |
|
_rep->verifyCertificateCallback = verifyCert; |
|
_rep->crlStore = crlStore; |
|
} |
|
|
|
SSLCallbackInfo::~SSLCallbackInfo() |
|
{ |
|
PEG_METHOD_ENTER(TRC_SSL, "SSLCallbackInfo::~SSLCallbackInfo"); |
|
for (Uint32 i = 0; i < _rep->peerCertificate.size(); i++) |
|
{ |
|
delete _rep->peerCertificate[i]; |
|
} |
|
delete _rep; |
|
PEG_METHOD_EXIT(); |
|
} |
|
|
PEGASUS_NAMESPACE_END | PEGASUS_NAMESPACE_END |
| |