(file) Return to SSLContext.cpp CVS log (file) (dir) Up to [Pegasus] / pegasus / src / Pegasus / Common

Diff for /pegasus/src/Pegasus/Common/SSLContext.cpp between version 1.45 and 1.84

version 1.45, 2005/02/05 22:59:24 version 1.84, 2007/08/06 09:46:20
Line 1 
Line 1 
 //%2005////////////////////////////////////////////////////////////////////////  //%2006////////////////////////////////////////////////////////////////////////
 // //
 // Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development // Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development
 // Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems. // Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.
Line 8 
Line 8 
 // IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group. // IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.
 // Copyright (c) 2005 Hewlett-Packard Development Company, L.P.; IBM Corp.; // Copyright (c) 2005 Hewlett-Packard Development Company, L.P.; IBM Corp.;
 // EMC Corporation; VERITAS Software Corporation; The Open Group. // EMC Corporation; VERITAS Software Corporation; The Open Group.
   // Copyright (c) 2006 Hewlett-Packard Development Company, L.P.; IBM Corp.;
   // EMC Corporation; Symantec Corporation; The Open Group.
 // //
 // Permission is hereby granted, free of charge, to any person obtaining a copy // Permission is hereby granted, free of charge, to any person obtaining a copy
 // of this software and associated documentation files (the "Software"), to // of this software and associated documentation files (the "Software"), to
Line 27 
Line 29 
 // //
 //============================================================================== //==============================================================================
 // //
 // Author: Markus Mueller (sedgewick_de@yahoo.de)  
 //  
 // Modified By: Nag Boranna, Hewlett-Packard Company (nagaraja_boranna@hp.com)  
 //              Roger Kumpf, Hewlett-Packard Company (roger_kumpf@hp.com)  
 //              Sushma Fernandes, Hewlett-Packard Company (sushma_fernandes@hp.com)  
 //              Heather Sterling, IBM (hsterl@us.ibm.com)  
 //              Amit K Arora, IBM (amita@in.ibm.com) for Bug#1090  
 //  
 //%///////////////////////////////////////////////////////////////////////////// //%/////////////////////////////////////////////////////////////////////////////
  
 #ifdef PEGASUS_HAS_SSL #ifdef PEGASUS_HAS_SSL
   # include <Pegasus/Common/Config.h>
 #ifdef PEGASUS_PLATFORM_WIN32_IX86_MSVC  # include <Pegasus/Common/Executor.h>
 //Bugzilla 2366  # include <Pegasus/Common/Network.h>
 //Use the X509_NAME in wincrypt.h on Windows.  See X509.h for more info.  
 #include <windows.h>  
 #include <wincrypt.h>  
 #endif  
   
 #define OPENSSL_NO_KRB5 1 #define OPENSSL_NO_KRB5 1
 #include <openssl/err.h> #include <openssl/err.h>
 #include <openssl/ssl.h> #include <openssl/ssl.h>
Line 53 
Line 42 
 #else #else
 #define SSL_CTX void #define SSL_CTX void
 #endif // end of PEGASUS_HAS_SSL #endif // end of PEGASUS_HAS_SSL
 #include <Pegasus/Common/Destroyer.h>  
   #include <time.h>
 #include <Pegasus/Common/Socket.h> #include <Pegasus/Common/Socket.h>
 #include <Pegasus/Common/Tracer.h> #include <Pegasus/Common/Tracer.h>
 #include <Pegasus/Common/FileSystem.h> #include <Pegasus/Common/FileSystem.h>
 #include <time.h>  #include <Pegasus/Common/MessageLoader.h>
 #include <Pegasus/Common/MessageLoader.h> //l10n  #include <Pegasus/Common/AuditLogger.h>
 #include <Pegasus/Common/Formatter.h>  
  
 #include "SSLContext.h" #include "SSLContext.h"
 #include "SSLContextRep.h" #include "SSLContextRep.h"
  
   #ifdef PEGASUS_OS_PASE
   # include <ILEWrapper/ILEUtilities.h>
   #endif
 // //
 // Typedef's for OpenSSL callback functions. // Typedef's for OpenSSL callback functions.
 // //
Line 102 
Line 93 
 // //
 #ifdef PEGASUS_HAS_SSL #ifdef PEGASUS_HAS_SSL
  
 // Mutex for SSL locks.  // Mutex for SSL locks which will get initialized by AutoArrayPtr constructor.
 Mutex* SSLContextRep::_sslLocks = 0;  AutoArrayPtr<Mutex> SSLContextRep::_sslLocks;
  
 // Mutex for _countRep. // Mutex for _countRep.
 Mutex SSLContextRep::_countRepMutex; Mutex SSLContextRep::_countRepMutex;
Line 188 
Line 179 
     strcpy(tempString, (char *)&timeStamp);     strcpy(tempString, (char *)&timeStamp);
     dateTime.set(tempString);     dateTime.set(tempString);
  
     return (dateTime);      return dateTime;
 } }
  
 // //
Line 198 
Line 189 
 { {
  
 public: public:
         static int verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx);      static int verificationCallback(
         static int verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore);          int preVerifyOk,
           X509_STORE_CTX* ctx);
       static int verificationCRLCallback(
           int ok,
           X509_STORE_CTX* ctx,
           X509_STORE* sslCRLStore);
 }; };
  
 // //
 // Callback function that is called by the OpenSSL library. This function // Callback function that is called by the OpenSSL library. This function
 // checks whether the certificate is listed in any of the CRL's // checks whether the certificate is listed in any of the CRL's
 // //
 int SSLCallback::verificationCRLCallback(int ok, X509_STORE_CTX *ctx, X509_STORE* sslCRLStore)  // return 1 if revoked, 0 otherwise
   //
   int SSLCallback::verificationCRLCallback(
       int ok,
       X509_STORE_CTX* ctx,
       X509_STORE* sslCRLStore)
 { {
         PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::verificationCRLCallback");         PEG_METHOD_ENTER(TRC_SSL, "SSLCallback::verificationCRLCallback");
  
         //PEP187 function      char buf[1024];
         //ATTN: must reimplement this callback 2/2/2005  
  
       //check whether a CRL store was specified
       if (sslCRLStore == NULL)
       {
           PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
               "---> SSL: CRL store is NULL");
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
     return ok;          return 0;
       }
   
       //get the current certificate info
       X509* currentCert;
       X509_NAME* issuerName;
       X509_NAME* subjectName;
       ASN1_INTEGER* serialNumber;
   
       currentCert = X509_STORE_CTX_get_current_cert(ctx);
       subjectName = X509_get_subject_name(currentCert);
       issuerName = X509_get_issuer_name(currentCert);
       serialNumber = X509_get_serialNumber(currentCert);
   
       //log certificate information
       //this is information in the "public" key, so it does no harm to log it
       X509_NAME_oneline(issuerName, buf, sizeof(buf));
       PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
           "---> SSL: Certificate Data: Issuer/Subject");
       PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, buf);
       X509_NAME_oneline(subjectName, buf, sizeof(buf));
       PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, buf);
   
       //initialize the CRL store
       X509_STORE_CTX crlStoreCtx;
       X509_STORE_CTX_init(&crlStoreCtx, sslCRLStore, NULL, NULL);
   
       PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
           "---> SSL: Initialized CRL store");
   
       //attempt to get a CRL issued by the certificate's issuer
       X509_OBJECT obj;
       if (X509_STORE_get_by_subject(
               &crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0)
       {
           PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
               "---> SSL: No CRL by that issuer");
           PEG_METHOD_EXIT();
           return 0;
       }
       X509_STORE_CTX_cleanup(&crlStoreCtx);
   
       //get CRL
       X509_CRL* crl = obj.data.crl;
       if (crl == NULL)
       {
           PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, "---> SSL: CRL is null");
           PEG_METHOD_EXIT();
           return 0;
       }
       else
       {
           PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
               "---> SSL: Found CRL by that issuer");
       }
   
       //get revoked certificates
       STACK_OF(X509_REVOKED)* revokedCerts = NULL;
       revokedCerts = X509_CRL_get_REVOKED(crl);
       int numRevoked = sk_X509_REVOKED_num(revokedCerts);
       PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
           "---> SSL: Number of certificates revoked by the issuer %d\n",
           numRevoked));
   
       //check whether the subject's certificate is revoked
       X509_REVOKED* revokedCert = NULL;
       for (int i = 0; i < sk_X509_REVOKED_num(revokedCerts); i++)
       {
           revokedCert = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i);
   
           //a matching serial number indicates revocation
           if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0)
           {
               PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2,
                   "---> SSL: Certificate is revoked");
               X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED);
               PEG_METHOD_EXIT();
               return 1;
           }
       }
   
       PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
           "---> SSL: Certificate is not revoked at this level");
   
       PEG_METHOD_EXIT();
       return 0;
 } }
  
 // //
 // Callback function that is called by the OpenSSL library. This function // Callback function that is called by the OpenSSL library. This function
 // extracts X509 certficate information and pass that on to client application // extracts X509 certficate information and pass that on to client application
 // callback function. // callback function.
 // We HAVE to build the certificate in all cases since it's needed to get the associated username out of the repository  // We HAVE to build the certificate in all cases since it's needed to get
 // later in the transaction  // the associated username out of the repository later in the transaction.
 // //
 int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx) int SSLCallback::verificationCallback(int preVerifyOk, X509_STORE_CTX *ctx)
 { {
Line 234 
Line 324 
     int    verifyError = X509_V_OK;     int    verifyError = X509_V_OK;
         int    revoked = -1;         int    revoked = -1;
  
         Tracer::trace(TRC_SSL, Tracer::LEVEL4,      PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
                                   "--->SSL: Preverify Error %d", verifyError);          "--->SSL: Preverify Error %d", verifyError));
  
     //     //
     // get the verification callback info specific to each SSL connection     // get the verification callback info specific to each SSL connection
     //     //
     ssl = (SSL*) X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());      ssl = (SSL*) X509_STORE_CTX_get_ex_data(
     SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX);          ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
       SSLCallbackInfo* exData = (SSLCallbackInfo*) SSL_get_ex_data(
           ssl, SSLCallbackInfo::SSL_CALLBACK_INDEX);
  
   #ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION
     //     //
     // If the SSLContext does not have an additional callback      // Check to see if a CRL path is defined
     // simply return the preverification error (or check the CRL)  
     // We do not need to go through the additional steps.  
     //     //
     if (exData->verifyCertificateCallback == NULL)      if (exData->_rep->crlStore != NULL)
     {     {
                 Tracer::trace(TRC_SSL, Tracer::LEVEL4,          revoked = verificationCRLCallback(
                                           "--->SSL: No verification callback specified");              preVerifyOk,ctx,exData->_rep->crlStore);
           PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
               "---> SSL: CRL callback returned %d", revoked));
  
                 if (exData->_crlStore == NULL)          if (revoked) //with the SSL callbacks '0' indicates failure
                 {                 {
                         PEG_METHOD_EXIT();                         PEG_METHOD_EXIT();
         return (preVerifyOk);              return 0;
                 } else  
                 {  
                         revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_crlStore);  
                         PEG_METHOD_EXIT();  
                         return (revoked);  
                 }                 }
     }     }
  
     //      PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
         // Check to see if a CRL path is defined          "---> SSL: CRL callback returned %d", revoked));
         //  #endif
         if (exData->_crlStore)  
         {  
         revoked = verificationCRLCallback(preVerifyOk,ctx,exData->_crlStore);  
                 Tracer::trace(TRC_SSL, Tracer::LEVEL4,  
                                           "---> SSL: CRL callback returned %d", revoked);  
         }  
  
     //     //
     // get the current certificate     // get the current certificate
Line 299 
Line 381 
     // get the serial number of the certificate     // get the serial number of the certificate
     //     //
     long serialNumber = ASN1_INTEGER_get(X509_get_serialNumber(currentCert));     long serialNumber = ASN1_INTEGER_get(X509_get_serialNumber(currentCert));
       char serialNumberString[32];
       sprintf(serialNumberString, "%lu", serialNumber);
  
     //     //
     // get the validity of the certificate     // get the validity of the certificate
Line 323 
Line 407 
     //     //
     if (!preVerifyOk)     if (!preVerifyOk)
     {     {
         Tracer::trace(TRC_SSL, Tracer::LEVEL4,          PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
                                           "---> SSL: certificate default verification error: %s", (const char*)errorStr.getCString());              "---> SSL: certificate default verification error: %s",
               (const char*)errorStr.getCString()));
     }     }
  
     //     //
     // get the issuer name on the certificate     // get the issuer name on the certificate
     //     //
     if (!preVerifyOk && (errorCode == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT))  
     {  
         X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, 256);  
     }  
     else  
     {  
         X509_NAME_oneline(X509_get_issuer_name(currentCert), buf, 256);         X509_NAME_oneline(X509_get_issuer_name(currentCert), buf, 256);
     }  
     String issuerName = String(buf);     String issuerName = String(buf);
  
         //         //
         // Create the certificate object         // Create the certificate object
         //         //
     exData->_peerCertificate = new SSLCertificateInfo(subjectName, issuerName, version, serialNumber,  
         notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk);      // insert at the beginning of the array so that the peer certificate is
       // first and the root CA is last
       exData->_rep->peerCertificate.insert(0, new SSLCertificateInfo(
           subjectName, issuerName, version, serialNumber,
           notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk));
   
       PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, "Created SSLCertificateInfo");
   
       // NOT_YET_VALID checks do not work correctly on subsequent tries --
       // Bugzilla#4283
       // call this prior to calling the user-specified callback in case they
       // want to override it
       if (errorCode == X509_V_OK &&
           (CIMDateTime::getDifference(
                CIMDateTime::getCurrentDateTime(), notBefore) > 0))
       {
           PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
               "Certificate was not yet valid.");
   
           X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_NOT_YET_VALID);
   
           PEG_AUDIT_LOG(logCertificateBasedAuthentication(
               issuerName,
               subjectName,
               serialNumberString,
               exData->_rep->ipAddress,
               false));
       }
  
     //     //
     // Call the application callback.      // Call the user-specified application callback if it is specified.
     // Note that the verification result does not automatically get set to X509_V_OK if the callback is successful.      // If it is null, return OpenSSL's verification code.
     // This is because OpenSSL retains the original default error in case we want to use it later.      // Note that the verification result does not automatically get set
     // To set the error, we could use X509_STORE_CTX_set_error(ctx, verifyError); but there is no real benefit to doing that here.      // to X509_V_OK if the callback is successful.
     //      // This is because OpenSSL retains the original default error in case
     if (exData->verifyCertificateCallback(*exData->_peerCertificate))      // we want to use it later.
       // To set the error, we could use X509_STORE_CTX_set_error(ctx,
       // verifyError); but there is no real benefit to doing that here.
       //
       if (exData->_rep->verifyCertificateCallback == NULL)
       {
           PEG_AUDIT_LOG(logCertificateBasedAuthentication(
               issuerName,
               subjectName,
               serialNumberString,
               exData->_rep->ipAddress,
               preVerifyOk));
   
           return preVerifyOk;
       }
       else
     {     {
         Tracer::trace(TRC_SSL, Tracer::LEVEL4,          if (exData->_rep->verifyCertificateCallback(
             "--> SSL: verifyCertificateCallback() returned X509_V_OK");                  *exData->_rep->peerCertificate[0]))
           {
               PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
                   "--> SSL: _rep->verifyCertificateCallback() returned "
                       "X509_V_OK");
   
               PEG_AUDIT_LOG(logCertificateBasedAuthentication(
                    issuerName,
                    subjectName,
                    serialNumberString,
                    exData->_rep->ipAddress,
                    true));
  
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         return 1;         return 1;
     }     }
     else // verification failed, handshake will be immediately terminated     else // verification failed, handshake will be immediately terminated
     {     {
         Tracer::trace(TRC_SSL, Tracer::LEVEL4,              PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
             "--> SSL: verifyCertificateCallback() returned error %d", exData->_peerCertificate->getErrorCode());                  "--> SSL: _rep->verifyCertificateCallback() returned error %d",
                   exData->_rep->peerCertificate[0]->getErrorCode()));
   
               PEG_AUDIT_LOG(logCertificateBasedAuthentication(
                    issuerName,
                    subjectName,
                    serialNumberString,
                    exData->_rep->ipAddress,
                    false));
  
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         return 0;         return 0;
     }     }
 } }
   }
  
 // //
 // Callback function called by OpenSSL.  This request is merely forwarded to the static  // Callback function called by OpenSSL.  This request is merely forwarded
 // function SSLCallback::callback().  The SSLCallback class is a friend class of the  // to the static function SSLCallback::callback().  The SSLCallback class
 // Pegasus SSL related classes needed to complete the callback.  // is a friend class of the Pegasus SSL related classes needed to complete
   // the callback.
 // //
 extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx) extern "C" int prepareForCallback(int preVerifyOk, X509_STORE_CTX *ctx)
 { {
Line 383 
Line 524 
 // //
 // Implement OpenSSL locking callback. // Implement OpenSSL locking callback.
 // //
 void pegasus_locking_callback( int              mode,  void pegasus_locking_callback(
       int mode,
                                int              type,                                int              type,
                                const char*      file,                                const char*      file,
                                int              line)                                int              line)
Line 392 
Line 534 
  
     if ( mode & CRYPTO_LOCK )     if ( mode & CRYPTO_LOCK )
     {     {
         /*Tracer::trace(TRC_SSL, Tracer::LEVEL4,          /*PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
                 "Now locking for %d", pegasus_thread_self());*/                  "Now locking for type %d", type));*/
         SSLContextRep::_sslLocks[type].lock( pegasus_thread_self() );          SSLContextRep::_sslLocks.get()[type].lock( );
     }     }
     else     else
     {     {
         /*Tracer::trace(TRC_SSL, Tracer::LEVEL4,          /*PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
                 "Now unlocking for %d", pegasus_thread_self());*/                  "Now unlocking for type %d", type));*/
         SSLContextRep::_sslLocks[type].unlock( );          SSLContextRep::_sslLocks.get()[type].unlock( );
     }     }
 } }
  
Line 411 
Line 553 
 { {
      // Allocate Memory for _sslLocks. SSL locks needs to be able to handle      // Allocate Memory for _sslLocks. SSL locks needs to be able to handle
      // up to CRYPTO_num_locks() different mutex locks.      // up to CRYPTO_num_locks() different mutex locks.
      PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,       PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
            "Initialized SSL callback.");            "Initialized SSL callback.");
  
      _sslLocks= new Mutex[CRYPTO_num_locks()];       _sslLocks.reset(new Mutex[CRYPTO_num_locks()]);
  
   #if defined(PEGASUS_HAVE_PTHREADS) && !defined(PEGASUS_OS_VMS)
      // Set the ID callback. The ID callback returns a thread ID.      // Set the ID callback. The ID callback returns a thread ID.
        CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK) pthread_self);
      CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK) pegasus_thread_self);  #endif
  
      // Set the locking callback to pegasus_locking_callback.      // Set the locking callback to pegasus_locking_callback.
  
      CRYPTO_set_locking_callback((CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback);       CRYPTO_set_locking_callback(
            (CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback);
  
 } }
  
Line 433 
Line 577 
  
     CRYPTO_set_locking_callback(NULL);     CRYPTO_set_locking_callback(NULL);
     CRYPTO_set_id_callback     (NULL);     CRYPTO_set_id_callback     (NULL);
     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,      PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
              "Freed SSL callback.");              "Freed SSL callback.");
       _sslLocks.reset();
     delete []_sslLocks;  
 } }
  
  
Line 469 
Line 612 
     _certificateVerifyFunction = verifyCert;     _certificateVerifyFunction = verifyCert;
  
     //     //
     // If a truststore and/or peer verification function is specified, enable peer verification      // If a truststore and/or peer verification function is specified,
       // enable peer verification
     //     //
     if (trustStore != String::EMPTY || verifyCert != NULL)     if (trustStore != String::EMPTY || verifyCert != NULL)
     {     {
Line 481 
Line 625 
     }     }
  
     //     //
     // Initialiaze SSL callbacks and increment the SSLContextRep object _counter.      // Initialize SSL callbacks and increment the SSLContextRep object _counter.
     //     //
     {     {
        AutoMutex autoMut(_countRepMutex);        AutoMutex autoMut(_countRepMutex);
  
        Tracer::trace(TRC_SSL, Tracer::LEVEL4,         PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
                 "Value of Countrep in constructor %d", _countRep);                  "Value of Countrep in constructor %d", _countRep));
         if ( _countRep == 0 )         if ( _countRep == 0 )
         {         {
             init_ssl();             init_ssl();
Line 495 
Line 639 
             //             //
             // load SSL library             // load SSL library
             //             //
             Tracer::trace(TRC_SSL, Tracer::LEVEL4,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
                 "Before calling SSL_load_error_strings %d", pegasus_thread_self());                  "Before calling SSL_load_error_strings");
  
             SSL_load_error_strings();             SSL_load_error_strings();
  
             Tracer::trace(TRC_SSL, Tracer::LEVEL4,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
                 "After calling SSL_load_error_strings %d", pegasus_thread_self());                  "After calling SSL_load_error_strings");
  
             Tracer::trace(TRC_SSL, Tracer::LEVEL4,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
                 "Before calling SSL_library_init %d", pegasus_thread_self());                  "Before calling SSL_library_init");
  
             SSL_library_init();             SSL_library_init();
  
             Tracer::trace(TRC_SSL, Tracer::LEVEL4,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
                 "After calling SSL_library_init %d", pegasus_thread_self());                  "After calling SSL_library_init");
   
         }         }
  
     _countRep++;     _countRep++;
Line 531 
Line 674 
     _certPath = sslContextRep._certPath;     _certPath = sslContextRep._certPath;
     _keyPath = sslContextRep._keyPath;     _keyPath = sslContextRep._keyPath;
         _crlPath = sslContextRep._crlPath;         _crlPath = sslContextRep._crlPath;
       _crlStore = sslContextRep._crlStore;
     _verifyPeer = sslContextRep._verifyPeer;     _verifyPeer = sslContextRep._verifyPeer;
     _certificateVerifyFunction = sslContextRep._certificateVerifyFunction;     _certificateVerifyFunction = sslContextRep._certificateVerifyFunction;
     _randomFile = sslContextRep._randomFile;     _randomFile = sslContextRep._randomFile;
  
     // Initialiaze SSL callbacks and increment the SSLContextRep object _counter.      // Initialize SSL callbacks and increment the SSLContextRep object _counter.
     {     {
         AutoMutex autoMut(_countRepMutex);         AutoMutex autoMut(_countRepMutex);
         Tracer::trace(TRC_SSL, Tracer::LEVEL4,          PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
              "Value of Countrep in copy constructor %d", _countRep);              "Value of Countrep in copy constructor %d", _countRep));
         if ( _countRep == 0 )         if ( _countRep == 0 )
         {         {
             init_ssl();             init_ssl();
Line 568 
Line 712 
         _countRep--;         _countRep--;
         // Free SSL locks if no instances of SSLContextRep exist.         // Free SSL locks if no instances of SSLContextRep exist.
  
         Tracer::trace(TRC_SSL, Tracer::LEVEL4,          PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
                 "Value of Countrep in destructor %d", _countRep);              "Value of Countrep in destructor %d", _countRep));
         if ( _countRep == 0 )         if ( _countRep == 0 )
         {         {
             free_ssl();             free_ssl();
Line 589 
Line 733 
     Boolean ret;     Boolean ret;
     int retVal = 0;     int retVal = 0;
  
 #ifdef PEGASUS_SSL_RANDOMFILE  #if defined(PEGASUS_SSL_RANDOMFILE) && !defined(PEGASUS_OS_PASE)
     if ( RAND_status() == 0 )     if ( RAND_status() == 0 )
     {     {
         //         //
Line 597 
Line 741 
         //         //
         if ( randomFile == String::EMPTY )         if ( randomFile == String::EMPTY )
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4,
                 "Random seed file is required.");                 "Random seed file is required.");
             PEG_METHOD_EXIT();             PEG_METHOD_EXIT();
             //l10n              MessageLoaderParms parms(
             //throw( SSLException("Random seed file required"));                  "Common.SSLContext.RANDOM_SEED_FILE_REQUIRED",
             MessageLoaderParms parms("Common.SSLContext.RANDOM_SEED_FILE_REQUIRED",  
                                                          "Random seed file required");                                                          "Random seed file required");
             throw SSLException(parms);             throw SSLException(parms);
         }         }
Line 617 
Line 760 
             if ( retVal < 0 )             if ( retVal < 0 )
             {             {
                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,
                     "Not enough seed data in seed file: " + randomFile);                      String("Not enough seed data in seed file: ") + randomFile);
                 PEG_METHOD_EXIT();                 PEG_METHOD_EXIT();
                 //l10n                  // do not put in $0 in default message, but pass in filename
                 // do not put in $0 in default message, but pass in filename for bundle message                  // for bundle message
                 //throw( SSLException("Not enough seed data in random seed file."));                  MessageLoaderParms parms(
                 MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE",                      "Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE",
                                                              "Not enough seed data in random seed file.",                                                              "Not enough seed data in random seed file.",
                                                              randomFile);                                                              randomFile);
                 throw SSLException(parms);                 throw SSLException(parms);
Line 631 
Line 774 
         else         else
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,
                 "seed file - " + randomFile + " does not exist.");                  String("seed file - " + randomFile + " does not exist."));
             PEG_METHOD_EXIT();             PEG_METHOD_EXIT();
             //l10n              MessageLoaderParms parms(
             //throw( SSLException("Seed file '" + randomFile + "' does not exist."));                  "Common.SSLContext.SEED_FILE_DOES_NOT_EXIST",
             MessageLoaderParms parms("Common.SSLContext.SEED_FILE_DOES_NOT_EXIST",  
                                                          "Seed file '$0' does not exist.",                                                          "Seed file '$0' does not exist.",
                                                          randomFile);                                                          randomFile);
             throw SSLException(parms);             throw SSLException(parms);
Line 647 
Line 789 
             // Try to do more seeding             // Try to do more seeding
             //             //
             long seedNumber;             long seedNumber;
         #if defined(PEGASUS_PLATFORM_WIN32_IX86_MSVC)          #if defined(PEGASUS_COMPILER_MSVC)
             srand((unsigned int)time(NULL)); // Initialize             srand((unsigned int)time(NULL)); // Initialize
             seedNumber = rand();             seedNumber = rand();
         #else         #else
Line 659 
Line 801 
             int  seedRet = RAND_status();             int  seedRet = RAND_status();
             if ( seedRet == 0 )             if ( seedRet == 0 )
             {             {
                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,                  PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
                     "Not enough seed data in random seed file, RAND_status = " +                      "Not enough seed data in random seed file, "
                     seedRet);                          "RAND_status = %d",
                 PEG_METHOD_EXIT();                      seedRet));
                 //l10n 485                  PEG_METHOD_EXIT();
                 // do not put in $0 in default message, but pass in filename for bundle message                  // do not put in $0 in default message, but pass in filename
                 //throw( SSLException("Not enough seed data in random seed file."));                  // for bundle message
                 MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE",                  MessageLoaderParms parms(
                       "Common.SSLContext.NOT_ENOUGH_SEED_DATA_IN_FILE",
                                                              "Not enough seed data in random seed file.",                                                              "Not enough seed data in random seed file.",
                                                              randomFile);                                                              randomFile);
                 throw SSLException(parms);                 throw SSLException(parms);
Line 678 
Line 821 
     int  seedRet = RAND_status();     int  seedRet = RAND_status();
     if ( seedRet == 0 )     if ( seedRet == 0 )
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4,  // pase for different logic
             "Not enough seed data , RAND_status = " + seedRet );  #ifdef PEGASUS_OS_PASE
           unsigned char prn[1024];
   
           umeGenerateRandomNumber(prn);
   
           RAND_seed(prn, 1024);
   
           if (RAND_status() == 0)
           {
   #endif
           PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
               "Not enough seed data, RAND_status = %d",
               seedRet));
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         //l10n          MessageLoaderParms parms(
         //throw( SSLException("Not enough seed data."));              "Common.SSLContext.NOT_ENOUGH_SEED_DATA",
         MessageLoaderParms parms("Common.SSLContext.NOT_ENOUGH_SEED_DATA",  
                                                  "Not enough seed data.");                                                  "Not enough seed data.");
         throw SSLException(parms);         throw SSLException(parms);
   #ifdef PEGASUS_OS_PASE
           }
   #endif
     }     }
  
     PEG_METHOD_EXIT();     PEG_METHOD_EXIT();
Line 704 
Line 861 
     if (!( sslContext = SSL_CTX_new(SSLv23_method()) ))     if (!( sslContext = SSL_CTX_new(SSLv23_method()) ))
     {     {
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         //l10n          MessageLoaderParms parms(
         //throw( SSLException("Could not get SSL CTX"));              "Common.SSLContext.COULD_NOT_GET",
         MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET",  
                                                  "Could not get SSL CTX");                                                  "Could not get SSL CTX");
         throw SSLException(parms);         throw SSLException(parms);
     }     }
  
 #ifdef PEGASUS_SSL_WEAKENCRYPTION #ifdef PEGASUS_SSL_WEAKENCRYPTION
     if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40))){      if (!(SSL_CTX_set_cipher_list(sslContext, SSL_TXT_EXP40)))
         //l10n      {
         //throw( SSLException("Could not set the cipher list"));          MessageLoaderParms parms(
         MessageLoaderParms parms("Common.SSLContext.COULD_NOT_SET_CIPHER_LIST",              "Common.SSLContext.COULD_NOT_SET_CIPHER_LIST",
                                                  "Could not set the cipher list");                                                  "Could not set the cipher list");
         throw SSLException(parms);         throw SSLException(parms);
     }     }
Line 727 
Line 883 
  
     SSL_CTX_set_quiet_shutdown(sslContext, 1);     SSL_CTX_set_quiet_shutdown(sslContext, 1);
     SSL_CTX_set_mode(sslContext, SSL_MODE_AUTO_RETRY);     SSL_CTX_set_mode(sslContext, SSL_MODE_AUTO_RETRY);
     SSL_CTX_set_options(sslContext,SSL_OP_ALL);      SSL_CTX_set_mode(sslContext, SSL_MODE_ENABLE_PARTIAL_WRITE);
     SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF);     SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF);
  
       int options = SSL_OP_ALL;
   #ifndef PEGASUS_ENABLE_SSLV2 //SSLv2 is disabled by default
       options |= SSL_OP_NO_SSLv2;
   #endif
       SSL_CTX_set_options(sslContext, options);
   
     if (_verifyPeer)     if (_verifyPeer)
     {     {
         //ATTN: We might still need a flag to specify SSL_VERIFY_FAIL_IF_NO_PEER_CERT          // ATTN: We might still need a flag to specify
         // If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be terminated          // SSL_VERIFY_FAIL_IF_NO_PEER_CERT
         // if the client sends no certificate or sends an untrusted certificate.  The          // If SSL_VERIFY_FAIL_IF_NO_PEER_CERT is ON, SSL will immediately be
         // callback function is not called in this case; the handshake is simply terminated.          // terminated if the client sends no certificate or sends an
           // untrusted certificate.  The callback function is not called in
           // this case; the handshake is simply terminated.
         // This value has NO effect in from a client perspective         // This value has NO effect in from a client perspective
  
         if (_certificateVerifyFunction != NULL)         if (_certificateVerifyFunction != NULL)
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                 "---> SSL: certificate verification callback specified");                 "---> SSL: certificate verification callback specified");
             SSL_CTX_set_verify(sslContext,             SSL_CTX_set_verify(sslContext,
                 SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback);                 SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, prepareForCallback);
         }         }
         else         else
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, "---> SSL: Trust Store specified");              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                   "---> SSL: Trust Store specified");
             SSL_CTX_set_verify(sslContext,             SSL_CTX_set_verify(sslContext,
                 SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,                  SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE |
                       SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
                 prepareForCallback);                 prepareForCallback);
         }         }
     }     }
     else     else
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,          PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
             "---> SSL: Trust Store and certificate verification callback are NOT specified");              "---> SSL: Trust Store and certificate verification callback "
                   "are NOT specified");
         SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL);         SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL);
     }     }
  
     //     //
     // Check if there is CA certificate file or directory specified. If specified,      // Check if there is CA certificate file or directory specified. If
     // and is not empty, load the certificates from the Trust store.      // specified, and is not empty, load the certificates from the Trust store.
     //     //
     if (_trustStore != String::EMPTY)     if (_trustStore != String::EMPTY)
     {     {
Line 777 
Line 944 
         //         //
         if (FileSystem::isDirectory(_trustStore))         if (FileSystem::isDirectory(_trustStore))
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                             "---> SSL: Truststore is a directory");                             "---> SSL: Truststore is a directory");
             //             //
             // load certificates from the trust store             // load certificates from the trust store
             //             //
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
                 "---> SSL: Loading certificates from the trust store: " + _trustStore);                  String("---> SSL: Loading certificates from the trust store: " +
                       _trustStore));
  
             if ((!SSL_CTX_load_verify_locations(sslContext, NULL, _trustStore.getCString())) ||              if ((!SSL_CTX_load_verify_locations(
                        sslContext, NULL, _trustStore.getCString())) ||
                 (!SSL_CTX_set_default_verify_paths(sslContext)))                 (!SSL_CTX_set_default_verify_paths(sslContext)))
             {             {
                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
                     "---> SSL: Could not load certificates from the trust store: " + _trustStore);                      String("---> SSL: Could not load certificates from the "
                 //l10n                          "trust store: " + _trustStore));
                 MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",                  MessageLoaderParms parms(
                       "Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",
                     "Could not load certificates in to trust store.");                     "Could not load certificates in to trust store.");
                 PEG_METHOD_EXIT();                 PEG_METHOD_EXIT();
                 throw SSLException(parms);                 throw SSLException(parms);
Line 800 
Line 970 
         }         }
         else if (FileSystem::exists(_trustStore))         else if (FileSystem::exists(_trustStore))
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                             "---> SSL: Truststore is a file");                             "---> SSL: Truststore is a file");
             //             //
             // Get size of the trust store file:             // Get size of the trust store file:
Line 815 
Line 985 
                 // load certificates from the trust store                 // load certificates from the trust store
                 //                 //
                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
                     "---> SSL: Loading certificates from the trust store: " + _trustStore);                      String("---> SSL: Loading certificates from the trust "
                           "store: " + _trustStore));
  
                 if ((!SSL_CTX_load_verify_locations(sslContext, _trustStore.getCString(), NULL)) ||                  if ((!SSL_CTX_load_verify_locations(
                            sslContext, _trustStore.getCString(), NULL)) ||
                     (!SSL_CTX_set_default_verify_paths(sslContext)))                     (!SSL_CTX_set_default_verify_paths(sslContext)))
                 {                 {
                     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,                     PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
                         "---> SSL: Could not load certificates from the trust store: " + _trustStore);                          String("---> SSL: Could not load certificates from the "
                     //l10n                              "trust store: " + _trustStore));
                     MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",                      MessageLoaderParms parms(
                           "Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",
                         "Could not load certificates in to trust store.");                         "Could not load certificates in to trust store.");
                     PEG_METHOD_EXIT();                     PEG_METHOD_EXIT();
                     throw SSLException(parms);                     throw SSLException(parms);
Line 835 
Line 1008 
                 // no certificates found in the trust store                 // no certificates found in the trust store
                 //                 //
                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,                 PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
                     "---> SSL: No certificates to load from the trust store: " + _trustStore);                      String("---> SSL: No certificates to load from the trust "
                           "store: " + _trustStore));
             }             }
         }         }
     }     }
  
         if (_crlPath != String::EMPTY)         if (_crlPath != String::EMPTY)
         {         {
         //need to save this -- can we make it static since there's only one CRL for cimserver?          // need to save this -- can we make it static since there's only
           // one CRL for cimserver?
                 X509_LOOKUP* pLookup;                 X509_LOOKUP* pLookup;
  
                 _crlStore = X509_STORE_new();                 _crlStore = X509_STORE_new();
  
                 //the validity of the crlstore was checked in ConfigManager during server startup          // the validity of the crlstore was checked in ConfigManager
           // during server startup
                 if (FileSystem::isDirectory(_crlPath))                 if (FileSystem::isDirectory(_crlPath))
         {         {
             Tracer::trace(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
                                                   "---> SSL: CRL store is a directory in %s", (const char*)_crlPath.getCString());                  "---> SSL: CRL store is a directory in %s",
                   (const char*)_crlPath.getCString()));
  
             if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_hash_dir())) == NULL)              if ((pLookup = X509_STORE_add_lookup(
                        _crlStore, X509_LOOKUP_hash_dir())) == NULL)
                         {                         {
                                 MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS",                  MessageLoaderParms parms(
                       "Common.SSLContext.COULD_NOT_LOAD_CRLS",
                                                                                  "Could not load certificate revocation list.");                                                                                  "Could not load certificate revocation list.");
                                 X509_STORE_free(_crlStore);                                 X509_STORE_free(_crlStore);
                 PEG_METHOD_EXIT();                 PEG_METHOD_EXIT();
                 throw SSLException(parms);                 throw SSLException(parms);
                         }                         }
  
             X509_LOOKUP_add_dir(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);              X509_LOOKUP_add_dir(
                   pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);
  
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                             "---> SSL: Successfully configured CRL directory");                             "---> SSL: Successfully configured CRL directory");
           }
                 } else          else
                 {                 {
             Tracer::trace(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE((TRC_SSL, Tracer::LEVEL3,
                                                   "---> SSL: CRL store is the file %s", (const char*)_crlPath.getCString());                  "---> SSL: CRL store is the file %s",
                   (const char*)_crlPath.getCString()));
  
             if ((pLookup = X509_STORE_add_lookup(_crlStore, X509_LOOKUP_file())) == NULL)              if ((pLookup = X509_STORE_add_lookup(
                      _crlStore, X509_LOOKUP_file())) == NULL)
                         {                         {
                 MessageLoaderParms parms("Common.SSLContext.COULD_NOT_LOAD_CRLS",                  MessageLoaderParms parms(
                       "Common.SSLContext.COULD_NOT_LOAD_CRLS",
                                                                                  "Could not load certificate revocation list.");                                                                                  "Could not load certificate revocation list.");
                                 X509_STORE_free(_crlStore);                                 X509_STORE_free(_crlStore);
                 PEG_METHOD_EXIT();                 PEG_METHOD_EXIT();
                 throw SSLException(parms);                 throw SSLException(parms);
                         }                         }
  
                         X509_LOOKUP_load_file(pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);              X509_LOOKUP_load_file(
                   pLookup, (const char*)_crlPath.getCString(), X509_FILETYPE_PEM);
  
                         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,              PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,
                             "---> SSL: Successfully configured CRL file");                             "---> SSL: Successfully configured CRL file");
                 }                 }
         }         }
Line 901 
Line 1085 
         // load the specified server certificates         // load the specified server certificates
         //         //
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
             "---> SSL: Loading server certificate from: " + _certPath);              String("---> SSL: Loading server certificate from: " + _certPath));
  
         if (SSL_CTX_use_certificate_file(sslContext,         if (SSL_CTX_use_certificate_file(sslContext,
             _certPath.getCString(), SSL_FILETYPE_PEM) <=0)             _certPath.getCString(), SSL_FILETYPE_PEM) <=0)
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
                 "---> SSL: No server certificate found in " + _certPath);                  String("---> SSL: No server certificate found in " +
             MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE",                      _certPath));
               MessageLoaderParms parms(
                   "Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE",
                                                      "Could not get server certificate.");                                                      "Could not get server certificate.");
             PEG_METHOD_EXIT();             PEG_METHOD_EXIT();
             throw SSLException(parms);             throw SSLException(parms);
Line 916 
Line 1102 
  
         //         //
         // If there is no key file (file containing server         // If there is no key file (file containing server
         // private key) specified, then try loading the key from the certificate file.          // private key) specified, then try loading the key from the
         // As of 2.4, if a keyfile is specified, its location is verified during server          // certificate file.
         // startup and will throw an error if the path is invalid.          // As of 2.4, if a keyfile is specified, its location is verified
           // during server startup and will throw an error if the path is invalid.
         //         //
         if (_keyPath == String::EMPTY)         if (_keyPath == String::EMPTY)
         {         {
             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,             PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
                 "---> SSL: loading private key from: " + _certPath);                  String("---> SSL: loading private key from: " + _certPath));
             //             //
             // load the private key and check for validity             // load the private key and check for validity
             //             //
             if (!_verifyPrivateKey(sslContext, _certPath))             if (!_verifyPrivateKey(sslContext, _certPath))
             {             {
                 MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",                  MessageLoaderParms parms(
                       "Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",
                                                          "Could not get private key.");                                                          "Could not get private key.");
                 PEG_METHOD_EXIT();                 PEG_METHOD_EXIT();
                 throw SSLException(parms);                 throw SSLException(parms);
Line 946 
Line 1134 
     if (_keyPath != String::EMPTY && !keyLoaded)     if (_keyPath != String::EMPTY && !keyLoaded)
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
             "---> SSL: loading private key from: " + _keyPath);              String("---> SSL: loading private key from: " + _keyPath));
         //         //
         // load given private key and check for validity         // load given private key and check for validity
         //         //
         if (!_verifyPrivateKey(sslContext, _keyPath))         if (!_verifyPrivateKey(sslContext, _keyPath))
         {         {
             MessageLoaderParms parms("Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",              MessageLoaderParms parms(
                   "Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",
                                                          "Could not get private key.");                                                          "Could not get private key.");
             PEG_METHOD_EXIT();             PEG_METHOD_EXIT();
             throw SSLException(parms);             throw SSLException(parms);
Line 968 
Line 1157 
 { {
     PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()");     PEG_METHOD_ENTER(TRC_SSL, "_verifyPrivateKey()");
  
     if (SSL_CTX_use_PrivateKey_file(ctx, keyPath.getCString(), SSL_FILETYPE_PEM) <= 0)      // Open the private key file.
   
       FILE* is = Executor::openFile(keyPath.getCString(), 'r');
   
       if (!is)
       {
           PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
               String("failed to open private key file: " + keyPath));
           return false;
       }
   
       // Read the private key from the input stream.
   
       EVP_PKEY* pkey;
       pkey = PEM_read_PrivateKey(is, NULL, NULL, NULL);
   
       if (!pkey)
       {
           PEG_TRACE_CSTRING(
               TRC_SSL, Tracer::LEVEL2, "failed to create private key");
           return false;
       }
   
       // Close the input stream.
   
       fclose(is);
   
       // Associate the new private key with the SSL context object.
   
       if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0)
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,
             "---> SSL: no private key found in " + String(keyPath));              String("---> SSL: no private key found in " + keyPath));
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         return false;         return false;
     }     }
  
       // Check private key for validity.
   
     if (!SSL_CTX_check_private_key(ctx))     if (!SSL_CTX_check_private_key(ctx))
     {     {
         PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,          PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2,
             "---> SSL: Private and public key do not match");             "---> SSL: Private and public key do not match");
         PEG_METHOD_EXIT();         PEG_METHOD_EXIT();
         return false;         return false;
Line 1008 
Line 1228 
     return _keyPath;     return _keyPath;
 } }
  
   #ifdef PEGASUS_USE_DEPRECATED_INTERFACES
   String SSLContextRep::getTrustStoreUserName() const
   {
       return String::EMPTY;
   }
   #endif
   
 String SSLContextRep::getCRLPath() const String SSLContextRep::getCRLPath() const
 { {
     return _crlPath;     return _crlPath;
Line 1018 
Line 1245 
     return _crlStore;     return _crlStore;
 } }
  
   void SSLContextRep::setCRLStore(X509_STORE* store)
   {
       _crlStore = store;
   }
   
 Boolean SSLContextRep::isPeerVerificationEnabled() const Boolean SSLContextRep::isPeerVerificationEnabled() const
 { {
     return _verifyPeer;     return _verifyPeer;
 } }
  
 SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const  SSLCertificateVerifyFunction*
       SSLContextRep::getSSLCertificateVerifyFunction() const
 { {
     return _certificateVerifyFunction;     return _certificateVerifyFunction;
 } }
Line 1034 
Line 1267 
 // these definitions are used if ssl is not available // these definitions are used if ssl is not available
 // //
  
 SSLContextRep::SSLContextRep(const String& trustStore,  SSLContextRep::SSLContextRep(
       const String& trustStore,
                        const String& certPath,                        const String& certPath,
                        const String& keyPath,                        const String& keyPath,
                        const String& crlPath,                        const String& crlPath,
                        SSLCertificateVerifyFunction* verifyCert,                        SSLCertificateVerifyFunction* verifyCert,
                        const String& randomFile)                        const String& randomFile)
 {}  {
   }
  
 SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {} SSLContextRep::SSLContextRep(const SSLContextRep& sslContextRep) {}
  
Line 1048 
Line 1283 
  
 SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; } SSL_CTX * SSLContextRep::_makeSSLContext() { return 0; }
  
 Boolean SSLContextRep::_verifyPrivateKey(SSL_CTX *ctx,  Boolean SSLContextRep::_verifyPrivateKey(
                                          const String& keyPath) { return false; }      SSL_CTX *ctx,
       const String& keyPath)
   {
       return false;
   }
  
 SSL_CTX * SSLContextRep::getContext() const { return 0; } SSL_CTX * SSLContextRep::getContext() const { return 0; }
  
Line 1059 
Line 1298 
  
 String SSLContextRep::getKeyPath() const { return String::EMPTY; } String SSLContextRep::getKeyPath() const { return String::EMPTY; }
  
   #ifdef PEGASUS_USE_DEPRECATED_INTERFACES
   String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; }
   #endif
   
 String SSLContextRep::getCRLPath() const { return String::EMPTY; } String SSLContextRep::getCRLPath() const { return String::EMPTY; }
  
 X509_STORE* SSLContextRep::getCRLStore() const { return NULL; } X509_STORE* SSLContextRep::getCRLStore() const { return NULL; }
  
   void SSLContextRep::setCRLStore(X509_STORE* store) { }
   
 Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; } Boolean SSLContextRep::isPeerVerificationEnabled() const { return false; }
  
 SSLCertificateVerifyFunction* SSLContextRep::getSSLCertificateVerifyFunction() const { return NULL; }  SSLCertificateVerifyFunction*
       SSLContextRep::getSSLCertificateVerifyFunction() const
   {
       return NULL;
   }
  
 void SSLContextRep::init_ssl() {} void SSLContextRep::init_ssl() {}
  
Line 1085 
Line 1334 
     SSLCertificateVerifyFunction* verifyCert,     SSLCertificateVerifyFunction* verifyCert,
     const String& randomFile)     const String& randomFile)
 { {
     _rep = new SSLContextRep(trustStore, String::EMPTY, String::EMPTY, String::EMPTY, verifyCert, randomFile);      _rep = new SSLContextRep(
           trustStore,
           String::EMPTY,
           String::EMPTY,
           String::EMPTY,
           verifyCert,
           randomFile);
 } }
  
 SSLContext::SSLContext( SSLContext::SSLContext(
Line 1095 
Line 1350 
     SSLCertificateVerifyFunction* verifyCert,     SSLCertificateVerifyFunction* verifyCert,
     const String& randomFile)     const String& randomFile)
 { {
     _rep = new SSLContextRep(trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile);      _rep = new SSLContextRep(
           trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile);
 } }
  
 //PEP187 //PEP187
Line 1107 
Line 1363 
         SSLCertificateVerifyFunction* verifyCert,         SSLCertificateVerifyFunction* verifyCert,
         const String& randomFile)         const String& randomFile)
 { {
     _rep = new SSLContextRep(trustStore, certPath, keyPath, crlPath, verifyCert, randomFile);  #ifndef PEGASUS_ENABLE_SSL_CRL_VERIFICATION
       if (crlPath.size() > 0)
       {
           MessageLoaderParms parms(
               "Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",
               "SSL CRL verification is not enabled.");
           throw Exception(parms);
       }
   #endif
       _rep = new SSLContextRep(
           trustStore, certPath, keyPath, crlPath, verifyCert, randomFile);
   }
   
   #ifdef PEGASUS_USE_DEPRECATED_INTERFACES
   SSLContext::SSLContext(
       const String& trustStore,
       const String& certPath,
       const String& keyPath,
       SSLCertificateVerifyFunction* verifyCert,
       String trustStoreUserName,
       const String& randomFile)
   {
       _rep = new SSLContextRep(
           trustStore, certPath, keyPath, String::EMPTY, verifyCert, randomFile);
 } }
   #endif
  
 SSLContext::SSLContext(const SSLContext& sslContext) SSLContext::SSLContext(const SSLContext& sslContext)
 { {
Line 1127 
Line 1407 
  
 String SSLContext::getTrustStore() const String SSLContext::getTrustStore() const
 { {
     return (_rep->getTrustStore());      return _rep->getTrustStore();
 } }
  
 String SSLContext::getCertPath() const String SSLContext::getCertPath() const
 { {
     return (_rep->getCertPath());      return _rep->getCertPath();
 } }
  
 String SSLContext::getKeyPath() const String SSLContext::getKeyPath() const
 { {
     return (_rep->getKeyPath());      return _rep->getKeyPath();
 } }
  
 String SSLContext::getCRLPath() const String SSLContext::getCRLPath() const
 { {
     return (_rep->getCRLPath());  #ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION
       return _rep->getCRLPath();
   #else
       MessageLoaderParms parms(
           "Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",
           "SSL CRL verification is not enabled.");
       throw Exception(parms);
       PEGASUS_UNREACHABLE(return String::EMPTY;)
   #endif
 } }
  
 X509_STORE* SSLContext::getCRLStore() const X509_STORE* SSLContext::getCRLStore() const
 { {
     return (_rep->getCRLStore());  #ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION
       return _rep->getCRLStore();
   #else
       MessageLoaderParms parms(
           "Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",
           "SSL CRL verification is not enabled.");
       throw Exception(parms);
       PEGASUS_UNREACHABLE(return 0;)
   #endif
 } }
  
 Boolean SSLContext::isPeerVerificationEnabled() const Boolean SSLContext::isPeerVerificationEnabled() const
 { {
     return (_rep->isPeerVerificationEnabled());      return _rep->isPeerVerificationEnabled();
 } }
  
 SSLCertificateVerifyFunction* SSLContext::getSSLCertificateVerifyFunction() const  #ifdef PEGASUS_USE_DEPRECATED_INTERFACES
   String SSLContext::getTrustStoreUserName() const
   {
       return _rep->getTrustStoreUserName();
   }
   #endif
   
   SSLCertificateVerifyFunction*
       SSLContext::getSSLCertificateVerifyFunction() const
 { {
     return (_rep->getSSLCertificateVerifyFunction());      return _rep->getSSLCertificateVerifyFunction();
 } }
  
 /////////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////////
Line 1293 
Line 1597 
  
 String SSLCertificateInfo::getSubjectName() const String SSLCertificateInfo::getSubjectName() const
 { {
     return (_rep->subjectName);      return _rep->subjectName;
 } }
  
 String SSLCertificateInfo::getIssuerName() const String SSLCertificateInfo::getIssuerName() const
 { {
     return (_rep->issuerName);      return _rep->issuerName;
 } }
  
 Uint32 SSLCertificateInfo::getVersionNumber() const Uint32 SSLCertificateInfo::getVersionNumber() const
 { {
     return (_rep->versionNumber);      return _rep->versionNumber;
 } }
  
 long SSLCertificateInfo::getSerialNumber() const long SSLCertificateInfo::getSerialNumber() const
 { {
     return (_rep->serialNumber);      return _rep->serialNumber;
 } }
  
 CIMDateTime SSLCertificateInfo::getNotBefore() const CIMDateTime SSLCertificateInfo::getNotBefore() const
 { {
     return (_rep->notBefore);      return _rep->notBefore;
 } }
  
 CIMDateTime SSLCertificateInfo::getNotAfter() const CIMDateTime SSLCertificateInfo::getNotAfter() const
 { {
     return (_rep->notAfter);      return _rep->notAfter;
 } }
  
 Uint32 SSLCertificateInfo::getErrorDepth() const Uint32 SSLCertificateInfo::getErrorDepth() const
 { {
     return (_rep->depth);      return _rep->depth;
 } }
  
 Uint32 SSLCertificateInfo::getErrorCode()  const Uint32 SSLCertificateInfo::getErrorCode()  const
 { {
     return (_rep->errorCode);      return _rep->errorCode;
 } }
  
 void SSLCertificateInfo::setErrorCode(const int errorCode) void SSLCertificateInfo::setErrorCode(const int errorCode)
Line 1338 
Line 1642 
  
 String SSLCertificateInfo::getErrorString() const String SSLCertificateInfo::getErrorString() const
 { {
     return (_rep->errorString);      return _rep->errorString;
 } }
  
 Uint32 SSLCertificateInfo::getResponseCode()  const Uint32 SSLCertificateInfo::getResponseCode()  const
 { {
     return (_rep->respCode);      return _rep->respCode;
 } }
  
 void SSLCertificateInfo::setResponseCode(const int respCode) void SSLCertificateInfo::setResponseCode(const int respCode)
Line 1381 
Line 1685 
     sprintf(buf, "Version number: %d\n", _rep->versionNumber);     sprintf(buf, "Version number: %d\n", _rep->versionNumber);
     s.append(buf);     s.append(buf);
  
     sprintf(buf, "Serial number: %ld\n", _rep->serialNumber);      sprintf(buf, "Serial number: %lu\n", _rep->serialNumber);
     s.append(buf);     s.append(buf);
  
     s.append("Not before date: ");     s.append("Not before date: ");
Line 1395 
Line 1699 
     return s;     return s;
 } }
  
 SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert, X509_STORE* crlStore)  ///////////////////////////////////////////////////////////////////////////////
   //
   // SSLCallbackInfo
   //
   ///////////////////////////////////////////////////////////////////////////////
   
   SSLCallbackInfo::SSLCallbackInfo(SSLCertificateVerifyFunction* verifyCert)
   {
       _rep = new SSLCallbackInfoRep();
       _rep->verifyCertificateCallback = verifyCert;
       _rep->crlStore = NULL;
   }
   
   SSLCallbackInfo::SSLCallbackInfo(
       SSLCertificateVerifyFunction* verifyCert,
       X509_STORE* crlStore)
   {
       _rep = new SSLCallbackInfoRep();
       _rep->verifyCertificateCallback = verifyCert;
       _rep->crlStore = crlStore;
   }
   
   SSLCallbackInfo::SSLCallbackInfo(
       SSLCertificateVerifyFunction* verifyCert,
       X509_STORE* crlStore,
       String ipAddress)
 { {
     verifyCertificateCallback = verifyCert;      _rep = new SSLCallbackInfoRep();
         _crlStore = crlStore;      _rep->verifyCertificateCallback = verifyCert;
     _peerCertificate = NULL;      _rep->crlStore = crlStore;
       _rep->ipAddress = ipAddress;
 } }
  
 SSLCallbackInfo::~SSLCallbackInfo() SSLCallbackInfo::~SSLCallbackInfo()
 { {
     if (_peerCertificate)      PEG_METHOD_ENTER(TRC_SSL, "SSLCallbackInfo::~SSLCallbackInfo");
       for (Uint32 i = 0; i < _rep->peerCertificate.size(); i++)
     {     {
         delete _peerCertificate;          delete _rep->peerCertificate[i];
     }     }
       delete _rep;
       PEG_METHOD_EXIT();
 } }
  
 PEGASUS_NAMESPACE_END PEGASUS_NAMESPACE_END

Legend:
Removed from v.1.45  
changed lines
  Added in v.1.84
No CVS admin address has been configured
 Powered by
ViewCVS 0.9.2