pegasus/src/Pegasus/Common/SSLContext.cpp - diff

Return to SSLContext.cpp CVS log

Up to [Pegasus] / pegasus / src / Pegasus / Common

Diff for /pegasus/src/Pegasus/Common/SSLContext.cpp between version 1.96.4.1 and 1.110

version 1.96.4.1, 2008/07/01 15:18:01

version 1.110, 2011/08/11 13:08:59

Line 1

//%2006////////////////////////////////////////////////////////////////////////

//%LICENSE////////////////////////////////////////////////////////////////

// Licensed to The Open Group (TOG) under one or more contributor license

// Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.

// agreements. Refer to the OpenPegasusNOTICE.txt file distributed with

// this work for additional information regarding copyright ownership.

// IBM Corp.; EMC Corporation, The Open Group.

// Each contributor licenses this file to you under the OpenPegasus Open

// Source License; you may not use this file except in compliance with the

// IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.

// License.

// EMC Corporation; VERITAS Software Corporation; The Open Group.

// Permission is hereby granted, free of charge, to any person obtaining a

// copy of this software and associated documentation files (the "Software"),

// EMC Corporation; Symantec Corporation; The Open Group.

// to deal in the Software without restriction, including without limitation

// the rights to use, copy, modify, merge, publish, distribute, sublicense,

// Permission is hereby granted, free of charge, to any person obtaining a copy

// and/or sell copies of the Software, and to permit persons to whom the

// of this software and associated documentation files (the "Software"), to

// Software is furnished to do so, subject to the following conditions:

// deal in the Software without restriction, including without limitation the

// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or

// The above copyright notice and this permission notice shall be included

// sell copies of the Software, and to permit persons to whom the Software is

// in all copies or substantial portions of the Software.

// furnished to do so, subject to the following conditions:

// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

// THE ABOVE COPYRIGHT NOTICE AND THIS PERMISSION NOTICE SHALL BE INCLUDED IN

// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

// ALL COPIES OR SUBSTANTIAL PORTIONS OF THE SOFTWARE. THE SOFTWARE IS PROVIDED

// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

// "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT

// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY

// LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR

// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,

// PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT

// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

// ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION

// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

//==============================================================================

//////////////////////////////////////////////////////////////////////////

//%/////////////////////////////////////////////////////////////////////////////

Line 58

Line 56

typedef struct x509_store_ctx_st X509_STORE_CTX;

typedef struct Timestamp

{

char year[4];

char month[2];

char day[2];

char hour[2];

char minutes[2];

char seconds[2];

char dot;

char microSeconds[6];

char plusOrMinus;

char utcOffset[3];

char padding[3];

} Timestamp_t;

PEGASUS_USING_STD;

PEGASUS_NAMESPACE_BEGIN

const int SSLCallbackInfo::SSL_CALLBACK_INDEX = 0;

class SSLCertificateInfoRep

{

public:

String subjectName;

String issuerName;

Uint32 depth;

Uint32 errorCode;

Uint32 respCode;

String errorString;

Uint32 versionNumber;

long serialNumber;

CIMDateTime notBefore;

CIMDateTime notAfter;

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

String peerCertificate;

#endif

};

// use the following definitions only if SSL is available

Line 96

Line 97

{

struct tm time;

int offset;

Timestamp_t timeStamp;

char tempString[80];

char plusOrMinus = '+';

unsigned char* utcTimeData = utcTime->data;

Line 144

Line 143

}

#undef g2

memset((void *)&timeStamp, 0, sizeof(Timestamp_t));

// Format the date.

if (plusOrMinus == '-')

sprintf((char *) &timeStamp,"%04d%02d%02d%02d%02d%02d.%06d%04d",

{

offset = -offset;

}

CIMDateTime dateTime = CIMDateTime(

time.tm_year,

time.tm_mon + 1,

time.tm_mday,

Line 155

Line 157

time.tm_min,

time.tm_sec,

offset);

timeStamp.plusOrMinus = plusOrMinus;

CIMDateTime dateTime;

dateTime.clear();

strcpy(tempString, (char *)&timeStamp);

dateTime.set(tempString);

return dateTime;

}

Line 274

Line 269

X509_REVOKED* revokedCert = NULL;

for (int i = 0; i < sk_X509_REVOKED_num(revokedCerts); i++)

{

revokedCert = (X509_REVOKED *)sk_value(X509_CRL_get_REVOKED(crl), i);

revokedCert = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i);

//a matching serial number indicates revocation

if (ASN1_INTEGER_cmp(revokedCert->serialNumber, serialNumber) == 0)

{

Line 410

Line 404

// insert at the beginning of the array so that the peer certificate is

// first and the root CA is last

exData->_rep->peerCertificate.insert(0, new SSLCertificateInfo(

SSLCertificateInfo *certInfo = new SSLCertificateInfo(

subjectName, issuerName, version, serialNumber,

subjectName,

notBefore, notAfter, depth, errorCode, errorStr, preVerifyOk));

issuerName,

version,

serialNumber,

notBefore,

notAfter,

depth,

errorCode,

errorStr,

preVerifyOk);

String peerCertificate;

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

// Get Base64 encoded DER (PEM) certificate

char *data = 0;

long length = 0;

BIO *bio = BIO_new(BIO_s_mem());

if (bio)

{

if (PEM_write_bio_X509(bio, currentCert) == 0)

{

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1,

"PEM converion failed.");

}

else

{

length = BIO_get_mem_data(bio, &data);

peerCertificate.assign(data, (Uint32)length);

}

BIO_free_all(bio);

}

certInfo->_rep->peerCertificate = peerCertificate;

#endif

exData->_rep->peerCertificate.insert(0, certInfo);

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, "Created SSLCertificateInfo");

Line 491

Line 522

const String& keyPath,

const String& crlPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

const String& randomFile,

const String& cipherSuite)

{

PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()");

Line 500

Line 532

_keyPath = keyPath;

_crlPath = crlPath;

_certificateVerifyFunction = verifyCert;

_cipherSuite = cipherSuite;

// If a truststore and/or peer verification function is specified,

Line 525

Line 558

_verifyPeer = sslContextRep._verifyPeer;

_certificateVerifyFunction = sslContextRep._certificateVerifyFunction;

_randomFile = sslContextRep._randomFile;

_cipherSuite = sslContextRep._cipherSuite;

_sslContext = _makeSSLContext();

Line 580

Line 614

retVal = RAND_load_file(randomFile.getCString(), -1);

if ( retVal < 0 )

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

String("Not enough seed data in seed file: ") + randomFile);

"Not enough seed data in seed file: %s",

(const char*)randomFile.getCString()));

PEG_METHOD_EXIT();

// do not put in $0 in default message, but pass in filename

// for bundle message

Line 594

Line 629

}

else

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

String("seed file - " + randomFile + " does not exist."));

"Seed file \'%s\' does not exist.",

(const char*)randomFile.getCString()));

PEG_METHOD_EXIT();

MessageLoaderParms parms(

"Common.SSLContext.SEED_FILE_DOES_NOT_EXIST",

Line 694

Line 730

}

#endif

if (_cipherSuite != String::EMPTY)

{

if (!(SSL_CTX_set_cipher_list(sslContext, _cipherSuite.getCString())))

{

PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3,

"---> SSL: Cipher Suite could not be specified");

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_SET_CIPHER_LIST",

"Could not set the cipher list");

throw SSLException(parms);

}

else

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

"---> SSL: Cipher suite set to %s",

(const char *)_cipherSuite.getCString()));

}

// set overall SSL Context flags

Line 766

Line 819

// load certificates from the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

String("---> SSL: Loading certificates from the trust store: " +

"---> SSL: Loading certificates from the trust store: %s",

_trustStore));

(const char*)_trustStore.getCString()));

if ((!SSL_CTX_load_verify_locations(

sslContext, NULL, _trustStore.getCString())) ||

(!SSL_CTX_set_default_verify_paths(sslContext)))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

String("---> SSL: Could not load certificates from the "

"---> SSL: Could not load certificates from the "

"trust store: " + _trustStore));

"trust store: %s ",(const char*)_trustStore.getCString()));

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",

"Could not load certificates in to trust store.");

Line 801

Line 854

// load certificates from the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

String("---> SSL: Loading certificates from the trust "

"---> SSL: Loading certificates from the trust store: %s",

"store: " + _trustStore));

(const char*)_trustStore.getCString()));

if ((!SSL_CTX_load_verify_locations(

sslContext, _trustStore.getCString(), NULL)) ||

(!SSL_CTX_set_default_verify_paths(sslContext)))

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

String("---> SSL: Could not load certificates from the "

"---> SSL: Could not load certificates from the "

"trust store: " + _trustStore));

"trust store: %s",

(const char*)_trustStore.getCString()));

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_LOAD_CERTIFICATES",

"Could not load certificates in to trust store.");

Line 824

Line 878

// no certificates found in the trust store

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2,

PEG_TRACE((TRC_SSL, Tracer::LEVEL2,

String("---> SSL: No certificates to load from the trust "

"---> SSL: No certificates to load from the "

"store: " + _trustStore));

"trust store: %s",(const char*)_trustStore.getCString()));

}

Line 906

Line 960

// load the specified server certificates

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

String("---> SSL: Loading server certificate from: " + _certPath));

"---> SSL: Loading server certificate from: %s",

(const char*)_certPath.getCString()));

if (SSL_CTX_use_certificate_file(sslContext,

_certPath.getCString(), SSL_FILETYPE_PEM) <=0)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

String("---> SSL: No server certificate found in " +

"---> SSL: No server certificate found in %s",

_certPath));

(const char*)_certPath.getCString()));

MessageLoaderParms parms(

"Common.SSLContext.COULD_NOT_GET_SERVER_CERTIFICATE",

"Common.SSLContext.COULD_NOT_ACCESS_SERVER_CERTIFICATE",

"Could not get server certificate.");

"Could not access server certificate in $0.",

(const char*)_certPath.getCString());

PEG_METHOD_EXIT();

throw SSLException(parms);

}

Line 931

Line 987

if (_keyPath == String::EMPTY)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

String("---> SSL: loading private key from: " + _certPath));

"---> SSL: Key file empty, loading private key from "

"certificate file: %s",(const char*)_certPath.getCString()));

// load the private key and check for validity

Line 955

Line 1012

if (_keyPath != String::EMPTY && !keyLoaded)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

String("---> SSL: loading private key from: " + _keyPath));

"---> SSL: loading private key from: %s",

(const char*)_keyPath.getCString()));

// load given private key and check for validity

Line 985

Line 1043

if (!is)

{

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1,

PEG_TRACE((TRC_SSL, Tracer::LEVEL1,

String("failed to open private key file: " + keyPath));

"---> SSL: failed to open private key file: %s",

(const char*)keyPath.getCString()));

return false;

}

Line 998

Line 1057

if (!pkey)

{

PEG_TRACE_CSTRING(

TRC_SSL, Tracer::LEVEL1, "failed to create private key");

TRC_SSL, Tracer::LEVEL1, "---> SSL: failed to create private key");

return false;

}

Line 1011

Line 1070

if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0)

{

EVP_PKEY_free(pkey);

PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3,

PEG_TRACE((TRC_SSL, Tracer::LEVEL3,

String("---> SSL: no private key found in " + keyPath));

"---> SSL: no private key found in %s",

(const char*)keyPath.getCString()));

PEG_METHOD_EXIT();

return false;

}

Line 1060

Line 1120

}

#endif

String SSLContextRep::getCipherSuite() const

{

return _cipherSuite;

}

String SSLContextRep::getCRLPath() const

{

return _crlPath;

Line 1129

Line 1194

const String& keyPath,

const String& crlPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile)

const String& randomFile,

const String& cipherSuite)

{

}

Line 1154

Line 1220

String SSLContextRep::getKeyPath() const { return String::EMPTY; }

String SSLContextRep::getCipherSuite() const { return String::EMPTY; }

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

String SSLContextRep::getTrustStoreUserName() const { return String::EMPTY; }

#endif

Line 1197

Line 1265

String::EMPTY,

verifyCert,

randomFile);

randomFile,

String::EMPTY);

}

SSLContext::SSLContext(

Line 1233

Line 1302

trustStore, certPath, keyPath, crlPath, verifyCert, randomFile);

}

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

SSLContext::SSLContext(

const String& trustStore,

const String& certPath,

const String& keyPath,

const String& crlPath,

SSLCertificateVerifyFunction* verifyCert,

const String& randomFile,

const String& cipherSuite)

{

#ifndef PEGASUS_ENABLE_SSL_CRL_VERIFICATION

if (crlPath.size() > 0)

{

MessageLoaderParms parms(

"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION",

"SSL CRL verification is not enabled.");

throw Exception(parms);

}

#endif

_rep = new SSLContextRep(

trustStore, certPath, keyPath, crlPath, verifyCert, randomFile,

cipherSuite);

}

#endif

#ifdef PEGASUS_USE_DEPRECATED_INTERFACES

SSLContext::SSLContext(

const String& trustStore,

Line 1315

Line 1409

}

#endif

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

String SSLContext::getCipherSuite() const

{

return _rep->getCipherSuite();

}

#endif

SSLCertificateVerifyFunction*

SSLContext::getSSLCertificateVerifyFunction() const

{

Line 1370

Line 1471

const int SSLCertificateInfo::V_ERR_APPLICATION_VERIFICATION = 50;

class SSLCertificateInfoRep

{

public:

String subjectName;

String issuerName;

Uint32 depth;

Uint32 errorCode;

Uint32 respCode;

String errorString;

Uint32 versionNumber;

long serialNumber;

CIMDateTime notBefore;

CIMDateTime notAfter;

};

SSLCertificateInfo::SSLCertificateInfo(

const String subjectName,

const String issuerName,

Line 1445

Line 1530

_rep->errorCode = certificateInfo._rep->errorCode;

_rep->errorString = certificateInfo._rep->errorString;

_rep->respCode = certificateInfo._rep->respCode;

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

_rep->peerCertificate = certificateInfo._rep->peerCertificate;

#endif

}

// Dummy constructor made private to disallow default construction

Line 1517

Line 1605

_rep->respCode = respCode;

}

#ifdef PEGASUS_USE_EXPERIMENTAL_INTERFACES

const String &SSLCertificateInfo::getPeerCertificate() const

{

return _rep->peerCertificate;

}

#endif

String SSLCertificateInfo::toString() const

{

char buf[1024];

Legend:

Removed from v.1.96.4.1
changed lines
	Added in v.1.110

No CVS admin address has been configured