version 1.89, 2007/10/05 18:31:56
|
version 1.96.4.1, 2008/07/01 15:18:01
|
|
|
#ifdef PEGASUS_OS_PASE | #ifdef PEGASUS_OS_PASE |
# include <ILEWrapper/ILEUtilities.h> | # include <ILEWrapper/ILEUtilities.h> |
#endif | #endif |
// |
|
// Typedef's for OpenSSL callback functions. |
|
// |
|
extern "C" |
|
{ |
|
typedef void (* CRYPTO_SET_LOCKING_CALLBACK)(int, int, const char *, int); |
|
typedef unsigned long (* CRYPTO_SET_ID_CALLBACK)(void); |
|
}; |
|
| |
typedef struct x509_store_ctx_st X509_STORE_CTX; | typedef struct x509_store_ctx_st X509_STORE_CTX; |
| |
|
|
// | // |
#ifdef PEGASUS_HAS_SSL | #ifdef PEGASUS_HAS_SSL |
| |
// Mutex for SSL locks which will get initialized by AutoArrayPtr constructor. |
AutoArrayPtr<Mutex> SSLEnvironmentInitializer::_sslLocks; |
AutoArrayPtr<Mutex> SSLContextRep::_sslLocks; |
int SSLEnvironmentInitializer::_instanceCount = 0; |
|
Mutex SSLEnvironmentInitializer::_instanceCountMutex; |
// Mutex for _countRep. |
|
Mutex SSLContextRep::_countRepMutex; |
|
|
|
// Initialise _count for SSLContextRep objects. |
|
int SSLContextRep::_countRep = 0; |
|
| |
| |
// | // |
|
|
if (X509_STORE_get_by_subject( | if (X509_STORE_get_by_subject( |
&crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0) | &crlStoreCtx, X509_LU_CRL, issuerName, &obj) <= 0) |
{ | { |
|
X509_STORE_CTX_cleanup(&crlStoreCtx); |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, | PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL3, |
"---> SSL: No CRL by that issuer"); | "---> SSL: No CRL by that issuer"); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
|
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2, | PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2, |
"---> SSL: Certificate is revoked"); | "---> SSL: Certificate is revoked"); |
X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED); | X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED); |
|
X509_CRL_free(crl); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return 1; | return 1; |
} | } |
} | } |
| |
|
X509_CRL_free(crl); |
|
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, | PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
"---> SSL: Certificate is not revoked at this level"); | "---> SSL: Certificate is not revoked at this level"); |
| |
|
|
char buf[256]; | char buf[256]; |
X509 *currentCert; | X509 *currentCert; |
SSL *ssl; | SSL *ssl; |
int verifyError = X509_V_OK; |
|
int revoked = -1; | int revoked = -1; |
| |
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, | PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
|
|
// | // |
if (!preVerifyOk) | if (!preVerifyOk) |
{ | { |
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL2, |
"---> SSL: certificate default verification error: %s", | "---> SSL: certificate default verification error: %s", |
(const char*)errorStr.getCString())); | (const char*)errorStr.getCString())); |
} | } |
|
|
(CIMDateTime::getDifference( | (CIMDateTime::getDifference( |
CIMDateTime::getCurrentDateTime(), notBefore) > 0)) | CIMDateTime::getCurrentDateTime(), notBefore) > 0)) |
{ | { |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2, |
"Certificate was not yet valid."); | "Certificate was not yet valid."); |
| |
X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_NOT_YET_VALID); | X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_NOT_YET_VALID); |
|
|
// This is because OpenSSL retains the original default error in case | // This is because OpenSSL retains the original default error in case |
// we want to use it later. | // we want to use it later. |
// To set the error, we could use X509_STORE_CTX_set_error(ctx, | // To set the error, we could use X509_STORE_CTX_set_error(ctx, |
// verifyError); but there is no real benefit to doing that here. |
// X509_V_OK); but there is no real benefit to doing that here. |
// | // |
if (exData->_rep->verifyCertificateCallback == NULL) | if (exData->_rep->verifyCertificateCallback == NULL) |
{ | { |
|
|
} | } |
else // verification failed, handshake will be immediately terminated | else // verification failed, handshake will be immediately terminated |
{ | { |
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"--> SSL: _rep->verifyCertificateCallback() returned error %d", | "--> SSL: _rep->verifyCertificateCallback() returned error %d", |
exData->_rep->peerCertificate[0]->getErrorCode())); | exData->_rep->peerCertificate[0]->getErrorCode())); |
| |
|
|
} | } |
| |
// | // |
// Implement OpenSSL locking callback. |
|
// |
|
void pegasus_locking_callback( |
|
int mode, |
|
int type, |
|
const char* file, |
|
int line) |
|
{ |
|
// Check whether the mode is lock or unlock. |
|
|
|
if ( mode & CRYPTO_LOCK ) |
|
{ |
|
/*PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
|
"Now locking for type %d", type));*/ |
|
SSLContextRep::_sslLocks.get()[type].lock( ); |
|
} |
|
else |
|
{ |
|
/*PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
|
"Now unlocking for type %d", type));*/ |
|
SSLContextRep::_sslLocks.get()[type].unlock( ); |
|
} |
|
} |
|
|
|
// |
|
// Initialize OpenSSL Locking and id callbacks. |
|
// |
|
void SSLContextRep::init_ssl() |
|
{ |
|
// Allocate Memory for _sslLocks. SSL locks needs to be able to handle |
|
// up to CRYPTO_num_locks() different mutex locks. |
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
|
"Initialized SSL callback."); |
|
|
|
_sslLocks.reset(new Mutex[CRYPTO_num_locks()]); |
|
|
|
#if defined(PEGASUS_HAVE_PTHREADS) && !defined(PEGASUS_OS_VMS) |
|
// Set the ID callback. The ID callback returns a thread ID. |
|
CRYPTO_set_id_callback((CRYPTO_SET_ID_CALLBACK) pthread_self); |
|
#endif |
|
|
|
// Set the locking callback to pegasus_locking_callback. |
|
|
|
CRYPTO_set_locking_callback( |
|
(CRYPTO_SET_LOCKING_CALLBACK) pegasus_locking_callback); |
|
|
|
} |
|
|
|
// Free OpenSSL Locking and id callbacks. |
|
void SSLContextRep::free_ssl() |
|
{ |
|
// Cleanup _sslLocks and set locking & id callback to NULL. |
|
|
|
CRYPTO_set_locking_callback(NULL); |
|
CRYPTO_set_id_callback (NULL); |
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
|
"Freed SSL callback."); |
|
_sslLocks.reset(); |
|
} |
|
|
|
|
|
// |
|
// SSL context area | // SSL context area |
// | // |
// For the OSs that don't have /dev/random device file, | // For the OSs that don't have /dev/random device file, |
|
|
PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); | PEG_METHOD_ENTER(TRC_SSL, "SSLContextRep::SSLContextRep()"); |
| |
_trustStore = trustStore; | _trustStore = trustStore; |
|
|
_certPath = certPath; | _certPath = certPath; |
|
|
_keyPath = keyPath; | _keyPath = keyPath; |
|
|
_crlPath = crlPath; | _crlPath = crlPath; |
|
|
_crlStore = NULL; |
|
|
|
_certificateVerifyFunction = verifyCert; | _certificateVerifyFunction = verifyCert; |
| |
// | // |
// If a truststore and/or peer verification function is specified, | // If a truststore and/or peer verification function is specified, |
// enable peer verification | // enable peer verification |
// | // |
if (trustStore != String::EMPTY || verifyCert != NULL) |
_verifyPeer = (trustStore != String::EMPTY || verifyCert != NULL); |
{ |
|
_verifyPeer = true; |
|
} |
|
else |
|
{ |
|
_verifyPeer = false; |
|
} |
|
|
|
// |
|
// Initialize SSL callbacks and increment the SSLContextRep object _counter. |
|
// |
|
{ |
|
AutoMutex autoMut(_countRepMutex); |
|
|
|
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
|
"Value of Countrep in constructor %d", _countRep)); |
|
if ( _countRep == 0 ) |
|
{ |
|
init_ssl(); |
|
|
|
// |
|
// load SSL library |
|
// |
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
|
"Before calling SSL_load_error_strings"); |
|
|
|
SSL_load_error_strings(); |
|
|
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
|
"After calling SSL_load_error_strings"); |
|
|
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
|
"Before calling SSL_library_init"); |
|
|
|
SSL_library_init(); |
|
|
|
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
|
"After calling SSL_library_init"); |
|
} |
|
|
|
_countRep++; |
|
} // mutex unlocks here |
|
| |
_randomInit(randomFile); | _randomInit(randomFile); |
| |
|
|
_certPath = sslContextRep._certPath; | _certPath = sslContextRep._certPath; |
_keyPath = sslContextRep._keyPath; | _keyPath = sslContextRep._keyPath; |
_crlPath = sslContextRep._crlPath; | _crlPath = sslContextRep._crlPath; |
_crlStore = sslContextRep._crlStore; |
|
_verifyPeer = sslContextRep._verifyPeer; | _verifyPeer = sslContextRep._verifyPeer; |
_certificateVerifyFunction = sslContextRep._certificateVerifyFunction; | _certificateVerifyFunction = sslContextRep._certificateVerifyFunction; |
_randomFile = sslContextRep._randomFile; | _randomFile = sslContextRep._randomFile; |
| |
// Initialize SSL callbacks and increment the SSLContextRep object _counter. |
|
{ |
|
AutoMutex autoMut(_countRepMutex); |
|
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
|
"Value of Countrep in copy constructor %d", _countRep)); |
|
if ( _countRep == 0 ) |
|
{ |
|
init_ssl(); |
|
} |
|
|
|
_countRep++; |
|
} // mutex unlocks here |
|
|
|
_sslContext = _makeSSLContext(); | _sslContext = _makeSSLContext(); |
|
|
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
} | } |
| |
|
|
| |
SSL_CTX_free(_sslContext); | SSL_CTX_free(_sslContext); |
| |
// Decrement the SSLContextRep object _counter. |
|
{ |
|
AutoMutex autoMut(_countRepMutex); |
|
_countRep--; |
|
// Free SSL locks if no instances of SSLContextRep exist. |
|
|
|
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
|
"Value of Countrep in destructor %d", _countRep)); |
|
if ( _countRep == 0 ) |
|
{ |
|
free_ssl(); |
|
ERR_free_strings(); |
|
} |
|
|
|
} |
|
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
} | } |
| |
|
|
// | // |
if ( randomFile == String::EMPTY ) | if ( randomFile == String::EMPTY ) |
{ | { |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1, |
"Random seed file is required."); | "Random seed file is required."); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
MessageLoaderParms parms( | MessageLoaderParms parms( |
|
|
retVal = RAND_load_file(randomFile.getCString(), -1); | retVal = RAND_load_file(randomFile.getCString(), -1); |
if ( retVal < 0 ) | if ( retVal < 0 ) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
String("Not enough seed data in seed file: ") + randomFile); | String("Not enough seed data in seed file: ") + randomFile); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
// do not put in $0 in default message, but pass in filename | // do not put in $0 in default message, but pass in filename |
|
|
} | } |
else | else |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
String("seed file - " + randomFile + " does not exist.")); | String("seed file - " + randomFile + " does not exist.")); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
MessageLoaderParms parms( | MessageLoaderParms parms( |
|
|
int seedRet = RAND_status(); | int seedRet = RAND_status(); |
if ( seedRet == 0 ) | if ( seedRet == 0 ) |
{ | { |
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"Not enough seed data in random seed file, " | "Not enough seed data in random seed file, " |
"RAND_status = %d", | "RAND_status = %d", |
seedRet)); | seedRet)); |
|
|
{ | { |
// generate random number for pase must use specify function | // generate random number for pase must use specify function |
unsigned char prn[1024]; | unsigned char prn[1024]; |
umeGenerateRandomNumber(prn); |
umeGenerateRandomNumber(prn, sizeof(prn)); |
RAND_seed(prn, 1024); | RAND_seed(prn, 1024); |
} | } |
#endif | #endif |
|
|
int seedRet = RAND_status(); | int seedRet = RAND_status(); |
if (seedRet == 0) | if (seedRet == 0) |
{ | { |
PEG_TRACE((TRC_SSL, Tracer::LEVEL4, |
PEG_TRACE((TRC_SSL, Tracer::LEVEL1, |
"Not enough seed data, RAND_status = %d", | "Not enough seed data, RAND_status = %d", |
seedRet)); | seedRet)); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
|
|
// | // |
// load certificates from the trust store | // load certificates from the trust store |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: Loading certificates from the trust store: " + | String("---> SSL: Loading certificates from the trust store: " + |
_trustStore)); | _trustStore)); |
| |
|
|
sslContext, NULL, _trustStore.getCString())) || | sslContext, NULL, _trustStore.getCString())) || |
(!SSL_CTX_set_default_verify_paths(sslContext))) | (!SSL_CTX_set_default_verify_paths(sslContext))) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
String("---> SSL: Could not load certificates from the " | String("---> SSL: Could not load certificates from the " |
"trust store: " + _trustStore)); | "trust store: " + _trustStore)); |
MessageLoaderParms parms( | MessageLoaderParms parms( |
|
|
// | // |
// load certificates from the trust store | // load certificates from the trust store |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: Loading certificates from the trust " | String("---> SSL: Loading certificates from the trust " |
"store: " + _trustStore)); | "store: " + _trustStore)); |
| |
|
|
sslContext, _trustStore.getCString(), NULL)) || | sslContext, _trustStore.getCString(), NULL)) || |
(!SSL_CTX_set_default_verify_paths(sslContext))) | (!SSL_CTX_set_default_verify_paths(sslContext))) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
String("---> SSL: Could not load certificates from the " | String("---> SSL: Could not load certificates from the " |
"trust store: " + _trustStore)); | "trust store: " + _trustStore)); |
MessageLoaderParms parms( | MessageLoaderParms parms( |
|
|
// one CRL for cimserver? | // one CRL for cimserver? |
X509_LOOKUP* pLookup; | X509_LOOKUP* pLookup; |
| |
_crlStore = X509_STORE_new(); |
_crlStore.reset(X509_STORE_new()); |
|
if (_crlStore.get() == NULL) |
|
{ |
|
PEG_METHOD_EXIT(); |
|
throw PEGASUS_STD(bad_alloc)(); |
|
} |
| |
// the validity of the crlstore was checked in ConfigManager | // the validity of the crlstore was checked in ConfigManager |
// during server startup | // during server startup |
|
|
(const char*)_crlPath.getCString())); | (const char*)_crlPath.getCString())); |
| |
if ((pLookup = X509_STORE_add_lookup( | if ((pLookup = X509_STORE_add_lookup( |
_crlStore, X509_LOOKUP_hash_dir())) == NULL) |
_crlStore.get(), X509_LOOKUP_hash_dir())) == NULL) |
{ | { |
MessageLoaderParms parms( | MessageLoaderParms parms( |
"Common.SSLContext.COULD_NOT_LOAD_CRLS", | "Common.SSLContext.COULD_NOT_LOAD_CRLS", |
"Could not load certificate revocation list."); | "Could not load certificate revocation list."); |
X509_STORE_free(_crlStore); |
_crlStore.reset(); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
|
|
(const char*)_crlPath.getCString())); | (const char*)_crlPath.getCString())); |
| |
if ((pLookup = X509_STORE_add_lookup( | if ((pLookup = X509_STORE_add_lookup( |
_crlStore, X509_LOOKUP_file())) == NULL) |
_crlStore.get(), X509_LOOKUP_file())) == NULL) |
{ | { |
MessageLoaderParms parms( | MessageLoaderParms parms( |
"Common.SSLContext.COULD_NOT_LOAD_CRLS", | "Common.SSLContext.COULD_NOT_LOAD_CRLS", |
"Could not load certificate revocation list."); | "Could not load certificate revocation list."); |
X509_STORE_free(_crlStore); |
_crlStore.reset(); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
throw SSLException(parms); | throw SSLException(parms); |
} | } |
|
|
// | // |
// load the specified server certificates | // load the specified server certificates |
// | // |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: Loading server certificate from: " + _certPath)); | String("---> SSL: Loading server certificate from: " + _certPath)); |
| |
if (SSL_CTX_use_certificate_file(sslContext, | if (SSL_CTX_use_certificate_file(sslContext, |
_certPath.getCString(), SSL_FILETYPE_PEM) <=0) | _certPath.getCString(), SSL_FILETYPE_PEM) <=0) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
String("---> SSL: No server certificate found in " + | String("---> SSL: No server certificate found in " + |
_certPath)); | _certPath)); |
MessageLoaderParms parms( | MessageLoaderParms parms( |
|
|
// | // |
if (_keyPath == String::EMPTY) | if (_keyPath == String::EMPTY) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: loading private key from: " + _certPath)); | String("---> SSL: loading private key from: " + _certPath)); |
// | // |
// load the private key and check for validity | // load the private key and check for validity |
|
|
// | // |
if (_keyPath != String::EMPTY && !keyLoaded) | if (_keyPath != String::EMPTY && !keyLoaded) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: loading private key from: " + _keyPath)); | String("---> SSL: loading private key from: " + _keyPath)); |
// | // |
// load given private key and check for validity | // load given private key and check for validity |
|
|
| |
if (!is) | if (!is) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL1, |
String("failed to open private key file: " + keyPath)); | String("failed to open private key file: " + keyPath)); |
return false; | return false; |
} | } |
|
|
if (!pkey) | if (!pkey) |
{ | { |
PEG_TRACE_CSTRING( | PEG_TRACE_CSTRING( |
TRC_SSL, Tracer::LEVEL2, "failed to create private key"); |
TRC_SSL, Tracer::LEVEL1, "failed to create private key"); |
return false; | return false; |
} | } |
| |
|
|
| |
if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) | if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) |
{ | { |
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL2, |
EVP_PKEY_free(pkey); |
|
PEG_TRACE_STRING(TRC_SSL, Tracer::LEVEL3, |
String("---> SSL: no private key found in " + keyPath)); | String("---> SSL: no private key found in " + keyPath)); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return false; | return false; |
} | } |
| |
|
EVP_PKEY_free(pkey); |
|
|
// Check private key for validity. | // Check private key for validity. |
| |
if (!SSL_CTX_check_private_key(ctx)) | if (!SSL_CTX_check_private_key(ctx)) |
{ | { |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL2, |
PEG_TRACE_CSTRING(TRC_SSL, Tracer::LEVEL1, |
"---> SSL: Private and public key do not match"); | "---> SSL: Private and public key do not match"); |
PEG_METHOD_EXIT(); | PEG_METHOD_EXIT(); |
return false; | return false; |
|
|
return _crlPath; | return _crlPath; |
} | } |
| |
X509_STORE* SSLContextRep::getCRLStore() const |
SharedPtr<X509_STORE, FreeX509STOREPtr> SSLContextRep::getCRLStore() const |
{ | { |
return _crlStore; | return _crlStore; |
} | } |
| |
void SSLContextRep::setCRLStore(X509_STORE* store) | void SSLContextRep::setCRLStore(X509_STORE* store) |
{ | { |
_crlStore = store; |
_crlStore.reset(store); |
} | } |
| |
Boolean SSLContextRep::isPeerVerificationEnabled() const | Boolean SSLContextRep::isPeerVerificationEnabled() const |
|
|
return _certificateVerifyFunction; | return _certificateVerifyFunction; |
} | } |
| |
|
void SSLContextRep::validateCertificate() |
|
{ |
|
BIO* in = BIO_new_file(_certPath.getCString(), "r"); |
|
PEGASUS_ASSERT(in != NULL); |
|
X509* cert = PEM_read_bio_X509(in, NULL, 0, NULL); |
|
BIO_free(in); |
|
PEGASUS_ASSERT(cert != NULL); |
|
|
|
if (X509_cmp_current_time(X509_get_notBefore(cert)) > 0) |
|
{ |
|
X509_free(cert); |
|
MessageLoaderParms parms( |
|
"Common.SSLContext.CERTIFICATE_NOT_YET_VALID", |
|
"Certificate $0 is not yet valid.", |
|
_certPath); |
|
throw SSLException(parms); |
|
} |
|
|
|
if (X509_cmp_current_time(X509_get_notAfter(cert)) < 0) |
|
{ |
|
X509_free(cert); |
|
MessageLoaderParms parms( |
|
"Common.SSLContext.CERTIFICATE_EXPIRED", |
|
"Certificate $0 has expired.", |
|
_certPath); |
|
throw SSLException(parms); |
|
} |
|
|
|
X509_free(cert); |
|
} |
|
|
#else | #else |
| |
// | // |
|
|
| |
String SSLContextRep::getCRLPath() const { return String::EMPTY; } | String SSLContextRep::getCRLPath() const { return String::EMPTY; } |
| |
X509_STORE* SSLContextRep::getCRLStore() const { return NULL; } |
SharedPtr<X509_STORE, FreeX509STOREPtr> SSLContextRep::getCRLStore() const |
|
{ |
|
return SharedPtr<X509_STORE, FreeX509STOREPtr>(); |
|
} |
| |
void SSLContextRep::setCRLStore(X509_STORE* store) { } | void SSLContextRep::setCRLStore(X509_STORE* store) { } |
| |
|
|
return NULL; | return NULL; |
} | } |
| |
void SSLContextRep::init_ssl() {} |
void SSLContextRep::validateCertificate() { } |
|
|
void SSLContextRep::free_ssl() {} |
|
| |
#endif // end of PEGASUS_HAS_SSL | #endif // end of PEGASUS_HAS_SSL |
| |
|
|
X509_STORE* SSLContext::getCRLStore() const | X509_STORE* SSLContext::getCRLStore() const |
{ | { |
#ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION | #ifdef PEGASUS_ENABLE_SSL_CRL_VERIFICATION |
return _rep->getCRLStore(); |
return _rep->getCRLStore().get(); |
#else | #else |
MessageLoaderParms parms( | MessageLoaderParms parms( |
"Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", | "Common.Exception.SSL_CRL_NOT_ENABLED_EXCEPTION", |
|
|
return _rep->getSSLCertificateVerifyFunction(); | return _rep->getSSLCertificateVerifyFunction(); |
} | } |
| |
|
void SSLContext::_validateCertificate() |
|
{ |
|
_rep->validateCertificate(); |
|
} |
|
|
/////////////////////////////////////////////////////////////////////////////// | /////////////////////////////////////////////////////////////////////////////// |
// | // |
// SSLCertificateInfo | // SSLCertificateInfo |
|
|
s.append(_rep->issuerName); | s.append(_rep->issuerName); |
s.append("\n"); | s.append("\n"); |
| |
sprintf(buf, "Depth: %d\n", _rep->depth); |
sprintf(buf, "Depth: %u\n", _rep->depth); |
s.append(buf); | s.append(buf); |
| |
sprintf(buf, "Error code: %d\n", _rep->errorCode); |
sprintf(buf, "Error code: %u\n", _rep->errorCode); |
s.append(buf); | s.append(buf); |
| |
sprintf(buf, "Response (preverify) code: %d\n", _rep->respCode); |
sprintf(buf, "Response (preverify) code: %u\n", _rep->respCode); |
s.append(buf); | s.append(buf); |
| |
s.append("Error string: "); | s.append("Error string: "); |
s.append(_rep->errorString); | s.append(_rep->errorString); |
s.append("\n"); | s.append("\n"); |
| |
sprintf(buf, "Version number: %d\n", _rep->versionNumber); |
sprintf(buf, "Version number: %u\n", _rep->versionNumber); |
s.append(buf); | s.append(buf); |
| |
sprintf(buf, "Serial number: %lu\n", _rep->serialNumber); |
sprintf(buf, "Serial number: %lu\n", (unsigned long)_rep->serialNumber); |
s.append(buf); | s.append(buf); |
| |
s.append("Not before date: "); | s.append("Not before date: "); |