/[monit]/monit/ssl.c
ViewVC logotype

Diff of /monit/ssl.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.10 by chopp, Sat Nov 2 10:47:22 2002 UTC revision 1.11 by hauk, Sun Nov 3 14:38:17 2002 UTC
# Line 85  static void ssl_mutex_lock(int mode, int Line 85  static void ssl_mutex_lock(int mode, int
85  static int ssl_entropy_start(void);  static int ssl_entropy_start(void);
86  static int ssl_entropy_stop(void);  static int ssl_entropy_stop(void);
87    
88  static int verify_init(ssl_server_connection * );  static int verify_init(ssl_server_connection *);
89  static int verify_callback(int, X509_STORE_CTX *);  static int verify_callback(int, X509_STORE_CTX *);
90  static void verify_info(ssl_server_connection *);  static void verify_info(ssl_server_connection *);
91    
92  static pthread_mutex_t   ssl_mutex= PTHREAD_MUTEX_INITIALIZER;  static pthread_mutex_t   ssl_mutex= PTHREAD_MUTEX_INITIALIZER;
93  static pthread_mutex_t * ssl_mutex_table;  static pthread_mutex_t *ssl_mutex_table;
94    
95  static int ssl_initilized=FALSE;  static int ssl_initilized=FALSE;
96  #endif  #endif
# Line 98  static int ssl_initilized=FALSE; Line 98  static int ssl_initilized=FALSE;
98  /**  /**
99   * Number of random bytes to obtain   * Number of random bytes to obtain
100   */   */
   
101  #define RANDOM_BYTES 2048  #define RANDOM_BYTES 2048
102    
103  /**  /**
104   * The PRIMARY random device selected for seeding the PRNG. We use a   * The PRIMARY random device selected for seeding the PRNG. We use a
105   * non-blocking pseudo random device, to generate pseudo entropy.   * non-blocking pseudo random device, to generate pseudo entropy.
106   */   */
   
107  #define URANDOM_DEVICE "/dev/urandom"  #define URANDOM_DEVICE "/dev/urandom"
108    
109  /**  /**
110   * If a non-blocking device is not found on the system a blocking   * If a non-blocking device is not found on the system a blocking
111   * entropy producer is tried instead.   * entropy producer is tried instead.
112   */   */
   
113  #define RANDOM_DEVICE "/dev/random"  #define RANDOM_DEVICE "/dev/random"
114    
115    
116  /**  /**
117   *  SSL Socket methods.   *  SSL Socket methods.
118   *   *
# Line 129  static int ssl_initilized=FALSE; Line 127  static int ssl_initilized=FALSE;
127    
128  /* ------------------------------------------------------------------ Public */  /* ------------------------------------------------------------------ Public */
129    
130    
131  /**  /**
132   * Embeds a socket in a ssl connection.   * Embeds a socket in a ssl connection.
133   * @param socket the socket to be used.   * @param socket the socket to be used.
134   * @return The ssl connection or NULL if an error occured.   * @return The ssl connection or NULL if an error occured.
135   */   */
136    int embed_ssl_socket (ssl_connection *ssl, int socket) {
 int embed_ssl_socket (ssl_connection * ssl, int socket) {  
137    
138  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
139      
140    if ( ssl == NULL ) {    if ( ssl == NULL ) {
141        
142      return FALSE;      return FALSE;
143        
144    }    }
145      
146    if (!ssl_initilized) {    if (!ssl_initilized) {
147        
148      start_ssl();      start_ssl();
149    
150    }    }
# Line 163  int embed_ssl_socket (ssl_connection * s Line 161  int embed_ssl_socket (ssl_connection * s
161    
162    if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) {    if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) {
163    
164      error("Cannot initilize SSL handler!\n");      error("Cannot initialize the SSL handler!\n");
165      goto sslerror;      goto sslerror;
166    
167    }    }
# Line 172  int embed_ssl_socket (ssl_connection * s Line 170  int embed_ssl_socket (ssl_connection * s
170    
171    if (SSL_connect (ssl->handler) == -1) {    if (SSL_connect (ssl->handler) == -1) {
172            
173      error("Cannot connect with SSL service!\n");      error("Cannot connect with the SSL service!\n");
174      goto sslerror;      goto sslerror;
175    
176    }    }
# Line 181  int embed_ssl_socket (ssl_connection * s Line 179  int embed_ssl_socket (ssl_connection * s
179    
180    if (! update_ssl_cert_data(ssl)) {    if (! update_ssl_cert_data(ssl)) {
181    
182      error("Cannot get SSL server certificate!\n");      error("Cannot get the SSL server certificate!\n");
183      goto sslerror;      goto sslerror;
184    
185    }    }
# Line 200  int embed_ssl_socket (ssl_connection * s Line 198  int embed_ssl_socket (ssl_connection * s
198  #endif  #endif
199  }  }
200    
201    
202  /**  /**
203   * Updates some data in the ssl connection   * Updates some data in the ssl connection
204   * @param ssl reference to ssl connection   * @param ssl reference to ssl connection
205   * @return TRUE, if not successful FALSE   * @return TRUE, if not successful FALSE
206   */   */
   
207  int update_ssl_cert_data(ssl_connection *ssl) {  int update_ssl_cert_data(ssl_connection *ssl) {
208    
209  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
210    
211    unsigned char md5[EVP_MAX_MD_SIZE];    unsigned char md5[EVP_MAX_MD_SIZE];
212    
213      ASSERT(ssl);
214      
215    if ((ssl->cert = SSL_get_peer_certificate (ssl->handler)) == NULL) {    if ((ssl->cert = SSL_get_peer_certificate (ssl->handler)) == NULL) {
216    
217      return FALSE;      return FALSE;
# Line 233  int update_ssl_cert_data(ssl_connection Line 233  int update_ssl_cert_data(ssl_connection
233    
234  }  }
235    
236    
237  /**  /**
238   * Compare certificate with given md5 sum   * Compare certificate with given md5 sum
239   * @param ssl reference to ssl connection   * @param ssl reference to ssl connection
240   * @param md5sum string of the md5sum to test against   * @param md5sum string of the md5sum to test against
241   * @return TRUE, if sums do not match FALSE   * @return TRUE, if sums do not match FALSE
242   */   */
243    int check_ssl_md5sum(ssl_connection *ssl, char *md5sum) {
 int check_ssl_md5sum(ssl_connection * ssl, char *md5sum) {  
244    
245  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
246    int i= 0;    int i= 0;
# Line 281  int check_ssl_md5sum(ssl_connection * ss Line 281  int check_ssl_md5sum(ssl_connection * ss
281   * @param protocol Socket protocol to use (SOCK_STREAM|SOCK_DGRAM)   * @param protocol Socket protocol to use (SOCK_STREAM|SOCK_DGRAM)
282   * @return The ssl connection or NULL if an error occured.   * @return The ssl connection or NULL if an error occured.
283   */   */
284    ssl_connection *create_ssl_socket(char *hostname, int port, int protocol) {
 ssl_connection * create_ssl_socket(char *hostname, int port, int protocol) {  
285    
286  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
287    
288    int socket;    int socket;
289    ssl_connection * ssl = new_ssl_connection(NULL);    ssl_connection *ssl = new_ssl_connection(NULL);
290    
291    ASSERT(hostname);    ASSERT(hostname);
292    
# Line 326  ssl_connection * create_ssl_socket(char Line 325  ssl_connection * create_ssl_socket(char
325    
326  }  }
327    
328    
329  /**  /**
330   * Closes a ssl connection (ssl socket + net socket)   * Closes a ssl connection (ssl socket + net socket)
331   * @param ssl ssl connection   * @param ssl ssl connection
332   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
333   */   */
334    int close_ssl_socket(ssl_connection *ssl) {
 int close_ssl_socket(ssl_connection * ssl) {  
335    
336  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
337    
# Line 356  int close_ssl_socket(ssl_connection * ss Line 355  int close_ssl_socket(ssl_connection * ss
355    
356  }  }
357    
358    
359  /**  /**
360   * Garbage collection for non reusabe parts of the ssl connection   * Garbage collection for non reusabe parts of the ssl connection
361   * @param ssl ssl connection   * @param ssl ssl connection
362   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
363   */   */
   
364  int cleanup_ssl_socket(ssl_connection *ssl) {  int cleanup_ssl_socket(ssl_connection *ssl) {
365    
366  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
# Line 417  int cleanup_ssl_socket(ssl_connection *s Line 416  int cleanup_ssl_socket(ssl_connection *s
416    
417  }  }
418    
419    
420  /**  /**
421   * Garbage collection for non-reusable parts a ssl connection   * Garbage collection for non-reusable parts a ssl connection
422   * @param ssl ssl connection   * @param ssl ssl connection
423   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
424   */   */
   
425  int delete_ssl_socket(ssl_connection *ssl) {  int delete_ssl_socket(ssl_connection *ssl) {
426    
427  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
# Line 453  int delete_ssl_socket(ssl_connection *ss Line 452  int delete_ssl_socket(ssl_connection *ss
452    
453  }  }
454    
 /* Server code */  
455    
456  /**  /**
457   * Initializes a ssl connection for server use.   * Initializes a ssl connection for server use.
458   * @param pemfilename Filename for the key/cert file   * @param pemfilename Filename for the key/cert file
459   * @return An ssl connection, or NULL if an error occured.   * @return An ssl connection, or NULL if an error occured.
460   */   */
461    ssl_server_connection *init_ssl_server (char *pemfilename) {
 ssl_server_connection * init_ssl_server (char *pemfilename) {  
462    
463  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
464    
465    ssl_server_connection * ssl_server = new_ssl_server_connection();    ssl_server_connection *ssl_server = new_ssl_server_connection();
466    
467    ASSERT(pemfilename);    ASSERT(pemfilename);
468    
# Line 477  ssl_server_connection * init_ssl_server Line 474  ssl_server_connection * init_ssl_server
474        
475    if ((ssl_server->method= SSLv23_server_method()) == NULL ) {    if ((ssl_server->method= SSLv23_server_method()) == NULL ) {
476    
477      error("Cannot initilize SSL method!\n");      error("Cannot initialize the SSL method to use!\n");
478      goto sslerror;      goto sslerror;
479    
480    }    }
481    
482    if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) {    if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) {
483    
484      error("Cannot initilize SSL server certificate handler!\n");      error("Cannot initialize the SSL server's certificate handler!\n");
485      goto sslerror;      goto sslerror;
486    
487    }    }
# Line 492  ssl_server_connection * init_ssl_server Line 489  ssl_server_connection * init_ssl_server
489    if (SSL_CTX_use_certificate_file(ssl_server->ctx, pemfilename,    if (SSL_CTX_use_certificate_file(ssl_server->ctx, pemfilename,
490                                     SSL_FILETYPE_PEM) <= 0) {                                     SSL_FILETYPE_PEM) <= 0) {
491    
492      error("Cannot initilize SSL server certificate!\n");      error("Cannot initialize the SSL server's certificate!\n");
493      goto sslerror;      goto sslerror;
494    
495    }    }
# Line 500  ssl_server_connection * init_ssl_server Line 497  ssl_server_connection * init_ssl_server
497    if (SSL_CTX_use_PrivateKey_file(ssl_server->ctx, pemfilename,    if (SSL_CTX_use_PrivateKey_file(ssl_server->ctx, pemfilename,
498                                    SSL_FILETYPE_PEM) <= 0) {                                    SSL_FILETYPE_PEM) <= 0) {
499    
500      error("Cannot initilize SSL server private key!\n");      error("Cannot initialize the SSL server's private key!\n");
501      goto sslerror;      goto sslerror;
502    
503    }    }
504    
505    if (!SSL_CTX_check_private_key(ssl_server->ctx)) {    if (!SSL_CTX_check_private_key(ssl_server->ctx)) {
506    
507      error("Private key does not match the certificate public key!\n");      error("The private key does not match the certificate public key!\n");
508      goto sslerror;      goto sslerror;
509    
510    }    }
511    
512    /**    /*
513     * We do need this to force transmission of client certs     * We need this to force transmission of client certs
514     */     */
515    if (!verify_init(ssl_server)) {    if (!verify_init(ssl_server)) {
516    
# Line 538  ssl_server_connection * init_ssl_server Line 535  ssl_server_connection * init_ssl_server
535    
536  }  }
537    
538    
539  /**  /**
540   * Creates a server socket (SOCK_STREAM type) and binds it to the   * Creates a server socket (SOCK_STREAM type) and binds it to the
541   * specified local port number.  The socket get a ssl layer for   * specified local port number.  The socket get a ssl layer for
# Line 548  ssl_server_connection * init_ssl_server Line 546  ssl_server_connection * init_ssl_server
546   * @param bindAddr the local address the server will bind to   * @param bindAddr the local address the server will bind to
547   * @return An ssl connection ready for accept, or NULL if an error occured.   * @return An ssl connection ready for accept, or NULL if an error occured.
548   */   */
549    ssl_server_connection *create_ssl_server_socket(char *pemfilename, int port,
 ssl_server_connection * create_ssl_server_socket(char * pemfilename, int port,  
550                                                   int backlog,                                                   int backlog,
551                                                   char *bindAddr) {                                                   char *bindAddr) {
552    
553  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
554        
555    int socket;    int socket;
556    ssl_server_connection * ssl_server;    ssl_server_connection *ssl_server;
557    
558    ASSERT(pemfilename);    ASSERT(pemfilename);
559    ASSERT(bindAddr);    ASSERT(bindAddr);
# Line 596  ssl_server_connection * create_ssl_serve Line 593  ssl_server_connection * create_ssl_serve
593    
594  }  }
595    
596    
597  /**  /**
598   * Closes a ssl server connection (ssl socket + net socket)   * Closes a ssl server connection (ssl socket + net socket)
599   * @param ssl ssl connection   * @param ssl ssl connection
600   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
601   */   */
602    int close_ssl_server_socket(ssl_server_connection *ssl_server) {
 int close_ssl_server_socket(ssl_server_connection * ssl_server) {  
603    
604  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
605    
# Line 624  int close_ssl_server_socket(ssl_server_c Line 621  int close_ssl_server_socket(ssl_server_c
621  #endif  #endif
622  }  }
623    
624    
625  /**  /**
626   * Garbage collection for a SSL server connection.   * Garbage collection for a SSL server connection.
627   * @param ssl_server data for ssl server connection   * @param ssl_server data for ssl server connection
628   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
629   */   */
   
630  int cleanup_ssl_server_socket(ssl_server_connection *ssl_server) {  int cleanup_ssl_server_socket(ssl_server_connection *ssl_server) {
631    
632  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
633    
634    ssl_connection * ssl;    ssl_connection *ssl;
635    
636    if(ssl_server==NULL) {    if(ssl_server==NULL) {
637    
# Line 663  int cleanup_ssl_server_socket(ssl_server Line 660  int cleanup_ssl_server_socket(ssl_server
660    
661  }  }
662    
663    
664  /**  /**
665   * Deletes a SSL server connection.   * Deletes a SSL server connection.
666   * @param ssl_server data for ssl server connection   * @param ssl_server data for ssl server connection
667   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
668   */   */
   
669  int delete_ssl_server_socket(ssl_server_connection *ssl_server) {  int delete_ssl_server_socket(ssl_server_connection *ssl_server) {
670    
671  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
# Line 699  int delete_ssl_server_socket(ssl_server_ Line 696  int delete_ssl_server_socket(ssl_server_
696    
697  }  }
698    
699    
700  /**  /**
701   * Inserts an SSL connection in the connection list of a server.   * Inserts an SSL connection in the connection list of a server.
702   * @param ssl_server data for ssl server connection   * @param ssl_server data for ssl server connection
703   * @return new SSL connection for the connection, or NULL if failed   * @return new SSL connection for the connection, or NULL if failed
704   */   */
705    ssl_connection *insert_accepted_ssl_socket(ssl_server_connection *ssl_server) {
 ssl_connection * insert_accepted_ssl_socket (ssl_server_connection  
                                              * ssl_server) {  
706    
707  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
708    
709    ssl_connection * ssl = (ssl_connection *) NEW(ssl);    ssl_connection *ssl;
710    
711    if (!ssl_initilized) {    ASSERT(ssl_server);
712    
713      start_ssl();    ssl= (ssl_connection *) NEW(ssl);
   
   }  
714    
715    if (!ssl_initilized) {    if (!ssl_initilized) {
716    
# Line 767  ssl_connection * insert_accepted_ssl_soc Line 761  ssl_connection * insert_accepted_ssl_soc
761    
762  }  }
763    
764    
765  /**  /**
766   * Closes an accepted SSL server connection and deletes it form the   * Closes an accepted SSL server connection and deletes it form the
767   * connection list.   * connection list.
# Line 774  ssl_connection * insert_accepted_ssl_soc Line 769  ssl_connection * insert_accepted_ssl_soc
769   * @param ssl data the connection to be deleted   * @param ssl data the connection to be deleted
770   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
771   */   */
772    int close_accepted_ssl_socket(ssl_server_connection *ssl_server,
773  int close_accepted_ssl_socket(ssl_server_connection * ssl_server,                                ssl_connection *ssl) {
                               ssl_connection * ssl) {  
774    
775  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
776    
# Line 808  int close_accepted_ssl_socket(ssl_server Line 802  int close_accepted_ssl_socket(ssl_server
802    
803  }  }
804    
805    
806  /**  /**
807   * Deletes an accepted SSL server connection from the connection   * Deletes an accepted SSL server connection from the connection
808   * list.   * list.
# Line 815  int close_accepted_ssl_socket(ssl_server Line 810  int close_accepted_ssl_socket(ssl_server
810   * @param ssl data the connection to be deleted   * @param ssl data the connection to be deleted
811   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
812   */   */
813    int delete_accepted_ssl_socket (ssl_server_connection *ssl_server,
814  int delete_accepted_ssl_socket (ssl_server_connection * ssl_server,                                  ssl_connection *ssl) {
                                 ssl_connection * ssl) {  
815    
816  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
817    
# Line 863  int delete_accepted_ssl_socket (ssl_serv Line 857  int delete_accepted_ssl_socket (ssl_serv
857    
858  }  }
859    
860    
861  /**  /**
862   * Embeds an accepted server socket in an existing ssl connection.   * Embeds an accepted server socket in an existing ssl connection.
863   * @param ssl ssl connection   * @param ssl ssl connection
864   * @param socket the socket to be used.   * @param socket the socket to be used.
865   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
866   */   */
867    int embed_accepted_ssl_socket(ssl_connection *ssl, int socket) {
 int embed_accepted_ssl_socket(ssl_connection * ssl, int socket) {  
868    
869  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
870    
871      ASSERT(ssl);
872      
873    ssl->socket=socket;    ssl->socket=socket;
874    
875    if (!ssl_initilized) {    if (!ssl_initilized) {
# Line 884  int embed_accepted_ssl_socket(ssl_connec Line 880  int embed_accepted_ssl_socket(ssl_connec
880    
881    if ((ssl->handler= SSL_new(ssl->ctx)) == NULL ) {    if ((ssl->handler= SSL_new(ssl->ctx)) == NULL ) {
882    
883      error("Cannot initilize SSL handler!\n");      error("Cannot initialize the SSL handler!\n");
884    
885    }    }
886    
# Line 910  int embed_accepted_ssl_socket(ssl_connec Line 906  int embed_accepted_ssl_socket(ssl_connec
906    
907    if (! update_ssl_cert_data(ssl) && (Run.httpsslclientpem != NULL)) {    if (! update_ssl_cert_data(ssl) && (Run.httpsslclientpem != NULL)) {
908    
909      error("Client did not supply required client certificate!\n");      error("The client did not supply a required client certificate!\n");
910      goto sslerror;      goto sslerror;
911    
912    }    }
# Line 929  int embed_accepted_ssl_socket(ssl_connec Line 925  int embed_accepted_ssl_socket(ssl_connec
925    
926  }  }
927    
928    
929  /**  /**
930   * Do "accept" for a ssl server socket   * Do "accept" for a ssl server socket
931   * @param ssl ssl connection   * @param ssl ssl connection
932   * @return the ssl_connection of the socket, NULL in case of an error   * @return the ssl_connection of the socket, NULL in case of an error
933   */   */
934    ssl_connection *accept_ssl_socket(ssl_server_connection *ssl_server) {
 ssl_connection * accept_ssl_socket(ssl_server_connection * ssl_server) {  
935    
936  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
937    
938    int no_crypt_socket;    int no_crypt_socket;
939    int len= sizeof(struct sockaddr_in);    int len= sizeof(struct sockaddr_in);
940    struct sockaddr_in in;    struct sockaddr_in in;
941    
942      ASSERT(ssl_server);
943      
944    no_crypt_socket= accept(ssl_server->server_socket, (struct sockaddr*)&in,    no_crypt_socket= accept(ssl_server->server_socket, (struct sockaddr*)&in,
945                            &len);                            &len);
946    
947    if ( no_crypt_socket >= 0 ) {    if ( no_crypt_socket >= 0 ) {
948            
949      ssl_connection * ssl = insert_accepted_ssl_socket(ssl_server);      ssl_connection *ssl = insert_accepted_ssl_socket(ssl_server);
950            
951      if ( ssl == NULL ) {      if ( ssl == NULL ) {
952    
# Line 981  ssl_connection * accept_ssl_socket(ssl_s Line 979  ssl_connection * accept_ssl_socket(ssl_s
979    
980  }  }
981    
 /* Generic code */  
982    
983  /**  /**
984   * Send data package though the ssl connection   * Send data package though the ssl connection
# Line 990  ssl_connection * accept_ssl_socket(ssl_s Line 987  ssl_connection * accept_ssl_socket(ssl_s
987   * @param len size of the data container   * @param len size of the data container
988   * @return number of bytes transmitted, -1 in case of an error   * @return number of bytes transmitted, -1 in case of an error
989   */   */
990    int send_ssl_socket(ssl_connection *ssl, void *buffer, int len) {
 int send_ssl_socket(ssl_connection * ssl, void * buffer, int len) {  
991    
992  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
993    
994      ASSERT(ssl);
995    
996    return SSL_write (ssl->handler, (void *) buffer, len);    return SSL_write (ssl->handler, (void *) buffer, len);
997    
998  #else  #else
# Line 1005  int send_ssl_socket(ssl_connection * ssl Line 1003  int send_ssl_socket(ssl_connection * ssl
1003    
1004  }  }
1005    
1006    
1007  /**  /**
1008   * Receive data package though the ssl connection   * Receive data package though the ssl connection
1009   * @param ssl ssl connection   * @param ssl ssl connection
# Line 1012  int send_ssl_socket(ssl_connection * ssl Line 1011  int send_ssl_socket(ssl_connection * ssl
1011   * @param len size of the data container   * @param len size of the data container
1012   * @return number of bytes transmitted, -1 in case of an error   * @return number of bytes transmitted, -1 in case of an error
1013   */   */
1014    int recv_ssl_socket(ssl_connection *ssl, void *buffer, int len) {
 int recv_ssl_socket(ssl_connection * ssl, void * buffer, int len) {  
1015    
1016  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
1017    
1018    return SSL_read (ssl->handler, (void *) buffer, len);    ASSERT(ssl);
1019    
1020      return SSL_read(ssl->handler, (void *) buffer, len);
1021    
1022  #else  #else
1023    
# Line 1027  int recv_ssl_socket(ssl_connection * ssl Line 1027  int recv_ssl_socket(ssl_connection * ssl
1027    
1028  }  }
1029    
1030    
1031  /**  /**
1032   * Receives a string data package though the ssl connection   * Receives a string data package though the ssl connection
1033   * @param ssl ssl connection   * @param ssl ssl connection
# Line 1034  int recv_ssl_socket(ssl_connection * ssl Line 1035  int recv_ssl_socket(ssl_connection * ssl
1035   * @param len size of the data container   * @param len size of the data container
1036   * @return pointer to buffer, NULL if failed   * @return pointer to buffer, NULL if failed
1037   */   */
1038    char *gets_ssl_socket(ssl_connection *ssl, char *buffer, int len ) {
 char * gets_ssl_socket(ssl_connection * ssl, char * buffer, int len ) {  
1039    
1040  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
1041    
1042    int i=0;    int i=0;
1043    char c;    char c;
1044    
1045      ASSERT(ssl);
1046    ASSERT(buffer);    ASSERT(buffer);
1047    
1048    while(i <= len - 1) {    while(i <= len - 1) {
# Line 1086  char * gets_ssl_socket(ssl_connection * Line 1087  char * gets_ssl_socket(ssl_connection *
1087    
1088  }  }
1089    
1090    
1091  /**  /**
1092   * Sends a formated string though the ssl connection   * Sends a formated string though the ssl connection
1093   * @param ssl ssl connection   * @param ssl ssl connection
# Line 1093  char * gets_ssl_socket(ssl_connection * Line 1095  char * gets_ssl_socket(ssl_connection *
1095   * @param ... data for the string   * @param ... data for the string
1096   * @return number for characters transmitted   * @return number for characters transmitted
1097   */   */
1098    int printf_ssl_socket(ssl_connection *ssl, const char *format, ...) {
 int printf_ssl_socket(ssl_connection * ssl, const char *format, ...) {  
1099    
1100  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
1101        
# Line 1103  int printf_ssl_socket(ssl_connection * s Line 1104  int printf_ssl_socket(ssl_connection * s
1104    
1105    va_list ap;    va_list ap;
1106    
1107      ASSERT(ssl);
1108    ASSERT(format);    ASSERT(format);
1109    
1110    va_start(ap,format);    va_start(ap,format);
# Line 1119  int printf_ssl_socket(ssl_connection * s Line 1121  int printf_ssl_socket(ssl_connection * s
1121        
1122  }  }
1123    
1124    
1125  /**  /**
1126   * Start SSL support library. It has to be run before the SSL support   * Start SSL support library. It has to be run before the SSL support
1127   * can be used.   * can be used.
1128   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
1129   */   */
   
1130  int start_ssl() {  int start_ssl() {
   /* Init SSL stuff */  
1131    
1132  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
1133    
# Line 1149  int start_ssl() { Line 1150  int start_ssl() {
1150    
1151  }  }
1152    
1153    
1154  /**  /**
1155   * Stop SSL support library   * Stop SSL support library
1156   * @return TRUE, or FALSE if an error has occured.   * @return TRUE, or FALSE if an error has occured.
1157   */   */
   
1158  int stop_ssl() {  int stop_ssl() {
1159    
1160  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
# Line 1177  int stop_ssl() { Line 1178  int stop_ssl() {
1178    
1179  }  }
1180    
1181    
1182  /**  /**
1183   * Generate a new ssl connection   * Generate a new ssl connection
1184   * @return ssl connection container   * @return ssl connection container
1185   */   */
1186    ssl_connection *new_ssl_connection(char *clientpemfilename) {
 ssl_connection * new_ssl_connection(char * clientpemfilename) {  
1187    
1188  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
1189    
1190    ssl_connection * ssl = (ssl_connection *) NEW(ssl);    ssl_connection *ssl = (ssl_connection *) NEW(ssl);
1191    
1192    if (!ssl_initilized) {    if (!ssl_initilized) {
1193    
# Line 1261  ssl_connection * new_ssl_connection(char Line 1262  ssl_connection * new_ssl_connection(char
1262    
1263  }  }
1264    
1265    
1266  /**  /**
1267   * Generate a new ssl server connection   * Generate a new ssl server connection
1268   * @return ssl server connection container   * @return ssl server connection container
1269   */   */
1270    ssl_server_connection *new_ssl_server_connection(void) {
 ssl_server_connection * new_ssl_server_connection(void) {  
1271    
1272  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
1273    
1274    ssl_server_connection * ssl_server = (ssl_server_connection *) NEW(ssl_server);    ssl_server_connection *ssl_server = (ssl_server_connection *) NEW(ssl_server);
1275    
1276    if (!ssl_initilized) {    if (!ssl_initilized) {
1277    
# Line 1293  ssl_server_connection * new_ssl_server_c Line 1294  ssl_server_connection * new_ssl_server_c
1294    
1295  }  }
1296    
1297    
1298  /**  /**
1299   * Checks if openssl is compiled in   * Checks if openssl is compiled in
1300   * @return TRUE if installed   * @return TRUE if installed
1301   */   */
   
1302  int have_ssl(void) {  int have_ssl(void) {
1303    
1304  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
# Line 1318  int have_ssl(void) { Line 1319  int have_ssl(void) {
1319    
1320  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
1321    
1322    
1323  /**  /**
1324   * Init verification of transmitted client certs   * Init verification of transmitted client certs
1325   */   */
1326    static int verify_init(ssl_server_connection *ssl_server) {
 static int verify_init(ssl_server_connection * ssl_server) {  
1327    
1328    struct stat stat_buf;    struct stat stat_buf;
1329    
# Line 1424  static int verify_init(ssl_server_connec Line 1425  static int verify_init(ssl_server_connec
1425  /**  /**
1426   * Check the transmitted client certs   * Check the transmitted client certs
1427   */   */
   
1428  static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) {  static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) {
1429    
1430    char subject[STRLEN];    char subject[STRLEN];
# Line 1474  static int verify_callback(int preverify Line 1474  static int verify_callback(int preverify
1474    }    }
1475    
1476   accept:   accept:
1477    /* log("HTTPD connection accepted to %s!\n", subject); */    return 1;
   return 1; /* Accept connection */  
1478    
1479   reject:   reject:
1480    log("HTTPD connection denied!\n");    log("HTTPD connection denied!\n");
1481    return 0; /* Reject connection */    return 0;
1482    
1483  }  }
1484    
 static void verify_info(ssl_server_connection *ssl_server) {  
     STACK_OF(X509_NAME) *stack;  
1485    
1486      stack=SSL_CTX_get_client_CA_list(ssl_server->ctx);  static void verify_info(ssl_server_connection *ssl_server) {
1487      log("We have found there are %d certificates\n", sk_X509_NAME_num(stack));    
1488      STACK_OF(X509_NAME) *stack;
1489      
1490      stack=SSL_CTX_get_client_CA_list(ssl_server->ctx);
1491      log("Found %d certificates\n", sk_X509_NAME_num(stack));
1492      
1493  }  }
1494    
1495    
# Line 1495  static void verify_info(ssl_server_conne Line 1497  static void verify_info(ssl_server_conne
1497   * Helper function for the SSL threadding support   * Helper function for the SSL threadding support
1498   * @return current thread number   * @return current thread number
1499   */   */
   
1500  static int unsigned long ssl_thread_id(void) {  static int unsigned long ssl_thread_id(void) {
1501    
1502    return ((unsigned long) pthread_self());    return ((unsigned long) pthread_self());
1503    
1504  }  }
1505    
1506    
1507  /**  /**
1508   * Helper function for the SSL threadding support   * Helper function for the SSL threadding support
1509   */   */
   
1510  static void ssl_mutex_lock(int mode, int n, const char *file, int line) {  static void ssl_mutex_lock(int mode, int n, const char *file, int line) {
1511    
1512    
1513    if(mode & CRYPTO_LOCK) {    if(mode & CRYPTO_LOCK) {
1514        
1515      pthread_mutex_lock( & ssl_mutex_table[n]);      pthread_mutex_lock( & ssl_mutex_table[n]);
1516        
1517    } else {    } else {
1518    
1519      pthread_mutex_unlock( & ssl_mutex_table[n]);      pthread_mutex_unlock( & ssl_mutex_table[n]);
1520        
1521    }    }
1522      
1523  }  }
1524    
1525    
1526  /**  /**
1527   * Initialize threadding support for the SSL library   * Initialize threadding support for the SSL library
1528   * @return TRUE if successful, FALSE if failed   * @return TRUE if successful, FALSE if failed
1529   */   */
   
1530  static int ssl_thread_start(void) {  static int ssl_thread_start(void) {
1531    
1532    int i;    int i;
# Line 1539  static int ssl_thread_start(void) { Line 1540  static int ssl_thread_start(void) {
1540    
1541  }  }
1542    
1543    
1544  /**  /**
1545   * Garbage colletion for the SSL threadding support   * Garbage colletion for the SSL threadding support
1546   * @return TRUE if successful, FALSE if failed   * @return TRUE if successful, FALSE if failed
1547   */   */
   
1548  static int ssl_thread_stop(void) {  static int ssl_thread_stop(void) {
1549    
1550    int i;    int i;
# Line 1556  static int ssl_thread_stop(void) { Line 1557  static int ssl_thread_stop(void) {
1557    
1558    return TRUE;    return TRUE;
1559    
   return FALSE;  
   
1560  }  }
1561    
1562    
1563  /**  /**
1564   * Start entropy gathering   * Start entropy gathering
1565   * @return TRUE if successful, FALSE if failed   * @return TRUE if successful, FALSE if failed
1566   */   */
   
1567  static int ssl_entropy_start(void) {  static int ssl_entropy_start(void) {
1568    
1569    if(exist_file(URANDOM_DEVICE)) {    if(exist_file(URANDOM_DEVICE)) {
# Line 1580  static int ssl_entropy_start(void) { Line 1579  static int ssl_entropy_start(void) {
1579    
1580    }    }
1581    
   // FIXME: log/warn PRNG not seeded properly  
   
1582    return FALSE;    return FALSE;
1583    
1584  }  }
1585    
1586    
1587  /**  /**
1588   * Stop entropy gathering   * Stop entropy gathering
1589   * @return TRUE if successful, FALSE if failed   * @return TRUE if successful, FALSE if failed
1590   */   */
   
1591  static int ssl_entropy_stop(void) {  static int ssl_entropy_stop(void) {
1592    
1593    RAND_cleanup();    RAND_cleanup();

Legend:
Removed from v.1.10  
changed lines
  Added in v.1.11

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26