85 |
static int ssl_entropy_start(void); |
static int ssl_entropy_start(void); |
86 |
static int ssl_entropy_stop(void); |
static int ssl_entropy_stop(void); |
87 |
|
|
88 |
static int verify_init(ssl_server_connection * ); |
static int verify_init(ssl_server_connection *); |
89 |
static int verify_callback(int, X509_STORE_CTX *); |
static int verify_callback(int, X509_STORE_CTX *); |
90 |
static void verify_info(ssl_server_connection *); |
static void verify_info(ssl_server_connection *); |
91 |
|
|
92 |
static pthread_mutex_t ssl_mutex= PTHREAD_MUTEX_INITIALIZER; |
static pthread_mutex_t ssl_mutex= PTHREAD_MUTEX_INITIALIZER; |
93 |
static pthread_mutex_t * ssl_mutex_table; |
static pthread_mutex_t *ssl_mutex_table; |
94 |
|
|
95 |
static int ssl_initilized=FALSE; |
static int ssl_initilized=FALSE; |
96 |
#endif |
#endif |
98 |
/** |
/** |
99 |
* Number of random bytes to obtain |
* Number of random bytes to obtain |
100 |
*/ |
*/ |
|
|
|
101 |
#define RANDOM_BYTES 2048 |
#define RANDOM_BYTES 2048 |
102 |
|
|
103 |
/** |
/** |
104 |
* The PRIMARY random device selected for seeding the PRNG. We use a |
* The PRIMARY random device selected for seeding the PRNG. We use a |
105 |
* non-blocking pseudo random device, to generate pseudo entropy. |
* non-blocking pseudo random device, to generate pseudo entropy. |
106 |
*/ |
*/ |
|
|
|
107 |
#define URANDOM_DEVICE "/dev/urandom" |
#define URANDOM_DEVICE "/dev/urandom" |
108 |
|
|
109 |
/** |
/** |
110 |
* If a non-blocking device is not found on the system a blocking |
* If a non-blocking device is not found on the system a blocking |
111 |
* entropy producer is tried instead. |
* entropy producer is tried instead. |
112 |
*/ |
*/ |
|
|
|
113 |
#define RANDOM_DEVICE "/dev/random" |
#define RANDOM_DEVICE "/dev/random" |
114 |
|
|
115 |
|
|
116 |
/** |
/** |
117 |
* SSL Socket methods. |
* SSL Socket methods. |
118 |
* |
* |
127 |
|
|
128 |
/* ------------------------------------------------------------------ Public */ |
/* ------------------------------------------------------------------ Public */ |
129 |
|
|
130 |
|
|
131 |
/** |
/** |
132 |
* Embeds a socket in a ssl connection. |
* Embeds a socket in a ssl connection. |
133 |
* @param socket the socket to be used. |
* @param socket the socket to be used. |
134 |
* @return The ssl connection or NULL if an error occured. |
* @return The ssl connection or NULL if an error occured. |
135 |
*/ |
*/ |
136 |
|
int embed_ssl_socket (ssl_connection *ssl, int socket) { |
|
int embed_ssl_socket (ssl_connection * ssl, int socket) { |
|
137 |
|
|
138 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
139 |
|
|
140 |
if ( ssl == NULL ) { |
if ( ssl == NULL ) { |
141 |
|
|
142 |
return FALSE; |
return FALSE; |
143 |
|
|
144 |
} |
} |
145 |
|
|
146 |
if (!ssl_initilized) { |
if (!ssl_initilized) { |
147 |
|
|
148 |
start_ssl(); |
start_ssl(); |
149 |
|
|
150 |
} |
} |
161 |
|
|
162 |
if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) { |
if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) { |
163 |
|
|
164 |
error("Cannot initilize SSL handler!\n"); |
error("Cannot initialize the SSL handler!\n"); |
165 |
goto sslerror; |
goto sslerror; |
166 |
|
|
167 |
} |
} |
170 |
|
|
171 |
if (SSL_connect (ssl->handler) == -1) { |
if (SSL_connect (ssl->handler) == -1) { |
172 |
|
|
173 |
error("Cannot connect with SSL service!\n"); |
error("Cannot connect with the SSL service!\n"); |
174 |
goto sslerror; |
goto sslerror; |
175 |
|
|
176 |
} |
} |
179 |
|
|
180 |
if (! update_ssl_cert_data(ssl)) { |
if (! update_ssl_cert_data(ssl)) { |
181 |
|
|
182 |
error("Cannot get SSL server certificate!\n"); |
error("Cannot get the SSL server certificate!\n"); |
183 |
goto sslerror; |
goto sslerror; |
184 |
|
|
185 |
} |
} |
198 |
#endif |
#endif |
199 |
} |
} |
200 |
|
|
201 |
|
|
202 |
/** |
/** |
203 |
* Updates some data in the ssl connection |
* Updates some data in the ssl connection |
204 |
* @param ssl reference to ssl connection |
* @param ssl reference to ssl connection |
205 |
* @return TRUE, if not successful FALSE |
* @return TRUE, if not successful FALSE |
206 |
*/ |
*/ |
|
|
|
207 |
int update_ssl_cert_data(ssl_connection *ssl) { |
int update_ssl_cert_data(ssl_connection *ssl) { |
208 |
|
|
209 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
210 |
|
|
211 |
unsigned char md5[EVP_MAX_MD_SIZE]; |
unsigned char md5[EVP_MAX_MD_SIZE]; |
212 |
|
|
213 |
|
ASSERT(ssl); |
214 |
|
|
215 |
if ((ssl->cert = SSL_get_peer_certificate (ssl->handler)) == NULL) { |
if ((ssl->cert = SSL_get_peer_certificate (ssl->handler)) == NULL) { |
216 |
|
|
217 |
return FALSE; |
return FALSE; |
233 |
|
|
234 |
} |
} |
235 |
|
|
236 |
|
|
237 |
/** |
/** |
238 |
* Compare certificate with given md5 sum |
* Compare certificate with given md5 sum |
239 |
* @param ssl reference to ssl connection |
* @param ssl reference to ssl connection |
240 |
* @param md5sum string of the md5sum to test against |
* @param md5sum string of the md5sum to test against |
241 |
* @return TRUE, if sums do not match FALSE |
* @return TRUE, if sums do not match FALSE |
242 |
*/ |
*/ |
243 |
|
int check_ssl_md5sum(ssl_connection *ssl, char *md5sum) { |
|
int check_ssl_md5sum(ssl_connection * ssl, char *md5sum) { |
|
244 |
|
|
245 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
246 |
int i= 0; |
int i= 0; |
281 |
* @param protocol Socket protocol to use (SOCK_STREAM|SOCK_DGRAM) |
* @param protocol Socket protocol to use (SOCK_STREAM|SOCK_DGRAM) |
282 |
* @return The ssl connection or NULL if an error occured. |
* @return The ssl connection or NULL if an error occured. |
283 |
*/ |
*/ |
284 |
|
ssl_connection *create_ssl_socket(char *hostname, int port, int protocol) { |
|
ssl_connection * create_ssl_socket(char *hostname, int port, int protocol) { |
|
285 |
|
|
286 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
287 |
|
|
288 |
int socket; |
int socket; |
289 |
ssl_connection * ssl = new_ssl_connection(NULL); |
ssl_connection *ssl = new_ssl_connection(NULL); |
290 |
|
|
291 |
ASSERT(hostname); |
ASSERT(hostname); |
292 |
|
|
325 |
|
|
326 |
} |
} |
327 |
|
|
328 |
|
|
329 |
/** |
/** |
330 |
* Closes a ssl connection (ssl socket + net socket) |
* Closes a ssl connection (ssl socket + net socket) |
331 |
* @param ssl ssl connection |
* @param ssl ssl connection |
332 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
333 |
*/ |
*/ |
334 |
|
int close_ssl_socket(ssl_connection *ssl) { |
|
int close_ssl_socket(ssl_connection * ssl) { |
|
335 |
|
|
336 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
337 |
|
|
355 |
|
|
356 |
} |
} |
357 |
|
|
358 |
|
|
359 |
/** |
/** |
360 |
* Garbage collection for non reusabe parts of the ssl connection |
* Garbage collection for non reusabe parts of the ssl connection |
361 |
* @param ssl ssl connection |
* @param ssl ssl connection |
362 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
363 |
*/ |
*/ |
|
|
|
364 |
int cleanup_ssl_socket(ssl_connection *ssl) { |
int cleanup_ssl_socket(ssl_connection *ssl) { |
365 |
|
|
366 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
416 |
|
|
417 |
} |
} |
418 |
|
|
419 |
|
|
420 |
/** |
/** |
421 |
* Garbage collection for non-reusable parts a ssl connection |
* Garbage collection for non-reusable parts a ssl connection |
422 |
* @param ssl ssl connection |
* @param ssl ssl connection |
423 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
424 |
*/ |
*/ |
|
|
|
425 |
int delete_ssl_socket(ssl_connection *ssl) { |
int delete_ssl_socket(ssl_connection *ssl) { |
426 |
|
|
427 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
452 |
|
|
453 |
} |
} |
454 |
|
|
|
/* Server code */ |
|
455 |
|
|
456 |
/** |
/** |
457 |
* Initializes a ssl connection for server use. |
* Initializes a ssl connection for server use. |
458 |
* @param pemfilename Filename for the key/cert file |
* @param pemfilename Filename for the key/cert file |
459 |
* @return An ssl connection, or NULL if an error occured. |
* @return An ssl connection, or NULL if an error occured. |
460 |
*/ |
*/ |
461 |
|
ssl_server_connection *init_ssl_server (char *pemfilename) { |
|
ssl_server_connection * init_ssl_server (char *pemfilename) { |
|
462 |
|
|
463 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
464 |
|
|
465 |
ssl_server_connection * ssl_server = new_ssl_server_connection(); |
ssl_server_connection *ssl_server = new_ssl_server_connection(); |
466 |
|
|
467 |
ASSERT(pemfilename); |
ASSERT(pemfilename); |
468 |
|
|
474 |
|
|
475 |
if ((ssl_server->method= SSLv23_server_method()) == NULL ) { |
if ((ssl_server->method= SSLv23_server_method()) == NULL ) { |
476 |
|
|
477 |
error("Cannot initilize SSL method!\n"); |
error("Cannot initialize the SSL method to use!\n"); |
478 |
goto sslerror; |
goto sslerror; |
479 |
|
|
480 |
} |
} |
481 |
|
|
482 |
if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) { |
if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) { |
483 |
|
|
484 |
error("Cannot initilize SSL server certificate handler!\n"); |
error("Cannot initialize the SSL server's certificate handler!\n"); |
485 |
goto sslerror; |
goto sslerror; |
486 |
|
|
487 |
} |
} |
489 |
if (SSL_CTX_use_certificate_file(ssl_server->ctx, pemfilename, |
if (SSL_CTX_use_certificate_file(ssl_server->ctx, pemfilename, |
490 |
SSL_FILETYPE_PEM) <= 0) { |
SSL_FILETYPE_PEM) <= 0) { |
491 |
|
|
492 |
error("Cannot initilize SSL server certificate!\n"); |
error("Cannot initialize the SSL server's certificate!\n"); |
493 |
goto sslerror; |
goto sslerror; |
494 |
|
|
495 |
} |
} |
497 |
if (SSL_CTX_use_PrivateKey_file(ssl_server->ctx, pemfilename, |
if (SSL_CTX_use_PrivateKey_file(ssl_server->ctx, pemfilename, |
498 |
SSL_FILETYPE_PEM) <= 0) { |
SSL_FILETYPE_PEM) <= 0) { |
499 |
|
|
500 |
error("Cannot initilize SSL server private key!\n"); |
error("Cannot initialize the SSL server's private key!\n"); |
501 |
goto sslerror; |
goto sslerror; |
502 |
|
|
503 |
} |
} |
504 |
|
|
505 |
if (!SSL_CTX_check_private_key(ssl_server->ctx)) { |
if (!SSL_CTX_check_private_key(ssl_server->ctx)) { |
506 |
|
|
507 |
error("Private key does not match the certificate public key!\n"); |
error("The private key does not match the certificate public key!\n"); |
508 |
goto sslerror; |
goto sslerror; |
509 |
|
|
510 |
} |
} |
511 |
|
|
512 |
/** |
/* |
513 |
* We do need this to force transmission of client certs |
* We need this to force transmission of client certs |
514 |
*/ |
*/ |
515 |
if (!verify_init(ssl_server)) { |
if (!verify_init(ssl_server)) { |
516 |
|
|
535 |
|
|
536 |
} |
} |
537 |
|
|
538 |
|
|
539 |
/** |
/** |
540 |
* Creates a server socket (SOCK_STREAM type) and binds it to the |
* Creates a server socket (SOCK_STREAM type) and binds it to the |
541 |
* specified local port number. The socket get a ssl layer for |
* specified local port number. The socket get a ssl layer for |
546 |
* @param bindAddr the local address the server will bind to |
* @param bindAddr the local address the server will bind to |
547 |
* @return An ssl connection ready for accept, or NULL if an error occured. |
* @return An ssl connection ready for accept, or NULL if an error occured. |
548 |
*/ |
*/ |
549 |
|
ssl_server_connection *create_ssl_server_socket(char *pemfilename, int port, |
|
ssl_server_connection * create_ssl_server_socket(char * pemfilename, int port, |
|
550 |
int backlog, |
int backlog, |
551 |
char *bindAddr) { |
char *bindAddr) { |
552 |
|
|
553 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
554 |
|
|
555 |
int socket; |
int socket; |
556 |
ssl_server_connection * ssl_server; |
ssl_server_connection *ssl_server; |
557 |
|
|
558 |
ASSERT(pemfilename); |
ASSERT(pemfilename); |
559 |
ASSERT(bindAddr); |
ASSERT(bindAddr); |
593 |
|
|
594 |
} |
} |
595 |
|
|
596 |
|
|
597 |
/** |
/** |
598 |
* Closes a ssl server connection (ssl socket + net socket) |
* Closes a ssl server connection (ssl socket + net socket) |
599 |
* @param ssl ssl connection |
* @param ssl ssl connection |
600 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
601 |
*/ |
*/ |
602 |
|
int close_ssl_server_socket(ssl_server_connection *ssl_server) { |
|
int close_ssl_server_socket(ssl_server_connection * ssl_server) { |
|
603 |
|
|
604 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
605 |
|
|
621 |
#endif |
#endif |
622 |
} |
} |
623 |
|
|
624 |
|
|
625 |
/** |
/** |
626 |
* Garbage collection for a SSL server connection. |
* Garbage collection for a SSL server connection. |
627 |
* @param ssl_server data for ssl server connection |
* @param ssl_server data for ssl server connection |
628 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
629 |
*/ |
*/ |
|
|
|
630 |
int cleanup_ssl_server_socket(ssl_server_connection *ssl_server) { |
int cleanup_ssl_server_socket(ssl_server_connection *ssl_server) { |
631 |
|
|
632 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
633 |
|
|
634 |
ssl_connection * ssl; |
ssl_connection *ssl; |
635 |
|
|
636 |
if(ssl_server==NULL) { |
if(ssl_server==NULL) { |
637 |
|
|
660 |
|
|
661 |
} |
} |
662 |
|
|
663 |
|
|
664 |
/** |
/** |
665 |
* Deletes a SSL server connection. |
* Deletes a SSL server connection. |
666 |
* @param ssl_server data for ssl server connection |
* @param ssl_server data for ssl server connection |
667 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
668 |
*/ |
*/ |
|
|
|
669 |
int delete_ssl_server_socket(ssl_server_connection *ssl_server) { |
int delete_ssl_server_socket(ssl_server_connection *ssl_server) { |
670 |
|
|
671 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
696 |
|
|
697 |
} |
} |
698 |
|
|
699 |
|
|
700 |
/** |
/** |
701 |
* Inserts an SSL connection in the connection list of a server. |
* Inserts an SSL connection in the connection list of a server. |
702 |
* @param ssl_server data for ssl server connection |
* @param ssl_server data for ssl server connection |
703 |
* @return new SSL connection for the connection, or NULL if failed |
* @return new SSL connection for the connection, or NULL if failed |
704 |
*/ |
*/ |
705 |
|
ssl_connection *insert_accepted_ssl_socket(ssl_server_connection *ssl_server) { |
|
ssl_connection * insert_accepted_ssl_socket (ssl_server_connection |
|
|
* ssl_server) { |
|
706 |
|
|
707 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
708 |
|
|
709 |
ssl_connection * ssl = (ssl_connection *) NEW(ssl); |
ssl_connection *ssl; |
710 |
|
|
711 |
if (!ssl_initilized) { |
ASSERT(ssl_server); |
712 |
|
|
713 |
start_ssl(); |
ssl= (ssl_connection *) NEW(ssl); |
|
|
|
|
} |
|
714 |
|
|
715 |
if (!ssl_initilized) { |
if (!ssl_initilized) { |
716 |
|
|
761 |
|
|
762 |
} |
} |
763 |
|
|
764 |
|
|
765 |
/** |
/** |
766 |
* Closes an accepted SSL server connection and deletes it form the |
* Closes an accepted SSL server connection and deletes it form the |
767 |
* connection list. |
* connection list. |
769 |
* @param ssl data the connection to be deleted |
* @param ssl data the connection to be deleted |
770 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
771 |
*/ |
*/ |
772 |
|
int close_accepted_ssl_socket(ssl_server_connection *ssl_server, |
773 |
int close_accepted_ssl_socket(ssl_server_connection * ssl_server, |
ssl_connection *ssl) { |
|
ssl_connection * ssl) { |
|
774 |
|
|
775 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
776 |
|
|
802 |
|
|
803 |
} |
} |
804 |
|
|
805 |
|
|
806 |
/** |
/** |
807 |
* Deletes an accepted SSL server connection from the connection |
* Deletes an accepted SSL server connection from the connection |
808 |
* list. |
* list. |
810 |
* @param ssl data the connection to be deleted |
* @param ssl data the connection to be deleted |
811 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
812 |
*/ |
*/ |
813 |
|
int delete_accepted_ssl_socket (ssl_server_connection *ssl_server, |
814 |
int delete_accepted_ssl_socket (ssl_server_connection * ssl_server, |
ssl_connection *ssl) { |
|
ssl_connection * ssl) { |
|
815 |
|
|
816 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
817 |
|
|
857 |
|
|
858 |
} |
} |
859 |
|
|
860 |
|
|
861 |
/** |
/** |
862 |
* Embeds an accepted server socket in an existing ssl connection. |
* Embeds an accepted server socket in an existing ssl connection. |
863 |
* @param ssl ssl connection |
* @param ssl ssl connection |
864 |
* @param socket the socket to be used. |
* @param socket the socket to be used. |
865 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
866 |
*/ |
*/ |
867 |
|
int embed_accepted_ssl_socket(ssl_connection *ssl, int socket) { |
|
int embed_accepted_ssl_socket(ssl_connection * ssl, int socket) { |
|
868 |
|
|
869 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
870 |
|
|
871 |
|
ASSERT(ssl); |
872 |
|
|
873 |
ssl->socket=socket; |
ssl->socket=socket; |
874 |
|
|
875 |
if (!ssl_initilized) { |
if (!ssl_initilized) { |
880 |
|
|
881 |
if ((ssl->handler= SSL_new(ssl->ctx)) == NULL ) { |
if ((ssl->handler= SSL_new(ssl->ctx)) == NULL ) { |
882 |
|
|
883 |
error("Cannot initilize SSL handler!\n"); |
error("Cannot initialize the SSL handler!\n"); |
884 |
|
|
885 |
} |
} |
886 |
|
|
906 |
|
|
907 |
if (! update_ssl_cert_data(ssl) && (Run.httpsslclientpem != NULL)) { |
if (! update_ssl_cert_data(ssl) && (Run.httpsslclientpem != NULL)) { |
908 |
|
|
909 |
error("Client did not supply required client certificate!\n"); |
error("The client did not supply a required client certificate!\n"); |
910 |
goto sslerror; |
goto sslerror; |
911 |
|
|
912 |
} |
} |
925 |
|
|
926 |
} |
} |
927 |
|
|
928 |
|
|
929 |
/** |
/** |
930 |
* Do "accept" for a ssl server socket |
* Do "accept" for a ssl server socket |
931 |
* @param ssl ssl connection |
* @param ssl ssl connection |
932 |
* @return the ssl_connection of the socket, NULL in case of an error |
* @return the ssl_connection of the socket, NULL in case of an error |
933 |
*/ |
*/ |
934 |
|
ssl_connection *accept_ssl_socket(ssl_server_connection *ssl_server) { |
|
ssl_connection * accept_ssl_socket(ssl_server_connection * ssl_server) { |
|
935 |
|
|
936 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
937 |
|
|
938 |
int no_crypt_socket; |
int no_crypt_socket; |
939 |
int len= sizeof(struct sockaddr_in); |
int len= sizeof(struct sockaddr_in); |
940 |
struct sockaddr_in in; |
struct sockaddr_in in; |
941 |
|
|
942 |
|
ASSERT(ssl_server); |
943 |
|
|
944 |
no_crypt_socket= accept(ssl_server->server_socket, (struct sockaddr*)&in, |
no_crypt_socket= accept(ssl_server->server_socket, (struct sockaddr*)&in, |
945 |
&len); |
&len); |
946 |
|
|
947 |
if ( no_crypt_socket >= 0 ) { |
if ( no_crypt_socket >= 0 ) { |
948 |
|
|
949 |
ssl_connection * ssl = insert_accepted_ssl_socket(ssl_server); |
ssl_connection *ssl = insert_accepted_ssl_socket(ssl_server); |
950 |
|
|
951 |
if ( ssl == NULL ) { |
if ( ssl == NULL ) { |
952 |
|
|
979 |
|
|
980 |
} |
} |
981 |
|
|
|
/* Generic code */ |
|
982 |
|
|
983 |
/** |
/** |
984 |
* Send data package though the ssl connection |
* Send data package though the ssl connection |
987 |
* @param len size of the data container |
* @param len size of the data container |
988 |
* @return number of bytes transmitted, -1 in case of an error |
* @return number of bytes transmitted, -1 in case of an error |
989 |
*/ |
*/ |
990 |
|
int send_ssl_socket(ssl_connection *ssl, void *buffer, int len) { |
|
int send_ssl_socket(ssl_connection * ssl, void * buffer, int len) { |
|
991 |
|
|
992 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
993 |
|
|
994 |
|
ASSERT(ssl); |
995 |
|
|
996 |
return SSL_write (ssl->handler, (void *) buffer, len); |
return SSL_write (ssl->handler, (void *) buffer, len); |
997 |
|
|
998 |
#else |
#else |
1003 |
|
|
1004 |
} |
} |
1005 |
|
|
1006 |
|
|
1007 |
/** |
/** |
1008 |
* Receive data package though the ssl connection |
* Receive data package though the ssl connection |
1009 |
* @param ssl ssl connection |
* @param ssl ssl connection |
1011 |
* @param len size of the data container |
* @param len size of the data container |
1012 |
* @return number of bytes transmitted, -1 in case of an error |
* @return number of bytes transmitted, -1 in case of an error |
1013 |
*/ |
*/ |
1014 |
|
int recv_ssl_socket(ssl_connection *ssl, void *buffer, int len) { |
|
int recv_ssl_socket(ssl_connection * ssl, void * buffer, int len) { |
|
1015 |
|
|
1016 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
1017 |
|
|
1018 |
return SSL_read (ssl->handler, (void *) buffer, len); |
ASSERT(ssl); |
1019 |
|
|
1020 |
|
return SSL_read(ssl->handler, (void *) buffer, len); |
1021 |
|
|
1022 |
#else |
#else |
1023 |
|
|
1027 |
|
|
1028 |
} |
} |
1029 |
|
|
1030 |
|
|
1031 |
/** |
/** |
1032 |
* Receives a string data package though the ssl connection |
* Receives a string data package though the ssl connection |
1033 |
* @param ssl ssl connection |
* @param ssl ssl connection |
1035 |
* @param len size of the data container |
* @param len size of the data container |
1036 |
* @return pointer to buffer, NULL if failed |
* @return pointer to buffer, NULL if failed |
1037 |
*/ |
*/ |
1038 |
|
char *gets_ssl_socket(ssl_connection *ssl, char *buffer, int len ) { |
|
char * gets_ssl_socket(ssl_connection * ssl, char * buffer, int len ) { |
|
1039 |
|
|
1040 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
1041 |
|
|
1042 |
int i=0; |
int i=0; |
1043 |
char c; |
char c; |
1044 |
|
|
1045 |
|
ASSERT(ssl); |
1046 |
ASSERT(buffer); |
ASSERT(buffer); |
1047 |
|
|
1048 |
while(i <= len - 1) { |
while(i <= len - 1) { |
1087 |
|
|
1088 |
} |
} |
1089 |
|
|
1090 |
|
|
1091 |
/** |
/** |
1092 |
* Sends a formated string though the ssl connection |
* Sends a formated string though the ssl connection |
1093 |
* @param ssl ssl connection |
* @param ssl ssl connection |
1095 |
* @param ... data for the string |
* @param ... data for the string |
1096 |
* @return number for characters transmitted |
* @return number for characters transmitted |
1097 |
*/ |
*/ |
1098 |
|
int printf_ssl_socket(ssl_connection *ssl, const char *format, ...) { |
|
int printf_ssl_socket(ssl_connection * ssl, const char *format, ...) { |
|
1099 |
|
|
1100 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
1101 |
|
|
1104 |
|
|
1105 |
va_list ap; |
va_list ap; |
1106 |
|
|
1107 |
|
ASSERT(ssl); |
1108 |
ASSERT(format); |
ASSERT(format); |
1109 |
|
|
1110 |
va_start(ap,format); |
va_start(ap,format); |
1121 |
|
|
1122 |
} |
} |
1123 |
|
|
1124 |
|
|
1125 |
/** |
/** |
1126 |
* Start SSL support library. It has to be run before the SSL support |
* Start SSL support library. It has to be run before the SSL support |
1127 |
* can be used. |
* can be used. |
1128 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
1129 |
*/ |
*/ |
|
|
|
1130 |
int start_ssl() { |
int start_ssl() { |
|
/* Init SSL stuff */ |
|
1131 |
|
|
1132 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
1133 |
|
|
1150 |
|
|
1151 |
} |
} |
1152 |
|
|
1153 |
|
|
1154 |
/** |
/** |
1155 |
* Stop SSL support library |
* Stop SSL support library |
1156 |
* @return TRUE, or FALSE if an error has occured. |
* @return TRUE, or FALSE if an error has occured. |
1157 |
*/ |
*/ |
|
|
|
1158 |
int stop_ssl() { |
int stop_ssl() { |
1159 |
|
|
1160 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
1178 |
|
|
1179 |
} |
} |
1180 |
|
|
1181 |
|
|
1182 |
/** |
/** |
1183 |
* Generate a new ssl connection |
* Generate a new ssl connection |
1184 |
* @return ssl connection container |
* @return ssl connection container |
1185 |
*/ |
*/ |
1186 |
|
ssl_connection *new_ssl_connection(char *clientpemfilename) { |
|
ssl_connection * new_ssl_connection(char * clientpemfilename) { |
|
1187 |
|
|
1188 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
1189 |
|
|
1190 |
ssl_connection * ssl = (ssl_connection *) NEW(ssl); |
ssl_connection *ssl = (ssl_connection *) NEW(ssl); |
1191 |
|
|
1192 |
if (!ssl_initilized) { |
if (!ssl_initilized) { |
1193 |
|
|
1262 |
|
|
1263 |
} |
} |
1264 |
|
|
1265 |
|
|
1266 |
/** |
/** |
1267 |
* Generate a new ssl server connection |
* Generate a new ssl server connection |
1268 |
* @return ssl server connection container |
* @return ssl server connection container |
1269 |
*/ |
*/ |
1270 |
|
ssl_server_connection *new_ssl_server_connection(void) { |
|
ssl_server_connection * new_ssl_server_connection(void) { |
|
1271 |
|
|
1272 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
1273 |
|
|
1274 |
ssl_server_connection * ssl_server = (ssl_server_connection *) NEW(ssl_server); |
ssl_server_connection *ssl_server = (ssl_server_connection *) NEW(ssl_server); |
1275 |
|
|
1276 |
if (!ssl_initilized) { |
if (!ssl_initilized) { |
1277 |
|
|
1294 |
|
|
1295 |
} |
} |
1296 |
|
|
1297 |
|
|
1298 |
/** |
/** |
1299 |
* Checks if openssl is compiled in |
* Checks if openssl is compiled in |
1300 |
* @return TRUE if installed |
* @return TRUE if installed |
1301 |
*/ |
*/ |
|
|
|
1302 |
int have_ssl(void) { |
int have_ssl(void) { |
1303 |
|
|
1304 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
1319 |
|
|
1320 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
1321 |
|
|
1322 |
|
|
1323 |
/** |
/** |
1324 |
* Init verification of transmitted client certs |
* Init verification of transmitted client certs |
1325 |
*/ |
*/ |
1326 |
|
static int verify_init(ssl_server_connection *ssl_server) { |
|
static int verify_init(ssl_server_connection * ssl_server) { |
|
1327 |
|
|
1328 |
struct stat stat_buf; |
struct stat stat_buf; |
1329 |
|
|
1425 |
/** |
/** |
1426 |
* Check the transmitted client certs |
* Check the transmitted client certs |
1427 |
*/ |
*/ |
|
|
|
1428 |
static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) { |
static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) { |
1429 |
|
|
1430 |
char subject[STRLEN]; |
char subject[STRLEN]; |
1474 |
} |
} |
1475 |
|
|
1476 |
accept: |
accept: |
1477 |
/* log("HTTPD connection accepted to %s!\n", subject); */ |
return 1; |
|
return 1; /* Accept connection */ |
|
1478 |
|
|
1479 |
reject: |
reject: |
1480 |
log("HTTPD connection denied!\n"); |
log("HTTPD connection denied!\n"); |
1481 |
return 0; /* Reject connection */ |
return 0; |
1482 |
|
|
1483 |
} |
} |
1484 |
|
|
|
static void verify_info(ssl_server_connection *ssl_server) { |
|
|
STACK_OF(X509_NAME) *stack; |
|
1485 |
|
|
1486 |
stack=SSL_CTX_get_client_CA_list(ssl_server->ctx); |
static void verify_info(ssl_server_connection *ssl_server) { |
1487 |
log("We have found there are %d certificates\n", sk_X509_NAME_num(stack)); |
|
1488 |
|
STACK_OF(X509_NAME) *stack; |
1489 |
|
|
1490 |
|
stack=SSL_CTX_get_client_CA_list(ssl_server->ctx); |
1491 |
|
log("Found %d certificates\n", sk_X509_NAME_num(stack)); |
1492 |
|
|
1493 |
} |
} |
1494 |
|
|
1495 |
|
|
1497 |
* Helper function for the SSL threadding support |
* Helper function for the SSL threadding support |
1498 |
* @return current thread number |
* @return current thread number |
1499 |
*/ |
*/ |
|
|
|
1500 |
static int unsigned long ssl_thread_id(void) { |
static int unsigned long ssl_thread_id(void) { |
1501 |
|
|
1502 |
return ((unsigned long) pthread_self()); |
return ((unsigned long) pthread_self()); |
1503 |
|
|
1504 |
} |
} |
1505 |
|
|
1506 |
|
|
1507 |
/** |
/** |
1508 |
* Helper function for the SSL threadding support |
* Helper function for the SSL threadding support |
1509 |
*/ |
*/ |
|
|
|
1510 |
static void ssl_mutex_lock(int mode, int n, const char *file, int line) { |
static void ssl_mutex_lock(int mode, int n, const char *file, int line) { |
1511 |
|
|
1512 |
|
|
1513 |
if(mode & CRYPTO_LOCK) { |
if(mode & CRYPTO_LOCK) { |
1514 |
|
|
1515 |
pthread_mutex_lock( & ssl_mutex_table[n]); |
pthread_mutex_lock( & ssl_mutex_table[n]); |
1516 |
|
|
1517 |
} else { |
} else { |
1518 |
|
|
1519 |
pthread_mutex_unlock( & ssl_mutex_table[n]); |
pthread_mutex_unlock( & ssl_mutex_table[n]); |
1520 |
|
|
1521 |
} |
} |
1522 |
|
|
1523 |
} |
} |
1524 |
|
|
1525 |
|
|
1526 |
/** |
/** |
1527 |
* Initialize threadding support for the SSL library |
* Initialize threadding support for the SSL library |
1528 |
* @return TRUE if successful, FALSE if failed |
* @return TRUE if successful, FALSE if failed |
1529 |
*/ |
*/ |
|
|
|
1530 |
static int ssl_thread_start(void) { |
static int ssl_thread_start(void) { |
1531 |
|
|
1532 |
int i; |
int i; |
1540 |
|
|
1541 |
} |
} |
1542 |
|
|
1543 |
|
|
1544 |
/** |
/** |
1545 |
* Garbage colletion for the SSL threadding support |
* Garbage colletion for the SSL threadding support |
1546 |
* @return TRUE if successful, FALSE if failed |
* @return TRUE if successful, FALSE if failed |
1547 |
*/ |
*/ |
|
|
|
1548 |
static int ssl_thread_stop(void) { |
static int ssl_thread_stop(void) { |
1549 |
|
|
1550 |
int i; |
int i; |
1557 |
|
|
1558 |
return TRUE; |
return TRUE; |
1559 |
|
|
|
return FALSE; |
|
|
|
|
1560 |
} |
} |
1561 |
|
|
1562 |
|
|
1563 |
/** |
/** |
1564 |
* Start entropy gathering |
* Start entropy gathering |
1565 |
* @return TRUE if successful, FALSE if failed |
* @return TRUE if successful, FALSE if failed |
1566 |
*/ |
*/ |
|
|
|
1567 |
static int ssl_entropy_start(void) { |
static int ssl_entropy_start(void) { |
1568 |
|
|
1569 |
if(exist_file(URANDOM_DEVICE)) { |
if(exist_file(URANDOM_DEVICE)) { |
1579 |
|
|
1580 |
} |
} |
1581 |
|
|
|
// FIXME: log/warn PRNG not seeded properly |
|
|
|
|
1582 |
return FALSE; |
return FALSE; |
1583 |
|
|
1584 |
} |
} |
1585 |
|
|
1586 |
|
|
1587 |
/** |
/** |
1588 |
* Stop entropy gathering |
* Stop entropy gathering |
1589 |
* @return TRUE if successful, FALSE if failed |
* @return TRUE if successful, FALSE if failed |
1590 |
*/ |
*/ |
|
|
|
1591 |
static int ssl_entropy_stop(void) { |
static int ssl_entropy_stop(void) { |
1592 |
|
|
1593 |
RAND_cleanup(); |
RAND_cleanup(); |