183 |
|
|
184 |
} else { |
} else { |
185 |
|
|
186 |
error("%s: Socket error!\n", prog); |
error("%s: embed_ssl_socket (): Socket error!\n", prog); |
187 |
goto sslerror; |
goto sslerror; |
188 |
} |
} |
189 |
|
|
190 |
if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) { |
if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) { |
191 |
|
|
192 |
handle_ssl_error("embed_ssl_socket()"); |
handle_ssl_error("embed_ssl_socket()"); |
193 |
error("%s: Cannot initialize the SSL handler!\n", prog); |
error("%s: embed_ssl_socket (): Cannot initialize the SSL handler!\n", |
194 |
|
prog); |
195 |
goto sslerror; |
goto sslerror; |
196 |
|
|
197 |
} |
} |
201 |
if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) { |
if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) { |
202 |
|
|
203 |
handle_ssl_error("embed_ssl_socket()"); |
handle_ssl_error("embed_ssl_socket()"); |
204 |
error("%s: Cannot generate IO buffer!\n", prog); |
error("%s: embed_ssl_socket (): Cannot generate IO buffer!\n", prog); |
205 |
goto sslerror; |
goto sslerror; |
206 |
|
|
207 |
} |
} |
214 |
|
|
215 |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
216 |
|
|
217 |
error("%s: The connection process with the SSL service timed out!\n", |
error("%s: embed_ssl_socket (): SSL service timeout!\n", |
218 |
prog); |
prog); |
219 |
goto sslerror; |
goto sslerror; |
220 |
|
|
232 |
|
|
233 |
if (! update_ssl_cert_data(ssl)) { |
if (! update_ssl_cert_data(ssl)) { |
234 |
|
|
235 |
error("%s: Cannot get the SSL server certificate!\n", |
error("%s: embed_ssl_socket (): Cannot get the SSL server certificate!\n", |
236 |
prog); |
prog); |
237 |
goto sslerror; |
goto sslerror; |
238 |
|
|
355 |
|
|
356 |
if ((socket= create_socket(hostname, port, protocol)) == -1) { |
if ((socket= create_socket(hostname, port, protocol)) == -1) { |
357 |
|
|
358 |
error("%s: Cannot connect!\n", prog); |
error("%s: create_ssl_socket(): Cannot connect!\n", prog); |
359 |
goto sslerror; |
goto sslerror; |
360 |
|
|
361 |
} |
} |
362 |
|
|
363 |
if (! embed_ssl_socket(ssl, socket)) { |
if (! embed_ssl_socket(ssl, socket)) { |
364 |
|
|
|
error("%s: Cannot embed socket!\n", prog); |
|
|
|
|
365 |
goto sslerror; |
goto sslerror; |
366 |
|
|
367 |
} |
} |
565 |
if ((ssl_server->method= SSLv23_server_method()) == NULL ) { |
if ((ssl_server->method= SSLv23_server_method()) == NULL ) { |
566 |
|
|
567 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
568 |
error("%s: Cannot initialize the SSL method to use!\n", prog); |
error("%s: init_ssl_server (): Cannot initialize the SSL method!\n", prog); |
569 |
goto sslerror; |
goto sslerror; |
570 |
|
|
571 |
} |
} |
573 |
if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) { |
if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) { |
574 |
|
|
575 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
576 |
error("%s: Cannot initialize the SSL server's certificate handler!\n" |
error("%s: init_ssl_server (): Cannot initialize SSL server" |
577 |
|
" certificate handler!\n" |
578 |
, prog); |
, prog); |
579 |
goto sslerror; |
goto sslerror; |
580 |
|
|
584 |
SSL_FILETYPE_PEM) <= 0) { |
SSL_FILETYPE_PEM) <= 0) { |
585 |
|
|
586 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
587 |
error("%s: Cannot initialize the SSL server's certificate!\n", prog); |
error("%s: init_ssl_server(): Cannot initialize SSL server" |
588 |
|
" certificate!\n", prog); |
589 |
goto sslerror; |
goto sslerror; |
590 |
|
|
591 |
} |
} |
594 |
SSL_FILETYPE_PEM) <= 0) { |
SSL_FILETYPE_PEM) <= 0) { |
595 |
|
|
596 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
597 |
error("%s: Cannot initialize the SSL server's private key!\n", prog); |
error("%s: init_ssl_server(): Cannot initialize SSL server" |
598 |
|
" private key!\n", prog); |
599 |
goto sslerror; |
goto sslerror; |
600 |
|
|
601 |
} |
} |
603 |
if (!SSL_CTX_check_private_key(ssl_server->ctx)) { |
if (!SSL_CTX_check_private_key(ssl_server->ctx)) { |
604 |
|
|
605 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
606 |
error("%s: The private key does not match the certificate public key!\n", |
error("%s: init_ssl_server(): The private key does not match the" |
607 |
prog); |
" certificate public key!\n", prog); |
608 |
goto sslerror; |
goto sslerror; |
609 |
|
|
610 |
} |
} |
615 |
if (!verify_init(ssl_server)) { |
if (!verify_init(ssl_server)) { |
616 |
|
|
617 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
618 |
error("%s: Verification engine was not properly initilized!\n", prog); |
error("%s: init_ssl_server(): Verification engine was not" |
619 |
|
" properly initilized!\n", prog); |
620 |
goto sslerror; |
goto sslerror; |
621 |
|
|
622 |
} |
} |
669 |
|
|
670 |
if ((socket= create_server_socket(port, backlog, bindAddr)) == -1) { |
if ((socket= create_server_socket(port, backlog, bindAddr)) == -1) { |
671 |
|
|
672 |
error("%s: Cannot connect!\n", prog); |
error("%s: create_ssl_server_socket(): Cannot connect!\n", prog); |
673 |
goto sslerror; |
goto sslerror; |
674 |
|
|
675 |
} |
} |
901 |
int return_value= TRUE; |
int return_value= TRUE; |
902 |
|
|
903 |
if ((ssl == NULL) || (ssl_server == NULL)) { |
if ((ssl == NULL) || (ssl_server == NULL)) { |
904 |
|
|
905 |
return FALSE; |
return FALSE; |
906 |
|
|
907 |
} |
} |
908 |
|
|
909 |
if (close(ssl->socket) < 0) { |
if (close(ssl->socket) < 0) { |
1010 |
if((ssl->handler= SSL_new(ssl->ctx)) == NULL) { |
if((ssl->handler= SSL_new(ssl->ctx)) == NULL) { |
1011 |
|
|
1012 |
handle_ssl_error("embed_accepted_ssl_socket()"); |
handle_ssl_error("embed_accepted_ssl_socket()"); |
1013 |
error("%s: Cannot initialize the SSL handler!\n", prog); |
error("%s: embed_accepted_ssl_socket(): Cannot initialize the" |
1014 |
|
" SSL handler!\n", prog); |
1015 |
goto sslerror; |
goto sslerror; |
1016 |
|
|
1017 |
} |
} |
1028 |
if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) { |
if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) { |
1029 |
|
|
1030 |
handle_ssl_error("embed_accepted_ssl_socket()"); |
handle_ssl_error("embed_accepted_ssl_socket()"); |
1031 |
error("%s: Cannot generate IO buffer!\n", prog); |
error("%s: embed_accepted_ssl_socket(): Cannot generate IO buffer!\n", |
1032 |
|
prog); |
1033 |
goto sslerror; |
goto sslerror; |
1034 |
|
|
1035 |
} |
} |
1042 |
|
|
1043 |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
1044 |
|
|
1045 |
error("%s: The connection process with the SSL service timed out!\n", |
error("%s: embed_accepted_ssl_socket(): SSL service timeout!\n", |
1046 |
prog); |
prog); |
1047 |
goto sslerror; |
goto sslerror; |
1048 |
|
|
1164 |
|
|
1165 |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
1166 |
|
|
1167 |
error("%s: The connection process with the SSL service has timed" |
error("%s: send_ssl_socket(): SSL service timeout\n", prog); |
|
" out!\n", prog); |
|
1168 |
break; |
break; |
1169 |
|
|
1170 |
} |
} |
1207 |
|
|
1208 |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
1209 |
|
|
1210 |
error("%s: The connection process with the SSL service has timed" |
error("%s: recv_ssl_socket(): SSL service timeout\n", prog); |
|
" out!\n", prog); |
|
1211 |
break; |
break; |
1212 |
|
|
1213 |
} |
} |
1458 |
|
|
1459 |
default: |
default: |
1460 |
|
|
1461 |
error("%s: Unknown SSL version!\n", prog); |
error("%s: new_ssl_connection(): Unknown SSL version!\n", prog); |
1462 |
goto sslerror; |
goto sslerror; |
1463 |
|
|
1464 |
} |
} |
1466 |
if (ssl->method == NULL ) { |
if (ssl->method == NULL ) { |
1467 |
|
|
1468 |
handle_ssl_error("new_ssl_connection()"); |
handle_ssl_error("new_ssl_connection()"); |
1469 |
error("%s: Cannot initilize SSL method!\n", prog); |
error("%s: new_ssl_connection(): Cannot initilize SSL method!\n", prog); |
1470 |
goto sslerror; |
goto sslerror; |
1471 |
|
|
1472 |
} |
} |
1474 |
if ((ssl->ctx= SSL_CTX_new (ssl->method)) == NULL ) { |
if ((ssl->ctx= SSL_CTX_new (ssl->method)) == NULL ) { |
1475 |
|
|
1476 |
handle_ssl_error("new_ssl_connection()"); |
handle_ssl_error("new_ssl_connection()"); |
1477 |
error("%s: Cannot initilize SSL server certificate handler!\n", prog); |
error("%s: new_ssl_connection(): Cannot initilize SSL server certificate" |
1478 |
|
" handler!\n", prog); |
1479 |
goto sslerror; |
goto sslerror; |
1480 |
|
|
1481 |
} |
} |
1486 |
SSL_FILETYPE_PEM) <= 0) { |
SSL_FILETYPE_PEM) <= 0) { |
1487 |
|
|
1488 |
handle_ssl_error("new_ssl_connection()"); |
handle_ssl_error("new_ssl_connection()"); |
1489 |
error("%s: Cannot initilize SSL server certificate!\n", prog); |
error("%s: new_ssl_connection(): Cannot initilize SSL server" |
1490 |
|
" certificate!\n", prog); |
1491 |
goto sslerror; |
goto sslerror; |
1492 |
|
|
1493 |
} |
} |
1496 |
SSL_FILETYPE_PEM) <= 0) { |
SSL_FILETYPE_PEM) <= 0) { |
1497 |
|
|
1498 |
handle_ssl_error("new_ssl_connection()"); |
handle_ssl_error("new_ssl_connection()"); |
1499 |
error("%s: Cannot initilize SSL server private key!\n", prog); |
error("%s: new_ssl_connection(): Cannot initilize SSL server" |
1500 |
|
" private key!\n", prog); |
1501 |
goto sslerror; |
goto sslerror; |
1502 |
|
|
1503 |
} |
} |
1505 |
if (!SSL_CTX_check_private_key(ssl->ctx)) { |
if (!SSL_CTX_check_private_key(ssl->ctx)) { |
1506 |
|
|
1507 |
handle_ssl_error("new_ssl_connection()"); |
handle_ssl_error("new_ssl_connection()"); |
1508 |
error("%s: Private key does not match the certificate public key!\n", |
error("%s: new_ssl_connection(): Private key does not match the" |
1509 |
|
" certificate public key!\n", |
1510 |
prog); |
prog); |
1511 |
goto sslerror; |
goto sslerror; |
1512 |
|
|
1619 |
|
|
1620 |
if ( -1 == stat(ssl_server->clientpemfile, &stat_buf )) { |
if ( -1 == stat(ssl_server->clientpemfile, &stat_buf )) { |
1621 |
|
|
1622 |
error("%s: Cannot stat the SSL pem path '%s' -- %s\n", |
error("%s: verify_init(): Cannot stat the SSL pem path '%s' -- %s\n", |
1623 |
prog, Run.httpsslclientpem, STRERROR); |
prog, Run.httpsslclientpem, STRERROR); |
1624 |
|
|
1625 |
goto end_error; |
goto end_error; |
1632 |
ssl_server->clientpemfile)) { |
ssl_server->clientpemfile)) { |
1633 |
|
|
1634 |
handle_ssl_error("verify_init()"); |
handle_ssl_error("verify_init()"); |
1635 |
error("%s: Error setting verify directory to %s\n", |
error("%s: verify_init(): Error setting verify directory to %s\n", |
1636 |
Run.httpsslclientpem); |
Run.httpsslclientpem); |
1637 |
|
|
1638 |
goto end_error; |
goto end_error; |
1639 |
|
|
1640 |
} |
} |
1641 |
|
|
1642 |
log("Loaded SSL client pem directory '%s'\n", ssl_server->clientpemfile); |
log("%s: verify_init(): Loaded SSL client pem directory '%s'\n", |
1643 |
|
prog, ssl_server->clientpemfile); |
1644 |
|
|
1645 |
/* Monits server cert for cli support ! */ |
/* Monits server cert for cli support ! */ |
1646 |
|
|
1648 |
NULL)) { |
NULL)) { |
1649 |
|
|
1650 |
handle_ssl_error("verify_init()"); |
handle_ssl_error("verify_init()"); |
1651 |
error("%s: Error loading verify certificates from %s\n", |
error("%s: verify_init(): Error loading verify certificates from %s\n", |
1652 |
prog, ssl_server->pemfile); |
prog, ssl_server->pemfile); |
1653 |
|
|
1654 |
goto end_error; |
goto end_error; |
1655 |
|
|
1656 |
} |
} |
1657 |
|
|
1658 |
log("Loaded monit's SSL pem server file '%s'\n", ssl_server->pemfile); |
log("%s: verify_init(): Loaded monit's SSL pem server file '%s'\n", |
1659 |
|
prog, ssl_server->pemfile); |
1660 |
|
|
1661 |
} else if (S_ISREG(stat_buf.st_mode)) { |
} else if (S_ISREG(stat_buf.st_mode)) { |
1662 |
|
|
1665 |
NULL)) { |
NULL)) { |
1666 |
|
|
1667 |
handle_ssl_error("verify_init()"); |
handle_ssl_error("verify_init()"); |
1668 |
error("%s: Error loading verify certificates from %s\n", |
error("%s: verify_init(): Error loading verify certificates from %s\n", |
1669 |
prog, Run.httpsslclientpem); |
prog, Run.httpsslclientpem); |
1670 |
|
|
1671 |
goto end_error; |
goto end_error; |
1672 |
|
|
1673 |
} |
} |
1674 |
|
|
1675 |
log("Loaded SSL pem client file '%s'\n", ssl_server->clientpemfile); |
log("%s: verify_init(): Loaded SSL pem client file '%s'\n", |
1676 |
|
prog, ssl_server->clientpemfile); |
1677 |
|
|
1678 |
/* Monits server cert for cli support ! */ |
/* Monits server cert for cli support ! */ |
1679 |
|
|
1681 |
NULL)) { |
NULL)) { |
1682 |
|
|
1683 |
handle_ssl_error("verify_init()"); |
handle_ssl_error("verify_init()"); |
1684 |
error("%s: Error loading verify certificates from %s\n", |
error("%s: verify_init(): Error loading verify certificates from %s\n", |
1685 |
prog, ssl_server->pemfile); |
prog, ssl_server->pemfile); |
1686 |
|
|
1687 |
goto end_error; |
goto end_error; |
1688 |
|
|
1689 |
} |
} |
1690 |
|
|
1691 |
log("Loaded monit's SSL pem server file '%s'\n", ssl_server->pemfile); |
log("%s: verify_init(): Loaded monit's SSL pem server file '%s'\n", |
1692 |
|
prog, ssl_server->pemfile); |
1693 |
|
|
1694 |
SSL_CTX_set_client_CA_list(ssl_server->ctx, |
SSL_CTX_set_client_CA_list(ssl_server->ctx, |
1695 |
SSL_load_client_CA_file(ssl_server->clientpemfile)); |
SSL_load_client_CA_file(ssl_server->clientpemfile)); |
1696 |
|
|
1697 |
} else { |
} else { |
1698 |
|
|
1699 |
error("%s: SSL client pem path is no file or directory %s\n", |
error("%s: verify_init(): SSL client pem path is no file or directory %s\n", |
1700 |
prog, ssl_server->clientpemfile); |
prog, ssl_server->clientpemfile); |
1701 |
|
|
1702 |
goto end_error; |
goto end_error; |
1742 |
&found_cert)!=1) { |
&found_cert)!=1) { |
1743 |
|
|
1744 |
handle_ssl_error("verify_callback()"); |
handle_ssl_error("verify_callback()"); |
1745 |
error("%s: SSL connection rejected. No matching certificate found.", prog); |
error("%s: verify_callback(): SSL connection rejected. No matching " |
1746 |
|
"certificate found.", prog); |
1747 |
|
|
1748 |
goto reject; |
goto reject; |
1749 |
|
|
1795 |
|
|
1796 |
/* Remote site specified a certificate, but it's not correct */ |
/* Remote site specified a certificate, but it's not correct */ |
1797 |
|
|
1798 |
error("%s: SSL connection rejected because certificate verification" |
error("%s: check_preverify(): SSL connection rejected because" |
1799 |
" has failed -- Error %i\n", prog, ctx->error); |
" certificate verification has failed -- Error %i\n", |
1800 |
|
prog, ctx->error); |
1801 |
return FALSE; /* Reject connection */ |
return FALSE; /* Reject connection */ |
1802 |
|
|
1803 |
} |
} |
1808 |
|
|
1809 |
/* Let's accept self signed certs for the moment! */ |
/* Let's accept self signed certs for the moment! */ |
1810 |
|
|
1811 |
log("SSL connection accepted with self signed certificate!\n"); |
log("%s: check_preverify(): SSL connection accepted with" |
1812 |
|
" self signed certificate!\n", prog); |
1813 |
|
|
1814 |
ctx->error=0; |
ctx->error=0; |
1815 |
return TRUE; |
return TRUE; |
1821 |
|
|
1822 |
/* Let's accept any purpose certs for the moment! */ |
/* Let's accept any purpose certs for the moment! */ |
1823 |
|
|
1824 |
log("SSL connection accepted with invalid purpose!\n"); |
log("%s: check_preverify(): SSL connection accepted " |
1825 |
|
"with invalid purpose!\n", prog); |
1826 |
|
|
1827 |
ctx->error=0; |
ctx->error=0; |
1828 |
return TRUE; |
return TRUE; |
1829 |
|
|
1830 |
} |
} |
1831 |
|
|
1832 |
error("%s: SSL connection rejected because certificate verification" |
error("%s: check_preverify(): SSL connection rejected because " |
1833 |
" has failed -- Error %i!\n", prog, ctx->error); |
"certificate verification has failed -- Error %i!\n", |
1834 |
|
prog, ctx->error); |
1835 |
return FALSE; /* Reject connection */ |
return FALSE; /* Reject connection */ |
1836 |
|
|
1837 |
|
|
1845 |
STACK_OF(X509_NAME) *stack; |
STACK_OF(X509_NAME) *stack; |
1846 |
|
|
1847 |
stack=SSL_CTX_get_client_CA_list(ssl_server->ctx); |
stack=SSL_CTX_get_client_CA_list(ssl_server->ctx); |
1848 |
log("Found %d certificates\n", sk_X509_NAME_num(stack)); |
log("%s: verify_info(): Found %d certificates\n", prog, |
1849 |
|
sk_X509_NAME_num(stack)); |
1850 |
|
|
1851 |
} |
} |
1852 |
|
|
1971 |
return TRUE; |
return TRUE; |
1972 |
|
|
1973 |
case SSL_ERROR_SYSCALL: |
case SSL_ERROR_SYSCALL: |
1974 |
error("%s: Openssl syscall error during %s: %s!\n", prog, operation, |
error("%s: %s: Openssl syscall error: %s!\n", prog, operation, |
1975 |
STRERROR); |
STRERROR); |
1976 |
return FALSE; |
return FALSE; |
1977 |
|
|
1980 |
return FALSE; |
return FALSE; |
1981 |
|
|
1982 |
default: |
default: |
1983 |
error("%s: Openssl error during %s!\n", prog, operation); |
error("%s: %s: Openssl error!\n", prog, operation); |
1984 |
return FALSE; |
return FALSE; |
1985 |
|
|
1986 |
} |
} |
1994 |
*/ |
*/ |
1995 |
static void handle_ssl_error(char *operation) { |
static void handle_ssl_error(char *operation) { |
1996 |
|
|
1997 |
error("%s: Openssl engine error during %s: %s\n", prog, operation, SSLERROR); |
error("%s: %s: Openssl engine error: %s\n", prog, operation, SSLERROR); |
1998 |
|
|
1999 |
} |
} |
2000 |
|
|