/[monit]/monit/ssl.c
ViewVC logotype

Diff of /monit/ssl.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.16 by martinp, Tue Feb 11 21:27:39 2003 UTC revision 1.17 by chopp, Fri Jun 6 09:31:16 2003 UTC
# Line 183  int embed_ssl_socket (ssl_connection *ss Line 183  int embed_ssl_socket (ssl_connection *ss
183    
184    } else {    } else {
185    
186      error("%s: Socket error!\n", prog);      error("%s: embed_ssl_socket (): Socket error!\n", prog);
187      goto sslerror;      goto sslerror;
188    }    }
189    
190    if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) {    if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) {
191    
192      handle_ssl_error("embed_ssl_socket()");      handle_ssl_error("embed_ssl_socket()");
193      error("%s: Cannot initialize the SSL handler!\n", prog);      error("%s: embed_ssl_socket (): Cannot initialize the SSL handler!\n",
194              prog);
195      goto sslerror;      goto sslerror;
196    
197    }    }
# Line 200  int embed_ssl_socket (ssl_connection *ss Line 201  int embed_ssl_socket (ssl_connection *ss
201    if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) {    if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) {
202    
203      handle_ssl_error("embed_ssl_socket()");      handle_ssl_error("embed_ssl_socket()");
204      error("%s: Cannot generate IO buffer!\n", prog);      error("%s: embed_ssl_socket (): Cannot generate IO buffer!\n", prog);
205      goto sslerror;      goto sslerror;
206    
207    }    }
# Line 213  int embed_ssl_socket (ssl_connection *ss Line 214  int embed_ssl_socket (ssl_connection *ss
214    
215      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {
216    
217        error("%s: The connection process with the SSL service timed out!\n",        error("%s: embed_ssl_socket (): SSL service timeout!\n",
218              prog);              prog);
219        goto sslerror;        goto sslerror;
220            
# Line 231  int embed_ssl_socket (ssl_connection *ss Line 232  int embed_ssl_socket (ssl_connection *ss
232    
233    if (! update_ssl_cert_data(ssl)) {    if (! update_ssl_cert_data(ssl)) {
234    
235      error("%s: Cannot get the SSL server certificate!\n",      error("%s: embed_ssl_socket (): Cannot get the SSL server certificate!\n",
236            prog);            prog);
237      goto sslerror;      goto sslerror;
238    
# Line 354  ssl_connection *create_ssl_socket(char * Line 355  ssl_connection *create_ssl_socket(char *
355    
356    if ((socket= create_socket(hostname, port, protocol)) == -1) {    if ((socket= create_socket(hostname, port, protocol)) == -1) {
357    
358      error("%s: Cannot connect!\n", prog);      error("%s: create_ssl_socket(): Cannot connect!\n", prog);
359      goto sslerror;      goto sslerror;
360    
361    }    }
362    
363    if (! embed_ssl_socket(ssl, socket)) {    if (! embed_ssl_socket(ssl, socket)) {
364    
     error("%s: Cannot embed socket!\n", prog);  
   
365      goto sslerror;      goto sslerror;
366    
367    }    }
# Line 566  ssl_server_connection *init_ssl_server ( Line 565  ssl_server_connection *init_ssl_server (
565    if ((ssl_server->method= SSLv23_server_method()) == NULL ) {    if ((ssl_server->method= SSLv23_server_method()) == NULL ) {
566    
567      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
568      error("%s: Cannot initialize the SSL method to use!\n", prog);      error("%s: init_ssl_server (): Cannot initialize the SSL method!\n", prog);
569      goto sslerror;      goto sslerror;
570    
571    }    }
# Line 574  ssl_server_connection *init_ssl_server ( Line 573  ssl_server_connection *init_ssl_server (
573    if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) {    if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) {
574    
575      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
576      error("%s: Cannot initialize the SSL server's certificate handler!\n"      error("%s: init_ssl_server (): Cannot initialize SSL server"
577              " certificate handler!\n"
578            , prog);            , prog);
579      goto sslerror;      goto sslerror;
580    
# Line 584  ssl_server_connection *init_ssl_server ( Line 584  ssl_server_connection *init_ssl_server (
584                                     SSL_FILETYPE_PEM) <= 0) {                                     SSL_FILETYPE_PEM) <= 0) {
585    
586      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
587      error("%s: Cannot initialize the SSL server's certificate!\n", prog);      error("%s: init_ssl_server(): Cannot initialize SSL server"
588              " certificate!\n", prog);
589      goto sslerror;      goto sslerror;
590    
591    }    }
# Line 593  ssl_server_connection *init_ssl_server ( Line 594  ssl_server_connection *init_ssl_server (
594                                    SSL_FILETYPE_PEM) <= 0) {                                    SSL_FILETYPE_PEM) <= 0) {
595    
596      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
597      error("%s: Cannot initialize the SSL server's private key!\n", prog);      error("%s: init_ssl_server(): Cannot initialize SSL server"
598              " private key!\n", prog);
599      goto sslerror;      goto sslerror;
600    
601    }    }
# Line 601  ssl_server_connection *init_ssl_server ( Line 603  ssl_server_connection *init_ssl_server (
603    if (!SSL_CTX_check_private_key(ssl_server->ctx)) {    if (!SSL_CTX_check_private_key(ssl_server->ctx)) {
604    
605      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
606      error("%s: The private key does not match the certificate public key!\n",      error("%s: init_ssl_server(): The private key does not match the"
607            prog);            " certificate public key!\n", prog);
608      goto sslerror;      goto sslerror;
609    
610    }    }
# Line 613  ssl_server_connection *init_ssl_server ( Line 615  ssl_server_connection *init_ssl_server (
615    if (!verify_init(ssl_server)) {    if (!verify_init(ssl_server)) {
616    
617      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
618      error("%s: Verification engine was not properly initilized!\n", prog);      error("%s: init_ssl_server(): Verification engine was not"
619              " properly initilized!\n", prog);
620      goto sslerror;      goto sslerror;
621    
622    }    }
# Line 666  ssl_server_connection *create_ssl_server Line 669  ssl_server_connection *create_ssl_server
669    
670    if ((socket= create_server_socket(port, backlog, bindAddr)) == -1) {    if ((socket= create_server_socket(port, backlog, bindAddr)) == -1) {
671    
672      error("%s: Cannot connect!\n", prog);      error("%s: create_ssl_server_socket(): Cannot connect!\n", prog);
673      goto sslerror;      goto sslerror;
674    
675    }    }
# Line 898  int close_accepted_ssl_socket(ssl_server Line 901  int close_accepted_ssl_socket(ssl_server
901    int return_value= TRUE;    int return_value= TRUE;
902    
903    if ((ssl == NULL) ||  (ssl_server == NULL)) {    if ((ssl == NULL) ||  (ssl_server == NULL)) {
904    
905      return FALSE;      return FALSE;
906    
907    }    }
908    
909    if (close(ssl->socket) < 0) {    if (close(ssl->socket) < 0) {
# Line 1005  int embed_accepted_ssl_socket(ssl_connec Line 1010  int embed_accepted_ssl_socket(ssl_connec
1010    if((ssl->handler= SSL_new(ssl->ctx)) == NULL) {    if((ssl->handler= SSL_new(ssl->ctx)) == NULL) {
1011    
1012      handle_ssl_error("embed_accepted_ssl_socket()");      handle_ssl_error("embed_accepted_ssl_socket()");
1013      error("%s: Cannot initialize the SSL handler!\n", prog);      error("%s: embed_accepted_ssl_socket(): Cannot initialize the"
1014              " SSL handler!\n", prog);
1015      goto sslerror;      goto sslerror;
1016    
1017    }    }
# Line 1022  int embed_accepted_ssl_socket(ssl_connec Line 1028  int embed_accepted_ssl_socket(ssl_connec
1028    if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) {    if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) {
1029    
1030      handle_ssl_error("embed_accepted_ssl_socket()");      handle_ssl_error("embed_accepted_ssl_socket()");
1031      error("%s: Cannot generate IO buffer!\n", prog);      error("%s: embed_accepted_ssl_socket(): Cannot generate IO buffer!\n",
1032              prog);
1033      goto sslerror;      goto sslerror;
1034    
1035    }    }
# Line 1035  int embed_accepted_ssl_socket(ssl_connec Line 1042  int embed_accepted_ssl_socket(ssl_connec
1042    
1043      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {
1044    
1045        error("%s: The connection process with the SSL service timed out!\n",        error("%s: embed_accepted_ssl_socket(): SSL service timeout!\n",
1046              prog);              prog);
1047        goto sslerror;        goto sslerror;
1048                
# Line 1157  int send_ssl_socket(ssl_connection *ssl, Line 1164  int send_ssl_socket(ssl_connection *ssl,
1164    
1165      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {
1166    
1167        error("%s: The connection process with the SSL service has timed"        error("%s: send_ssl_socket(): SSL service timeout\n", prog);
             " out!\n", prog);  
1168        break;        break;
1169                
1170      }      }
# Line 1201  int recv_ssl_socket(ssl_connection *ssl, Line 1207  int recv_ssl_socket(ssl_connection *ssl,
1207            
1208      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {
1209    
1210        error("%s: The connection process with the SSL service has timed"        error("%s: recv_ssl_socket(): SSL service timeout\n", prog);
             " out!\n", prog);  
1211        break;        break;
1212                
1213      }      }
# Line 1453  ssl_connection *new_ssl_connection(char Line 1458  ssl_connection *new_ssl_connection(char
1458    
1459    default:    default:
1460    
1461      error("%s: Unknown SSL version!\n", prog);      error("%s: new_ssl_connection(): Unknown SSL version!\n", prog);
1462      goto sslerror;      goto sslerror;
1463    
1464    }    }
# Line 1461  ssl_connection *new_ssl_connection(char Line 1466  ssl_connection *new_ssl_connection(char
1466    if (ssl->method == NULL ) {    if (ssl->method == NULL ) {
1467    
1468      handle_ssl_error("new_ssl_connection()");      handle_ssl_error("new_ssl_connection()");
1469      error("%s: Cannot initilize SSL method!\n", prog);      error("%s: new_ssl_connection(): Cannot initilize SSL method!\n", prog);
1470      goto sslerror;      goto sslerror;
1471    
1472    }    }
# Line 1469  ssl_connection *new_ssl_connection(char Line 1474  ssl_connection *new_ssl_connection(char
1474    if ((ssl->ctx= SSL_CTX_new (ssl->method)) == NULL ) {    if ((ssl->ctx= SSL_CTX_new (ssl->method)) == NULL ) {
1475    
1476      handle_ssl_error("new_ssl_connection()");      handle_ssl_error("new_ssl_connection()");
1477      error("%s: Cannot initilize SSL server certificate handler!\n", prog);      error("%s: new_ssl_connection(): Cannot initilize SSL server certificate"
1478              " handler!\n", prog);
1479      goto sslerror;      goto sslerror;
1480    
1481    }    }
# Line 1480  ssl_connection *new_ssl_connection(char Line 1486  ssl_connection *new_ssl_connection(char
1486                                       SSL_FILETYPE_PEM) <= 0) {                                       SSL_FILETYPE_PEM) <= 0) {
1487    
1488        handle_ssl_error("new_ssl_connection()");        handle_ssl_error("new_ssl_connection()");
1489        error("%s: Cannot initilize SSL server certificate!\n", prog);        error("%s: new_ssl_connection(): Cannot initilize SSL server"
1490                " certificate!\n", prog);
1491        goto sslerror;        goto sslerror;
1492                
1493      }      }
# Line 1489  ssl_connection *new_ssl_connection(char Line 1496  ssl_connection *new_ssl_connection(char
1496                                      SSL_FILETYPE_PEM) <= 0) {                                      SSL_FILETYPE_PEM) <= 0) {
1497    
1498        handle_ssl_error("new_ssl_connection()");        handle_ssl_error("new_ssl_connection()");
1499        error("%s: Cannot initilize SSL server private key!\n", prog);        error("%s: new_ssl_connection(): Cannot initilize SSL server"
1500                " private key!\n", prog);
1501        goto sslerror;        goto sslerror;
1502    
1503      }      }
# Line 1497  ssl_connection *new_ssl_connection(char Line 1505  ssl_connection *new_ssl_connection(char
1505      if (!SSL_CTX_check_private_key(ssl->ctx)) {      if (!SSL_CTX_check_private_key(ssl->ctx)) {
1506    
1507        handle_ssl_error("new_ssl_connection()");        handle_ssl_error("new_ssl_connection()");
1508        error("%s: Private key does not match the certificate public key!\n",        error("%s: new_ssl_connection(): Private key does not match the"
1509                " certificate public key!\n",
1510              prog);              prog);
1511        goto sslerror;        goto sslerror;
1512    
# Line 1610  static int verify_init(ssl_server_connec Line 1619  static int verify_init(ssl_server_connec
1619    
1620    if ( -1 == stat(ssl_server->clientpemfile, &stat_buf )) {    if ( -1 == stat(ssl_server->clientpemfile, &stat_buf )) {
1621    
1622      error("%s: Cannot stat the SSL pem path '%s' -- %s\n",      error("%s: verify_init(): Cannot stat the SSL pem path '%s' -- %s\n",
1623            prog, Run.httpsslclientpem, STRERROR);            prog, Run.httpsslclientpem, STRERROR);
1624    
1625      goto end_error;      goto end_error;
# Line 1623  static int verify_init(ssl_server_connec Line 1632  static int verify_init(ssl_server_connec
1632                                         ssl_server->clientpemfile)) {                                         ssl_server->clientpemfile)) {
1633    
1634        handle_ssl_error("verify_init()");        handle_ssl_error("verify_init()");
1635        error("%s: Error setting verify directory to %s\n",        error("%s: verify_init(): Error setting verify directory to %s\n",
1636              Run.httpsslclientpem);              Run.httpsslclientpem);
1637    
1638        goto end_error;        goto end_error;
1639    
1640      }      }
1641    
1642      log("Loaded SSL client pem directory '%s'\n", ssl_server->clientpemfile);      log("%s: verify_init(): Loaded SSL client pem directory '%s'\n",
1643            prog, ssl_server->clientpemfile);
1644    
1645      /* Monits server cert for cli support ! */      /* Monits server cert for cli support ! */
1646    
# Line 1638  static int verify_init(ssl_server_connec Line 1648  static int verify_init(ssl_server_connec
1648                                        NULL)) {                                        NULL)) {
1649    
1650        handle_ssl_error("verify_init()");        handle_ssl_error("verify_init()");
1651        error("%s: Error loading verify certificates from %s\n",        error("%s: verify_init(): Error loading verify certificates from %s\n",
1652              prog, ssl_server->pemfile);              prog, ssl_server->pemfile);
1653    
1654        goto end_error;        goto end_error;
1655    
1656      }      }
1657    
1658      log("Loaded monit's SSL pem server file '%s'\n", ssl_server->pemfile);      log("%s: verify_init(): Loaded monit's SSL pem server file '%s'\n",
1659            prog, ssl_server->pemfile);
1660    
1661    } else if (S_ISREG(stat_buf.st_mode)) {    } else if (S_ISREG(stat_buf.st_mode)) {
1662    
# Line 1654  static int verify_init(ssl_server_connec Line 1665  static int verify_init(ssl_server_connec
1665                                        NULL)) {                                        NULL)) {
1666    
1667        handle_ssl_error("verify_init()");        handle_ssl_error("verify_init()");
1668        error("%s: Error loading verify certificates from %s\n",        error("%s: verify_init(): Error loading verify certificates from %s\n",
1669              prog, Run.httpsslclientpem);              prog, Run.httpsslclientpem);
1670    
1671        goto end_error;        goto end_error;
1672    
1673      }      }
1674    
1675      log("Loaded SSL pem client file '%s'\n", ssl_server->clientpemfile);      log("%s: verify_init(): Loaded SSL pem client file '%s'\n",
1676            prog, ssl_server->clientpemfile);
1677    
1678      /* Monits server cert for cli support ! */      /* Monits server cert for cli support ! */
1679    
# Line 1669  static int verify_init(ssl_server_connec Line 1681  static int verify_init(ssl_server_connec
1681                                        NULL)) {                                        NULL)) {
1682    
1683        handle_ssl_error("verify_init()");        handle_ssl_error("verify_init()");
1684        error("%s: Error loading verify certificates from %s\n",        error("%s: verify_init(): Error loading verify certificates from %s\n",
1685              prog, ssl_server->pemfile);              prog, ssl_server->pemfile);
1686    
1687        goto end_error;        goto end_error;
1688    
1689      }      }
1690    
1691      log("Loaded monit's SSL pem server file '%s'\n", ssl_server->pemfile);      log("%s: verify_init(): Loaded monit's SSL pem server file '%s'\n",
1692            prog, ssl_server->pemfile);
1693    
1694      SSL_CTX_set_client_CA_list(ssl_server->ctx,      SSL_CTX_set_client_CA_list(ssl_server->ctx,
1695                                 SSL_load_client_CA_file(ssl_server->clientpemfile));                                 SSL_load_client_CA_file(ssl_server->clientpemfile));
1696    
1697    } else {    } else {
1698    
1699      error("%s: SSL client pem path is no file or directory %s\n",      error("%s: verify_init(): SSL client pem path is no file or directory %s\n",
1700            prog, ssl_server->clientpemfile);            prog, ssl_server->clientpemfile);
1701    
1702      goto end_error;      goto end_error;
# Line 1729  static int verify_callback(int preverify Line 1742  static int verify_callback(int preverify
1742                                 &found_cert)!=1) {                                 &found_cert)!=1) {
1743    
1744      handle_ssl_error("verify_callback()");      handle_ssl_error("verify_callback()");
1745      error("%s: SSL connection rejected. No matching certificate found.", prog);      error("%s: verify_callback(): SSL connection rejected. No matching "
1746              "certificate found.", prog);
1747    
1748      goto reject;      goto reject;
1749    
# Line 1781  static int check_preverify(X509_STORE_CT Line 1795  static int check_preverify(X509_STORE_CT
1795    
1796      /* Remote site specified a certificate, but it's not correct */      /* Remote site specified a certificate, but it's not correct */
1797            
1798      error("%s: SSL connection rejected because certificate verification"      error("%s: check_preverify(): SSL connection rejected because"
1799            " has failed -- Error %i\n", prog, ctx->error);            " certificate verification has failed -- Error %i\n",
1800              prog, ctx->error);
1801      return FALSE; /* Reject connection */      return FALSE; /* Reject connection */
1802    
1803    }    }
# Line 1793  static int check_preverify(X509_STORE_CT Line 1808  static int check_preverify(X509_STORE_CT
1808            
1809      /* Let's accept self signed certs for the moment! */      /* Let's accept self signed certs for the moment! */
1810            
1811      log("SSL connection accepted with self signed certificate!\n");      log("%s: check_preverify(): SSL connection accepted with"
1812            " self signed certificate!\n", prog);
1813    
1814      ctx->error=0;      ctx->error=0;
1815      return TRUE;      return TRUE;
# Line 1805  static int check_preverify(X509_STORE_CT Line 1821  static int check_preverify(X509_STORE_CT
1821            
1822      /* Let's accept any purpose certs for the moment! */      /* Let's accept any purpose certs for the moment! */
1823            
1824      log("SSL connection accepted with invalid purpose!\n");      log("%s: check_preverify(): SSL connection accepted "
1825            "with invalid purpose!\n", prog);
1826    
1827      ctx->error=0;      ctx->error=0;
1828      return TRUE;      return TRUE;
1829    
1830    }    }
1831            
1832    error("%s: SSL connection rejected because certificate verification"    error("%s: check_preverify(): SSL connection rejected because "
1833          " has failed -- Error %i!\n", prog, ctx->error);          "certificate verification has failed -- Error %i!\n",
1834            prog, ctx->error);
1835    return FALSE; /* Reject connection */    return FALSE; /* Reject connection */
1836    
1837    
# Line 1827  static void verify_info(ssl_server_conne Line 1845  static void verify_info(ssl_server_conne
1845    STACK_OF(X509_NAME) *stack;    STACK_OF(X509_NAME) *stack;
1846        
1847    stack=SSL_CTX_get_client_CA_list(ssl_server->ctx);    stack=SSL_CTX_get_client_CA_list(ssl_server->ctx);
1848    log("Found %d certificates\n", sk_X509_NAME_num(stack));    log("%s: verify_info(): Found %d certificates\n", prog,
1849          sk_X509_NAME_num(stack));
1850        
1851  }  }
1852    
# Line 1952  static int handle_connection_error(int c Line 1971  static int handle_connection_error(int c
1971      return TRUE;      return TRUE;
1972            
1973    case SSL_ERROR_SYSCALL:    case SSL_ERROR_SYSCALL:
1974      error("%s: Openssl syscall error during %s: %s!\n", prog, operation,      error("%s: %s: Openssl syscall error: %s!\n", prog, operation,
1975            STRERROR);            STRERROR);
1976      return FALSE;      return FALSE;
1977    
# Line 1961  static int handle_connection_error(int c Line 1980  static int handle_connection_error(int c
1980      return FALSE;      return FALSE;
1981                
1982    default:    default:
1983      error("%s: Openssl error during %s!\n", prog, operation);      error("%s: %s: Openssl error!\n", prog, operation);
1984      return FALSE;      return FALSE;
1985    
1986    }    }
# Line 1975  static int handle_connection_error(int c Line 1994  static int handle_connection_error(int c
1994   */   */
1995  static void handle_ssl_error(char *operation) {  static void handle_ssl_error(char *operation) {
1996    
1997    error("%s: Openssl engine error during %s: %s\n", prog, operation, SSLERROR);    error("%s: %s: Openssl engine error: %s\n", prog, operation, SSLERROR);
1998    
1999  }  }
2000    

Legend:
Removed from v.1.16  
changed lines
  Added in v.1.17

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26