/[monit]/monit/ssl.c
ViewVC logotype

Diff of /monit/ssl.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.17 by chopp, Fri Jun 6 09:31:16 2003 UTC revision 1.18 by hauk, Thu Jun 26 14:24:11 2003 UTC
# Line 183  int embed_ssl_socket (ssl_connection *ss Line 183  int embed_ssl_socket (ssl_connection *ss
183    
184    } else {    } else {
185    
186      error("%s: embed_ssl_socket (): Socket error!\n", prog);      log("%s: embed_ssl_socket (): Socket error!\n", prog);
187      goto sslerror;      goto sslerror;
188    }    }
189    
190    if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) {    if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) {
191    
192      handle_ssl_error("embed_ssl_socket()");      handle_ssl_error("embed_ssl_socket()");
193      error("%s: embed_ssl_socket (): Cannot initialize the SSL handler!\n",      log("%s: embed_ssl_socket (): Cannot initialize the SSL handler!\n",
194            prog);            prog);
195      goto sslerror;      goto sslerror;
196    
# Line 201  int embed_ssl_socket (ssl_connection *ss Line 201  int embed_ssl_socket (ssl_connection *ss
201    if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) {    if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) {
202    
203      handle_ssl_error("embed_ssl_socket()");      handle_ssl_error("embed_ssl_socket()");
204      error("%s: embed_ssl_socket (): Cannot generate IO buffer!\n", prog);      log("%s: embed_ssl_socket (): Cannot generate IO buffer!\n", prog);
205      goto sslerror;      goto sslerror;
206    
207    }    }
# Line 214  int embed_ssl_socket (ssl_connection *ss Line 214  int embed_ssl_socket (ssl_connection *ss
214    
215      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {
216    
217        error("%s: embed_ssl_socket (): SSL service timeout!\n",        log("%s: embed_ssl_socket (): SSL service timeout!\n",
218              prog);              prog);
219        goto sslerror;        goto sslerror;
220            
# Line 232  int embed_ssl_socket (ssl_connection *ss Line 232  int embed_ssl_socket (ssl_connection *ss
232    
233    if (! update_ssl_cert_data(ssl)) {    if (! update_ssl_cert_data(ssl)) {
234    
235      error("%s: embed_ssl_socket (): Cannot get the SSL server certificate!\n",      log("%s: embed_ssl_socket (): Cannot get the SSL server certificate!\n",
236            prog);            prog);
237      goto sslerror;      goto sslerror;
238    
# Line 355  ssl_connection *create_ssl_socket(char * Line 355  ssl_connection *create_ssl_socket(char *
355    
356    if ((socket= create_socket(hostname, port, protocol)) == -1) {    if ((socket= create_socket(hostname, port, protocol)) == -1) {
357    
358      error("%s: create_ssl_socket(): Cannot connect!\n", prog);      log("%s: create_ssl_socket(): Cannot connect!\n", prog);
359      goto sslerror;      goto sslerror;
360    
361    }    }
# Line 565  ssl_server_connection *init_ssl_server ( Line 565  ssl_server_connection *init_ssl_server (
565    if ((ssl_server->method= SSLv23_server_method()) == NULL ) {    if ((ssl_server->method= SSLv23_server_method()) == NULL ) {
566    
567      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
568      error("%s: init_ssl_server (): Cannot initialize the SSL method!\n", prog);      log("%s: init_ssl_server (): Cannot initialize the SSL method!\n", prog);
569      goto sslerror;      goto sslerror;
570    
571    }    }
# Line 573  ssl_server_connection *init_ssl_server ( Line 573  ssl_server_connection *init_ssl_server (
573    if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) {    if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) {
574    
575      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
576      error("%s: init_ssl_server (): Cannot initialize SSL server"      log("%s: init_ssl_server (): Cannot initialize SSL server"
577            " certificate handler!\n"            " certificate handler!\n"
578            , prog);            , prog);
579      goto sslerror;      goto sslerror;
# Line 584  ssl_server_connection *init_ssl_server ( Line 584  ssl_server_connection *init_ssl_server (
584                                     SSL_FILETYPE_PEM) <= 0) {                                     SSL_FILETYPE_PEM) <= 0) {
585    
586      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
587      error("%s: init_ssl_server(): Cannot initialize SSL server"      log("%s: init_ssl_server(): Cannot initialize SSL server"
588            " certificate!\n", prog);            " certificate!\n", prog);
589      goto sslerror;      goto sslerror;
590    
# Line 594  ssl_server_connection *init_ssl_server ( Line 594  ssl_server_connection *init_ssl_server (
594                                    SSL_FILETYPE_PEM) <= 0) {                                    SSL_FILETYPE_PEM) <= 0) {
595    
596      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
597      error("%s: init_ssl_server(): Cannot initialize SSL server"      log("%s: init_ssl_server(): Cannot initialize SSL server"
598            " private key!\n", prog);            " private key!\n", prog);
599      goto sslerror;      goto sslerror;
600    
# Line 603  ssl_server_connection *init_ssl_server ( Line 603  ssl_server_connection *init_ssl_server (
603    if (!SSL_CTX_check_private_key(ssl_server->ctx)) {    if (!SSL_CTX_check_private_key(ssl_server->ctx)) {
604    
605      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
606      error("%s: init_ssl_server(): The private key does not match the"      log("%s: init_ssl_server(): The private key does not match the"
607            " certificate public key!\n", prog);            " certificate public key!\n", prog);
608      goto sslerror;      goto sslerror;
609    
# Line 615  ssl_server_connection *init_ssl_server ( Line 615  ssl_server_connection *init_ssl_server (
615    if (!verify_init(ssl_server)) {    if (!verify_init(ssl_server)) {
616    
617      handle_ssl_error("init_ssl_server()");      handle_ssl_error("init_ssl_server()");
618      error("%s: init_ssl_server(): Verification engine was not"      log("%s: init_ssl_server(): Verification engine was not"
619            " properly initilized!\n", prog);            " properly initilized!\n", prog);
620      goto sslerror;      goto sslerror;
621    
# Line 669  ssl_server_connection *create_ssl_server Line 669  ssl_server_connection *create_ssl_server
669    
670    if ((socket= create_server_socket(port, backlog, bindAddr)) == -1) {    if ((socket= create_server_socket(port, backlog, bindAddr)) == -1) {
671    
672      error("%s: create_ssl_server_socket(): Cannot connect!\n", prog);      log("%s: create_ssl_server_socket(): Cannot connect!\n", prog);
673      goto sslerror;      goto sslerror;
674    
675    }    }
# Line 1010  int embed_accepted_ssl_socket(ssl_connec Line 1010  int embed_accepted_ssl_socket(ssl_connec
1010    if((ssl->handler= SSL_new(ssl->ctx)) == NULL) {    if((ssl->handler= SSL_new(ssl->ctx)) == NULL) {
1011    
1012      handle_ssl_error("embed_accepted_ssl_socket()");      handle_ssl_error("embed_accepted_ssl_socket()");
1013      error("%s: embed_accepted_ssl_socket(): Cannot initialize the"      log("%s: embed_accepted_ssl_socket(): Cannot initialize the"
1014            " SSL handler!\n", prog);            " SSL handler!\n", prog);
1015      goto sslerror;      goto sslerror;
1016    
# Line 1018  int embed_accepted_ssl_socket(ssl_connec Line 1018  int embed_accepted_ssl_socket(ssl_connec
1018    
1019    if(socket < 0) {    if(socket < 0) {
1020    
1021      error("Socket error!\n");      log("Socket error!\n");
1022      goto sslerror;      goto sslerror;
1023    
1024    }    }
# Line 1028  int embed_accepted_ssl_socket(ssl_connec Line 1028  int embed_accepted_ssl_socket(ssl_connec
1028    if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) {    if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) {
1029    
1030      handle_ssl_error("embed_accepted_ssl_socket()");      handle_ssl_error("embed_accepted_ssl_socket()");
1031      error("%s: embed_accepted_ssl_socket(): Cannot generate IO buffer!\n",      log("%s: embed_accepted_ssl_socket(): Cannot generate IO buffer!\n",
1032            prog);            prog);
1033      goto sslerror;      goto sslerror;
1034    
# Line 1042  int embed_accepted_ssl_socket(ssl_connec Line 1042  int embed_accepted_ssl_socket(ssl_connec
1042    
1043      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {
1044    
1045        error("%s: embed_accepted_ssl_socket(): SSL service timeout!\n",        log("%s: embed_accepted_ssl_socket(): SSL service timeout!\n",
1046              prog);              prog);
1047        goto sslerror;        goto sslerror;
1048                
# Line 1061  int embed_accepted_ssl_socket(ssl_connec Line 1061  int embed_accepted_ssl_socket(ssl_connec
1061    
1062    if(!update_ssl_cert_data(ssl) && (ssl->clientpemfile != NULL)) {    if(!update_ssl_cert_data(ssl) && (ssl->clientpemfile != NULL)) {
1063    
1064      error("%s: The client did not supply a required client certificate!\n",      log("%s: The client did not supply a required client certificate!\n",
1065            prog);            prog);
1066      goto sslerror;      goto sslerror;
1067    
# Line 1069  int embed_accepted_ssl_socket(ssl_connec Line 1069  int embed_accepted_ssl_socket(ssl_connec
1069    
1070    if (SSL_get_verify_result(ssl->handler)>0) {    if (SSL_get_verify_result(ssl->handler)>0) {
1071    
1072      error("%s: Verification of the certificate has failed!\n",      log("%s: Verification of the certificate has failed!\n",
1073            prog);            prog);
1074      goto sslerror;      goto sslerror;
1075    
# Line 1164  int send_ssl_socket(ssl_connection *ssl, Line 1164  int send_ssl_socket(ssl_connection *ssl,
1164    
1165      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {
1166    
1167        error("%s: send_ssl_socket(): SSL service timeout\n", prog);        log("%s: send_ssl_socket(): SSL service timeout\n", prog);
1168        break;        break;
1169                
1170      }      }
# Line 1207  int recv_ssl_socket(ssl_connection *ssl, Line 1207  int recv_ssl_socket(ssl_connection *ssl,
1207            
1208      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {      if((time(NULL)-ssl_time) > SSL_TIMEOUT) {
1209    
1210        error("%s: recv_ssl_socket(): SSL service timeout\n", prog);        log("%s: recv_ssl_socket(): SSL service timeout\n", prog);
1211        break;        break;
1212                
1213      }      }
# Line 1458  ssl_connection *new_ssl_connection(char Line 1458  ssl_connection *new_ssl_connection(char
1458    
1459    default:    default:
1460    
1461      error("%s: new_ssl_connection(): Unknown SSL version!\n", prog);      log("%s: new_ssl_connection(): Unknown SSL version!\n", prog);
1462      goto sslerror;      goto sslerror;
1463    
1464    }    }
# Line 1466  ssl_connection *new_ssl_connection(char Line 1466  ssl_connection *new_ssl_connection(char
1466    if (ssl->method == NULL ) {    if (ssl->method == NULL ) {
1467    
1468      handle_ssl_error("new_ssl_connection()");      handle_ssl_error("new_ssl_connection()");
1469      error("%s: new_ssl_connection(): Cannot initilize SSL method!\n", prog);      log("%s: new_ssl_connection(): Cannot initilize SSL method!\n", prog);
1470      goto sslerror;      goto sslerror;
1471    
1472    }    }
# Line 1474  ssl_connection *new_ssl_connection(char Line 1474  ssl_connection *new_ssl_connection(char
1474    if ((ssl->ctx= SSL_CTX_new (ssl->method)) == NULL ) {    if ((ssl->ctx= SSL_CTX_new (ssl->method)) == NULL ) {
1475    
1476      handle_ssl_error("new_ssl_connection()");      handle_ssl_error("new_ssl_connection()");
1477      error("%s: new_ssl_connection(): Cannot initilize SSL server certificate"      log("%s: new_ssl_connection(): Cannot initilize SSL server certificate"
1478            " handler!\n", prog);            " handler!\n", prog);
1479      goto sslerror;      goto sslerror;
1480    
# Line 1486  ssl_connection *new_ssl_connection(char Line 1486  ssl_connection *new_ssl_connection(char
1486                                       SSL_FILETYPE_PEM) <= 0) {                                       SSL_FILETYPE_PEM) <= 0) {
1487    
1488        handle_ssl_error("new_ssl_connection()");        handle_ssl_error("new_ssl_connection()");
1489        error("%s: new_ssl_connection(): Cannot initilize SSL server"        log("%s: new_ssl_connection(): Cannot initilize SSL server"
1490              " certificate!\n", prog);              " certificate!\n", prog);
1491        goto sslerror;        goto sslerror;
1492                
# Line 1496  ssl_connection *new_ssl_connection(char Line 1496  ssl_connection *new_ssl_connection(char
1496                                      SSL_FILETYPE_PEM) <= 0) {                                      SSL_FILETYPE_PEM) <= 0) {
1497    
1498        handle_ssl_error("new_ssl_connection()");        handle_ssl_error("new_ssl_connection()");
1499        error("%s: new_ssl_connection(): Cannot initilize SSL server"        log("%s: new_ssl_connection(): Cannot initilize SSL server"
1500              " private key!\n", prog);              " private key!\n", prog);
1501        goto sslerror;        goto sslerror;
1502    
# Line 1505  ssl_connection *new_ssl_connection(char Line 1505  ssl_connection *new_ssl_connection(char
1505      if (!SSL_CTX_check_private_key(ssl->ctx)) {      if (!SSL_CTX_check_private_key(ssl->ctx)) {
1506    
1507        handle_ssl_error("new_ssl_connection()");        handle_ssl_error("new_ssl_connection()");
1508        error("%s: new_ssl_connection(): Private key does not match the"        log("%s: new_ssl_connection(): Private key does not match the"
1509              " certificate public key!\n",              " certificate public key!\n",
1510              prog);              prog);
1511        goto sslerror;        goto sslerror;
# Line 1619  static int verify_init(ssl_server_connec Line 1619  static int verify_init(ssl_server_connec
1619    
1620    if ( -1 == stat(ssl_server->clientpemfile, &stat_buf )) {    if ( -1 == stat(ssl_server->clientpemfile, &stat_buf )) {
1621    
1622      error("%s: verify_init(): Cannot stat the SSL pem path '%s' -- %s\n",      log("%s: verify_init(): Cannot stat the SSL pem path '%s' -- %s\n",
1623            prog, Run.httpsslclientpem, STRERROR);            prog, Run.httpsslclientpem, STRERROR);
1624    
1625      goto end_error;      goto end_error;
# Line 1632  static int verify_init(ssl_server_connec Line 1632  static int verify_init(ssl_server_connec
1632                                         ssl_server->clientpemfile)) {                                         ssl_server->clientpemfile)) {
1633    
1634        handle_ssl_error("verify_init()");        handle_ssl_error("verify_init()");
1635        error("%s: verify_init(): Error setting verify directory to %s\n",        log("%s: verify_init(): Error setting verify directory to %s\n",
1636              Run.httpsslclientpem);              Run.httpsslclientpem);
1637    
1638        goto end_error;        goto end_error;
# Line 1648  static int verify_init(ssl_server_connec Line 1648  static int verify_init(ssl_server_connec
1648                                        NULL)) {                                        NULL)) {
1649    
1650        handle_ssl_error("verify_init()");        handle_ssl_error("verify_init()");
1651        error("%s: verify_init(): Error loading verify certificates from %s\n",        log("%s: verify_init(): Error loading verify certificates from %s\n",
1652              prog, ssl_server->pemfile);              prog, ssl_server->pemfile);
1653    
1654        goto end_error;        goto end_error;
# Line 1665  static int verify_init(ssl_server_connec Line 1665  static int verify_init(ssl_server_connec
1665                                        NULL)) {                                        NULL)) {
1666    
1667        handle_ssl_error("verify_init()");        handle_ssl_error("verify_init()");
1668        error("%s: verify_init(): Error loading verify certificates from %s\n",        log("%s: verify_init(): Error loading verify certificates from %s\n",
1669              prog, Run.httpsslclientpem);              prog, Run.httpsslclientpem);
1670    
1671        goto end_error;        goto end_error;
# Line 1681  static int verify_init(ssl_server_connec Line 1681  static int verify_init(ssl_server_connec
1681                                        NULL)) {                                        NULL)) {
1682    
1683        handle_ssl_error("verify_init()");        handle_ssl_error("verify_init()");
1684        error("%s: verify_init(): Error loading verify certificates from %s\n",        log("%s: verify_init(): Error loading verify certificates from %s\n",
1685              prog, ssl_server->pemfile);              prog, ssl_server->pemfile);
1686    
1687        goto end_error;        goto end_error;
# Line 1696  static int verify_init(ssl_server_connec Line 1696  static int verify_init(ssl_server_connec
1696    
1697    } else {    } else {
1698    
1699      error("%s: verify_init(): SSL client pem path is no file or directory %s\n",      log("%s: verify_init(): SSL client pem path is no file or directory %s\n",
1700            prog, ssl_server->clientpemfile);            prog, ssl_server->clientpemfile);
1701    
1702      goto end_error;      goto end_error;
# Line 1742  static int verify_callback(int preverify Line 1742  static int verify_callback(int preverify
1742                                 &found_cert)!=1) {                                 &found_cert)!=1) {
1743    
1744      handle_ssl_error("verify_callback()");      handle_ssl_error("verify_callback()");
1745      error("%s: verify_callback(): SSL connection rejected. No matching "      log("%s: verify_callback(): SSL connection rejected. No matching "
1746            "certificate found.", prog);            "certificate found.", prog);
1747    
1748      goto reject;      goto reject;
# Line 1795  static int check_preverify(X509_STORE_CT Line 1795  static int check_preverify(X509_STORE_CT
1795    
1796      /* Remote site specified a certificate, but it's not correct */      /* Remote site specified a certificate, but it's not correct */
1797            
1798      error("%s: check_preverify(): SSL connection rejected because"      log("%s: check_preverify(): SSL connection rejected because"
1799            " certificate verification has failed -- Error %i\n",            " certificate verification has failed -- Error %i\n",
1800            prog, ctx->error);            prog, ctx->error);
1801      return FALSE; /* Reject connection */      return FALSE; /* Reject connection */
# Line 1829  static int check_preverify(X509_STORE_CT Line 1829  static int check_preverify(X509_STORE_CT
1829    
1830    }    }
1831            
1832    error("%s: check_preverify(): SSL connection rejected because "    log("%s: check_preverify(): SSL connection rejected because "
1833          "certificate verification has failed -- Error %i!\n",          "certificate verification has failed -- Error %i!\n",
1834          prog, ctx->error);          prog, ctx->error);
1835    return FALSE; /* Reject connection */    return FALSE; /* Reject connection */
# Line 1971  static int handle_connection_error(int c Line 1971  static int handle_connection_error(int c
1971      return TRUE;      return TRUE;
1972            
1973    case SSL_ERROR_SYSCALL:    case SSL_ERROR_SYSCALL:
1974      error("%s: %s: Openssl syscall error: %s!\n", prog, operation,      log("%s: %s: Openssl syscall error: %s!\n", prog, operation,
1975            STRERROR);            STRERROR);
1976      return FALSE;      return FALSE;
1977    
# Line 1980  static int handle_connection_error(int c Line 1980  static int handle_connection_error(int c
1980      return FALSE;      return FALSE;
1981                
1982    default:    default:
1983      error("%s: %s: Openssl error!\n", prog, operation);      log("%s: %s: Openssl error!\n", prog, operation);
1984      return FALSE;      return FALSE;
1985    
1986    }    }
# Line 1994  static int handle_connection_error(int c Line 1994  static int handle_connection_error(int c
1994   */   */
1995  static void handle_ssl_error(char *operation) {  static void handle_ssl_error(char *operation) {
1996    
1997    error("%s: %s: Openssl engine error: %s\n", prog, operation, SSLERROR);    log("%s: %s: Openssl engine error: %s\n", prog, operation, SSLERROR);
1998    
1999  }  }
2000    

Legend:
Removed from v.1.17  
changed lines
  Added in v.1.18

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26