183 |
|
|
184 |
} else { |
} else { |
185 |
|
|
186 |
error("%s: embed_ssl_socket (): Socket error!\n", prog); |
log("%s: embed_ssl_socket (): Socket error!\n", prog); |
187 |
goto sslerror; |
goto sslerror; |
188 |
} |
} |
189 |
|
|
190 |
if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) { |
if ((ssl->handler= SSL_new (ssl->ctx)) == NULL ) { |
191 |
|
|
192 |
handle_ssl_error("embed_ssl_socket()"); |
handle_ssl_error("embed_ssl_socket()"); |
193 |
error("%s: embed_ssl_socket (): Cannot initialize the SSL handler!\n", |
log("%s: embed_ssl_socket (): Cannot initialize the SSL handler!\n", |
194 |
prog); |
prog); |
195 |
goto sslerror; |
goto sslerror; |
196 |
|
|
201 |
if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) { |
if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) { |
202 |
|
|
203 |
handle_ssl_error("embed_ssl_socket()"); |
handle_ssl_error("embed_ssl_socket()"); |
204 |
error("%s: embed_ssl_socket (): Cannot generate IO buffer!\n", prog); |
log("%s: embed_ssl_socket (): Cannot generate IO buffer!\n", prog); |
205 |
goto sslerror; |
goto sslerror; |
206 |
|
|
207 |
} |
} |
214 |
|
|
215 |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
216 |
|
|
217 |
error("%s: embed_ssl_socket (): SSL service timeout!\n", |
log("%s: embed_ssl_socket (): SSL service timeout!\n", |
218 |
prog); |
prog); |
219 |
goto sslerror; |
goto sslerror; |
220 |
|
|
232 |
|
|
233 |
if (! update_ssl_cert_data(ssl)) { |
if (! update_ssl_cert_data(ssl)) { |
234 |
|
|
235 |
error("%s: embed_ssl_socket (): Cannot get the SSL server certificate!\n", |
log("%s: embed_ssl_socket (): Cannot get the SSL server certificate!\n", |
236 |
prog); |
prog); |
237 |
goto sslerror; |
goto sslerror; |
238 |
|
|
355 |
|
|
356 |
if ((socket= create_socket(hostname, port, protocol)) == -1) { |
if ((socket= create_socket(hostname, port, protocol)) == -1) { |
357 |
|
|
358 |
error("%s: create_ssl_socket(): Cannot connect!\n", prog); |
log("%s: create_ssl_socket(): Cannot connect!\n", prog); |
359 |
goto sslerror; |
goto sslerror; |
360 |
|
|
361 |
} |
} |
565 |
if ((ssl_server->method= SSLv23_server_method()) == NULL ) { |
if ((ssl_server->method= SSLv23_server_method()) == NULL ) { |
566 |
|
|
567 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
568 |
error("%s: init_ssl_server (): Cannot initialize the SSL method!\n", prog); |
log("%s: init_ssl_server (): Cannot initialize the SSL method!\n", prog); |
569 |
goto sslerror; |
goto sslerror; |
570 |
|
|
571 |
} |
} |
573 |
if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) { |
if ((ssl_server->ctx= SSL_CTX_new(ssl_server->method)) == NULL ) { |
574 |
|
|
575 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
576 |
error("%s: init_ssl_server (): Cannot initialize SSL server" |
log("%s: init_ssl_server (): Cannot initialize SSL server" |
577 |
" certificate handler!\n" |
" certificate handler!\n" |
578 |
, prog); |
, prog); |
579 |
goto sslerror; |
goto sslerror; |
584 |
SSL_FILETYPE_PEM) <= 0) { |
SSL_FILETYPE_PEM) <= 0) { |
585 |
|
|
586 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
587 |
error("%s: init_ssl_server(): Cannot initialize SSL server" |
log("%s: init_ssl_server(): Cannot initialize SSL server" |
588 |
" certificate!\n", prog); |
" certificate!\n", prog); |
589 |
goto sslerror; |
goto sslerror; |
590 |
|
|
594 |
SSL_FILETYPE_PEM) <= 0) { |
SSL_FILETYPE_PEM) <= 0) { |
595 |
|
|
596 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
597 |
error("%s: init_ssl_server(): Cannot initialize SSL server" |
log("%s: init_ssl_server(): Cannot initialize SSL server" |
598 |
" private key!\n", prog); |
" private key!\n", prog); |
599 |
goto sslerror; |
goto sslerror; |
600 |
|
|
603 |
if (!SSL_CTX_check_private_key(ssl_server->ctx)) { |
if (!SSL_CTX_check_private_key(ssl_server->ctx)) { |
604 |
|
|
605 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
606 |
error("%s: init_ssl_server(): The private key does not match the" |
log("%s: init_ssl_server(): The private key does not match the" |
607 |
" certificate public key!\n", prog); |
" certificate public key!\n", prog); |
608 |
goto sslerror; |
goto sslerror; |
609 |
|
|
615 |
if (!verify_init(ssl_server)) { |
if (!verify_init(ssl_server)) { |
616 |
|
|
617 |
handle_ssl_error("init_ssl_server()"); |
handle_ssl_error("init_ssl_server()"); |
618 |
error("%s: init_ssl_server(): Verification engine was not" |
log("%s: init_ssl_server(): Verification engine was not" |
619 |
" properly initilized!\n", prog); |
" properly initilized!\n", prog); |
620 |
goto sslerror; |
goto sslerror; |
621 |
|
|
669 |
|
|
670 |
if ((socket= create_server_socket(port, backlog, bindAddr)) == -1) { |
if ((socket= create_server_socket(port, backlog, bindAddr)) == -1) { |
671 |
|
|
672 |
error("%s: create_ssl_server_socket(): Cannot connect!\n", prog); |
log("%s: create_ssl_server_socket(): Cannot connect!\n", prog); |
673 |
goto sslerror; |
goto sslerror; |
674 |
|
|
675 |
} |
} |
1010 |
if((ssl->handler= SSL_new(ssl->ctx)) == NULL) { |
if((ssl->handler= SSL_new(ssl->ctx)) == NULL) { |
1011 |
|
|
1012 |
handle_ssl_error("embed_accepted_ssl_socket()"); |
handle_ssl_error("embed_accepted_ssl_socket()"); |
1013 |
error("%s: embed_accepted_ssl_socket(): Cannot initialize the" |
log("%s: embed_accepted_ssl_socket(): Cannot initialize the" |
1014 |
" SSL handler!\n", prog); |
" SSL handler!\n", prog); |
1015 |
goto sslerror; |
goto sslerror; |
1016 |
|
|
1018 |
|
|
1019 |
if(socket < 0) { |
if(socket < 0) { |
1020 |
|
|
1021 |
error("Socket error!\n"); |
log("Socket error!\n"); |
1022 |
goto sslerror; |
goto sslerror; |
1023 |
|
|
1024 |
} |
} |
1028 |
if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) { |
if((ssl->socket_bio= BIO_new_socket(ssl->socket, BIO_NOCLOSE)) == NULL) { |
1029 |
|
|
1030 |
handle_ssl_error("embed_accepted_ssl_socket()"); |
handle_ssl_error("embed_accepted_ssl_socket()"); |
1031 |
error("%s: embed_accepted_ssl_socket(): Cannot generate IO buffer!\n", |
log("%s: embed_accepted_ssl_socket(): Cannot generate IO buffer!\n", |
1032 |
prog); |
prog); |
1033 |
goto sslerror; |
goto sslerror; |
1034 |
|
|
1042 |
|
|
1043 |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
1044 |
|
|
1045 |
error("%s: embed_accepted_ssl_socket(): SSL service timeout!\n", |
log("%s: embed_accepted_ssl_socket(): SSL service timeout!\n", |
1046 |
prog); |
prog); |
1047 |
goto sslerror; |
goto sslerror; |
1048 |
|
|
1061 |
|
|
1062 |
if(!update_ssl_cert_data(ssl) && (ssl->clientpemfile != NULL)) { |
if(!update_ssl_cert_data(ssl) && (ssl->clientpemfile != NULL)) { |
1063 |
|
|
1064 |
error("%s: The client did not supply a required client certificate!\n", |
log("%s: The client did not supply a required client certificate!\n", |
1065 |
prog); |
prog); |
1066 |
goto sslerror; |
goto sslerror; |
1067 |
|
|
1069 |
|
|
1070 |
if (SSL_get_verify_result(ssl->handler)>0) { |
if (SSL_get_verify_result(ssl->handler)>0) { |
1071 |
|
|
1072 |
error("%s: Verification of the certificate has failed!\n", |
log("%s: Verification of the certificate has failed!\n", |
1073 |
prog); |
prog); |
1074 |
goto sslerror; |
goto sslerror; |
1075 |
|
|
1164 |
|
|
1165 |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
1166 |
|
|
1167 |
error("%s: send_ssl_socket(): SSL service timeout\n", prog); |
log("%s: send_ssl_socket(): SSL service timeout\n", prog); |
1168 |
break; |
break; |
1169 |
|
|
1170 |
} |
} |
1207 |
|
|
1208 |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
if((time(NULL)-ssl_time) > SSL_TIMEOUT) { |
1209 |
|
|
1210 |
error("%s: recv_ssl_socket(): SSL service timeout\n", prog); |
log("%s: recv_ssl_socket(): SSL service timeout\n", prog); |
1211 |
break; |
break; |
1212 |
|
|
1213 |
} |
} |
1458 |
|
|
1459 |
default: |
default: |
1460 |
|
|
1461 |
error("%s: new_ssl_connection(): Unknown SSL version!\n", prog); |
log("%s: new_ssl_connection(): Unknown SSL version!\n", prog); |
1462 |
goto sslerror; |
goto sslerror; |
1463 |
|
|
1464 |
} |
} |
1466 |
if (ssl->method == NULL ) { |
if (ssl->method == NULL ) { |
1467 |
|
|
1468 |
handle_ssl_error("new_ssl_connection()"); |
handle_ssl_error("new_ssl_connection()"); |
1469 |
error("%s: new_ssl_connection(): Cannot initilize SSL method!\n", prog); |
log("%s: new_ssl_connection(): Cannot initilize SSL method!\n", prog); |
1470 |
goto sslerror; |
goto sslerror; |
1471 |
|
|
1472 |
} |
} |
1474 |
if ((ssl->ctx= SSL_CTX_new (ssl->method)) == NULL ) { |
if ((ssl->ctx= SSL_CTX_new (ssl->method)) == NULL ) { |
1475 |
|
|
1476 |
handle_ssl_error("new_ssl_connection()"); |
handle_ssl_error("new_ssl_connection()"); |
1477 |
error("%s: new_ssl_connection(): Cannot initilize SSL server certificate" |
log("%s: new_ssl_connection(): Cannot initilize SSL server certificate" |
1478 |
" handler!\n", prog); |
" handler!\n", prog); |
1479 |
goto sslerror; |
goto sslerror; |
1480 |
|
|
1486 |
SSL_FILETYPE_PEM) <= 0) { |
SSL_FILETYPE_PEM) <= 0) { |
1487 |
|
|
1488 |
handle_ssl_error("new_ssl_connection()"); |
handle_ssl_error("new_ssl_connection()"); |
1489 |
error("%s: new_ssl_connection(): Cannot initilize SSL server" |
log("%s: new_ssl_connection(): Cannot initilize SSL server" |
1490 |
" certificate!\n", prog); |
" certificate!\n", prog); |
1491 |
goto sslerror; |
goto sslerror; |
1492 |
|
|
1496 |
SSL_FILETYPE_PEM) <= 0) { |
SSL_FILETYPE_PEM) <= 0) { |
1497 |
|
|
1498 |
handle_ssl_error("new_ssl_connection()"); |
handle_ssl_error("new_ssl_connection()"); |
1499 |
error("%s: new_ssl_connection(): Cannot initilize SSL server" |
log("%s: new_ssl_connection(): Cannot initilize SSL server" |
1500 |
" private key!\n", prog); |
" private key!\n", prog); |
1501 |
goto sslerror; |
goto sslerror; |
1502 |
|
|
1505 |
if (!SSL_CTX_check_private_key(ssl->ctx)) { |
if (!SSL_CTX_check_private_key(ssl->ctx)) { |
1506 |
|
|
1507 |
handle_ssl_error("new_ssl_connection()"); |
handle_ssl_error("new_ssl_connection()"); |
1508 |
error("%s: new_ssl_connection(): Private key does not match the" |
log("%s: new_ssl_connection(): Private key does not match the" |
1509 |
" certificate public key!\n", |
" certificate public key!\n", |
1510 |
prog); |
prog); |
1511 |
goto sslerror; |
goto sslerror; |
1619 |
|
|
1620 |
if ( -1 == stat(ssl_server->clientpemfile, &stat_buf )) { |
if ( -1 == stat(ssl_server->clientpemfile, &stat_buf )) { |
1621 |
|
|
1622 |
error("%s: verify_init(): Cannot stat the SSL pem path '%s' -- %s\n", |
log("%s: verify_init(): Cannot stat the SSL pem path '%s' -- %s\n", |
1623 |
prog, Run.httpsslclientpem, STRERROR); |
prog, Run.httpsslclientpem, STRERROR); |
1624 |
|
|
1625 |
goto end_error; |
goto end_error; |
1632 |
ssl_server->clientpemfile)) { |
ssl_server->clientpemfile)) { |
1633 |
|
|
1634 |
handle_ssl_error("verify_init()"); |
handle_ssl_error("verify_init()"); |
1635 |
error("%s: verify_init(): Error setting verify directory to %s\n", |
log("%s: verify_init(): Error setting verify directory to %s\n", |
1636 |
Run.httpsslclientpem); |
Run.httpsslclientpem); |
1637 |
|
|
1638 |
goto end_error; |
goto end_error; |
1648 |
NULL)) { |
NULL)) { |
1649 |
|
|
1650 |
handle_ssl_error("verify_init()"); |
handle_ssl_error("verify_init()"); |
1651 |
error("%s: verify_init(): Error loading verify certificates from %s\n", |
log("%s: verify_init(): Error loading verify certificates from %s\n", |
1652 |
prog, ssl_server->pemfile); |
prog, ssl_server->pemfile); |
1653 |
|
|
1654 |
goto end_error; |
goto end_error; |
1665 |
NULL)) { |
NULL)) { |
1666 |
|
|
1667 |
handle_ssl_error("verify_init()"); |
handle_ssl_error("verify_init()"); |
1668 |
error("%s: verify_init(): Error loading verify certificates from %s\n", |
log("%s: verify_init(): Error loading verify certificates from %s\n", |
1669 |
prog, Run.httpsslclientpem); |
prog, Run.httpsslclientpem); |
1670 |
|
|
1671 |
goto end_error; |
goto end_error; |
1681 |
NULL)) { |
NULL)) { |
1682 |
|
|
1683 |
handle_ssl_error("verify_init()"); |
handle_ssl_error("verify_init()"); |
1684 |
error("%s: verify_init(): Error loading verify certificates from %s\n", |
log("%s: verify_init(): Error loading verify certificates from %s\n", |
1685 |
prog, ssl_server->pemfile); |
prog, ssl_server->pemfile); |
1686 |
|
|
1687 |
goto end_error; |
goto end_error; |
1696 |
|
|
1697 |
} else { |
} else { |
1698 |
|
|
1699 |
error("%s: verify_init(): SSL client pem path is no file or directory %s\n", |
log("%s: verify_init(): SSL client pem path is no file or directory %s\n", |
1700 |
prog, ssl_server->clientpemfile); |
prog, ssl_server->clientpemfile); |
1701 |
|
|
1702 |
goto end_error; |
goto end_error; |
1742 |
&found_cert)!=1) { |
&found_cert)!=1) { |
1743 |
|
|
1744 |
handle_ssl_error("verify_callback()"); |
handle_ssl_error("verify_callback()"); |
1745 |
error("%s: verify_callback(): SSL connection rejected. No matching " |
log("%s: verify_callback(): SSL connection rejected. No matching " |
1746 |
"certificate found.", prog); |
"certificate found.", prog); |
1747 |
|
|
1748 |
goto reject; |
goto reject; |
1795 |
|
|
1796 |
/* Remote site specified a certificate, but it's not correct */ |
/* Remote site specified a certificate, but it's not correct */ |
1797 |
|
|
1798 |
error("%s: check_preverify(): SSL connection rejected because" |
log("%s: check_preverify(): SSL connection rejected because" |
1799 |
" certificate verification has failed -- Error %i\n", |
" certificate verification has failed -- Error %i\n", |
1800 |
prog, ctx->error); |
prog, ctx->error); |
1801 |
return FALSE; /* Reject connection */ |
return FALSE; /* Reject connection */ |
1829 |
|
|
1830 |
} |
} |
1831 |
|
|
1832 |
error("%s: check_preverify(): SSL connection rejected because " |
log("%s: check_preverify(): SSL connection rejected because " |
1833 |
"certificate verification has failed -- Error %i!\n", |
"certificate verification has failed -- Error %i!\n", |
1834 |
prog, ctx->error); |
prog, ctx->error); |
1835 |
return FALSE; /* Reject connection */ |
return FALSE; /* Reject connection */ |
1971 |
return TRUE; |
return TRUE; |
1972 |
|
|
1973 |
case SSL_ERROR_SYSCALL: |
case SSL_ERROR_SYSCALL: |
1974 |
error("%s: %s: Openssl syscall error: %s!\n", prog, operation, |
log("%s: %s: Openssl syscall error: %s!\n", prog, operation, |
1975 |
STRERROR); |
STRERROR); |
1976 |
return FALSE; |
return FALSE; |
1977 |
|
|
1980 |
return FALSE; |
return FALSE; |
1981 |
|
|
1982 |
default: |
default: |
1983 |
error("%s: %s: Openssl error!\n", prog, operation); |
log("%s: %s: Openssl error!\n", prog, operation); |
1984 |
return FALSE; |
return FALSE; |
1985 |
|
|
1986 |
} |
} |
1994 |
*/ |
*/ |
1995 |
static void handle_ssl_error(char *operation) { |
static void handle_ssl_error(char *operation) { |
1996 |
|
|
1997 |
error("%s: %s: Openssl engine error: %s\n", prog, operation, SSLERROR); |
log("%s: %s: Openssl engine error: %s\n", prog, operation, SSLERROR); |
1998 |
|
|
1999 |
} |
} |
2000 |
|
|