32 |
#include <pthread.h> |
#include <pthread.h> |
33 |
#include <unistd.h> |
#include <unistd.h> |
34 |
|
|
|
|
|
35 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
36 |
#include <openssl/crypto.h> |
#include <openssl/crypto.h> |
37 |
#include <openssl/x509.h> |
#include <openssl/x509.h> |
38 |
|
#include <openssl/x509_vfy.h> |
39 |
#include <openssl/pem.h> |
#include <openssl/pem.h> |
40 |
#include <openssl/ssl.h> |
#include <openssl/ssl.h> |
41 |
#include <openssl/err.h> |
#include <openssl/err.h> |
56 |
static int ssl_entropy_start(void); |
static int ssl_entropy_start(void); |
57 |
static int ssl_entropy_stop(void); |
static int ssl_entropy_stop(void); |
58 |
|
|
59 |
|
static int verify_callback(int, X509_STORE_CTX *); |
60 |
|
|
61 |
static pthread_mutex_t ssl_mutex= PTHREAD_MUTEX_INITIALIZER; |
static pthread_mutex_t ssl_mutex= PTHREAD_MUTEX_INITIALIZER; |
62 |
static pthread_mutex_t * ssl_mutex_table; |
static pthread_mutex_t * ssl_mutex_table; |
63 |
#endif |
#endif |
140 |
|
|
141 |
ssl->cipher= (char *) SSL_get_cipher(ssl->handler); |
ssl->cipher= (char *) SSL_get_cipher(ssl->handler); |
142 |
|
|
143 |
|
/* |
144 |
if ((ssl->cert = SSL_get_peer_certificate (ssl->handler)) == NULL) { |
if ((ssl->cert = SSL_get_peer_certificate (ssl->handler)) == NULL) { |
145 |
|
|
146 |
error("Cannot get SSL server certificate!\n"); |
error("Cannot get SSL server certificate!\n"); |
151 |
ssl->cert_issuer=X509_NAME_oneline (X509_get_issuer_name (ssl->cert),0,0); |
ssl->cert_issuer=X509_NAME_oneline (X509_get_issuer_name (ssl->cert),0,0); |
152 |
ssl->cert_subject=X509_NAME_oneline (X509_get_subject_name (ssl->cert),0,0); |
ssl->cert_subject=X509_NAME_oneline (X509_get_subject_name (ssl->cert),0,0); |
153 |
|
|
154 |
|
*/ |
155 |
|
|
156 |
|
if (! update_ssl_cert_data(ssl)) { |
157 |
|
|
158 |
|
error("Cannot get SSL server certificate!\n"); |
159 |
|
goto sslerror; |
160 |
|
|
161 |
|
} |
162 |
|
|
163 |
return TRUE; |
return TRUE; |
164 |
|
|
165 |
sslerror: |
sslerror: |
174 |
#endif |
#endif |
175 |
} |
} |
176 |
|
|
177 |
|
|
178 |
|
int update_ssl_cert_data(ssl_connection *ssl) { |
179 |
|
|
180 |
|
#ifdef HAVE_OPENSSL |
181 |
|
|
182 |
|
unsigned char md5[EVP_MAX_MD_SIZE]; |
183 |
|
|
184 |
|
if ((ssl->cert = SSL_get_peer_certificate (ssl->handler)) == NULL) { |
185 |
|
|
186 |
|
return FALSE; |
187 |
|
|
188 |
|
} |
189 |
|
|
190 |
|
ssl->cert_issuer=X509_NAME_oneline (X509_get_issuer_name (ssl->cert),0,0); |
191 |
|
ssl->cert_subject=X509_NAME_oneline (X509_get_subject_name (ssl->cert),0,0); |
192 |
|
X509_digest(ssl->cert,EVP_md5(), md5, &ssl->cert_md5_len); |
193 |
|
ssl->cert_md5=xstrdup(md5); |
194 |
|
|
195 |
|
return TRUE; |
196 |
|
|
197 |
|
#else |
198 |
|
|
199 |
|
return FALSE; |
200 |
|
|
201 |
|
#endif |
202 |
|
|
203 |
|
} |
204 |
|
|
205 |
/** |
/** |
206 |
* Open a socket against hostname:port with the given protocol. |
* Open a socket against hostname:port with the given protocol. |
207 |
* This socket is sent through a ssl connection. |
* This socket is sent through a ssl connection. |
322 |
|
|
323 |
} |
} |
324 |
|
|
325 |
|
if (ssl->cert_md5 != NULL) { |
326 |
|
|
327 |
|
free(ssl->cert_md5); |
328 |
|
ssl->cert_md5= NULL; |
329 |
|
|
330 |
|
} |
331 |
|
|
332 |
return TRUE; |
return TRUE; |
333 |
|
|
334 |
#else |
#else |
388 |
#ifdef HAVE_OPENSSL |
#ifdef HAVE_OPENSSL |
389 |
|
|
390 |
ssl_server_connection * ssl_server = new_ssl_server_connection(); |
ssl_server_connection * ssl_server = new_ssl_server_connection(); |
|
/* new_ssl_server_connection()*/ |
|
391 |
|
|
392 |
if ((ssl_server->method= SSLv23_server_method()) == NULL ) { |
if ((ssl_server->method= SSLv23_server_method()) == NULL ) { |
393 |
|
|
424 |
|
|
425 |
} |
} |
426 |
|
|
427 |
|
/** |
428 |
|
* We do need this to force transmission of client certs |
429 |
|
*/ |
430 |
|
SSL_CTX_set_verify(ssl_server->ctx, SSL_VERIFY_PEER, verify_callback); |
431 |
|
|
432 |
return ssl_server; |
return ssl_server; |
433 |
|
|
434 |
sslerror: |
sslerror: |
659 |
return FALSE; |
return FALSE; |
660 |
} |
} |
661 |
|
|
662 |
return ((close(ssl->socket) >= 0) && delete_accepted_ssl_socket(ssl_server, |
return (delete_accepted_ssl_socket(ssl_server, ssl) && (close(ssl->socket) >= 0)); |
|
ssl)); |
|
|
|
|
|
return TRUE; |
|
663 |
|
|
664 |
#else |
#else |
665 |
|
|
750 |
} |
} |
751 |
|
|
752 |
ssl->cipher= (char *) SSL_get_cipher(ssl->handler); |
ssl->cipher= (char *) SSL_get_cipher(ssl->handler); |
|
ssl->cert= SSL_get_peer_certificate(ssl->handler); |
|
753 |
|
|
754 |
if ( ssl->cert!= NULL ) { |
update_ssl_cert_data(ssl); |
|
|
|
|
ssl->cert_issuer=X509_NAME_oneline(X509_get_issuer_name(ssl->cert), |
|
|
0, 0); |
|
|
ssl->cert_subject=X509_NAME_oneline(X509_get_subject_name(ssl->cert), |
|
|
0, 0); |
|
|
|
|
|
} |
|
755 |
|
|
756 |
return TRUE; |
return TRUE; |
757 |
|
|
1012 |
ssl->socket= 0; |
ssl->socket= 0; |
1013 |
ssl->next = NULL; |
ssl->next = NULL; |
1014 |
ssl->accepted = FALSE; |
ssl->accepted = FALSE; |
1015 |
|
ssl->cert_md5 = NULL; |
1016 |
|
ssl->cert_md5_len = 0; |
1017 |
|
|
1018 |
if ((ssl->method= SSLv23_client_method()) == NULL ) { |
if ((ssl->method= SSLv23_client_method()) == NULL ) { |
1019 |
|
|
1093 |
/* ----------------------------------------------------------------- Private */ |
/* ----------------------------------------------------------------- Private */ |
1094 |
|
|
1095 |
|
|
1096 |
|
|
1097 |
|
#ifdef HAVE_OPENSSL |
1098 |
|
|
1099 |
/** |
/** |
1100 |
* Helper function for the SSL threadding support |
* We do need this to force transmission of client certs |
1101 |
* @return current thread number |
* @return current thread number |
1102 |
*/ |
*/ |
1103 |
|
|
1104 |
#ifdef HAVE_OPENSSL |
static int verify_callback(int preverify, X509_STORE_CTX *ctx) { |
1105 |
|
return 1; |
1106 |
|
} |
1107 |
|
|
1108 |
|
/** |
1109 |
|
* Helper function for the SSL threadding support |
1110 |
|
* @return current thread number |
1111 |
|
*/ |
1112 |
|
|
1113 |
static int unsigned long ssl_thread_id(void) { |
static int unsigned long ssl_thread_id(void) { |
1114 |
|
|