/[monit]/monit/ssl.c
ViewVC logotype

Diff of /monit/ssl.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.3 by chopp, Tue Oct 8 11:34:37 2002 UTC revision 1.4 by chopp, Thu Oct 10 16:08:53 2002 UTC
# Line 32  Line 32 
32  #include <pthread.h>  #include <pthread.h>
33  #include <unistd.h>  #include <unistd.h>
34    
   
35  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
36  #include <openssl/crypto.h>  #include <openssl/crypto.h>
37  #include <openssl/x509.h>  #include <openssl/x509.h>
38    #include <openssl/x509_vfy.h>
39  #include <openssl/pem.h>  #include <openssl/pem.h>
40  #include <openssl/ssl.h>  #include <openssl/ssl.h>
41  #include <openssl/err.h>  #include <openssl/err.h>
# Line 56  static void ssl_mutex_lock(int mode, int Line 56  static void ssl_mutex_lock(int mode, int
56  static int ssl_entropy_start(void);  static int ssl_entropy_start(void);
57  static int ssl_entropy_stop(void);  static int ssl_entropy_stop(void);
58    
59    static int verify_callback(int, X509_STORE_CTX *);
60    
61  static pthread_mutex_t   ssl_mutex= PTHREAD_MUTEX_INITIALIZER;  static pthread_mutex_t   ssl_mutex= PTHREAD_MUTEX_INITIALIZER;
62  static pthread_mutex_t * ssl_mutex_table;  static pthread_mutex_t * ssl_mutex_table;
63  #endif  #endif
# Line 138  int embed_ssl_socket (ssl_connection * s Line 140  int embed_ssl_socket (ssl_connection * s
140    
141    ssl->cipher= (char *) SSL_get_cipher(ssl->handler);    ssl->cipher= (char *) SSL_get_cipher(ssl->handler);
142    
143      /*
144    if ((ssl->cert = SSL_get_peer_certificate (ssl->handler)) == NULL) {    if ((ssl->cert = SSL_get_peer_certificate (ssl->handler)) == NULL) {
145    
146      error("Cannot get SSL server certificate!\n");      error("Cannot get SSL server certificate!\n");
# Line 148  int embed_ssl_socket (ssl_connection * s Line 151  int embed_ssl_socket (ssl_connection * s
151    ssl->cert_issuer=X509_NAME_oneline (X509_get_issuer_name (ssl->cert),0,0);    ssl->cert_issuer=X509_NAME_oneline (X509_get_issuer_name (ssl->cert),0,0);
152    ssl->cert_subject=X509_NAME_oneline (X509_get_subject_name (ssl->cert),0,0);    ssl->cert_subject=X509_NAME_oneline (X509_get_subject_name (ssl->cert),0,0);
153    
154      */
155    
156      if (! update_ssl_cert_data(ssl)) {
157    
158        error("Cannot get SSL server certificate!\n");
159        goto sslerror;
160    
161      }
162    
163    return TRUE;    return TRUE;
164    
165   sslerror:   sslerror:
# Line 162  int embed_ssl_socket (ssl_connection * s Line 174  int embed_ssl_socket (ssl_connection * s
174  #endif  #endif
175  }  }
176    
177    
178    int update_ssl_cert_data(ssl_connection *ssl) {
179    
180    #ifdef HAVE_OPENSSL
181    
182      unsigned char md5[EVP_MAX_MD_SIZE];
183    
184      if ((ssl->cert = SSL_get_peer_certificate (ssl->handler)) == NULL) {
185    
186        return FALSE;
187    
188      }
189    
190      ssl->cert_issuer=X509_NAME_oneline (X509_get_issuer_name (ssl->cert),0,0);
191      ssl->cert_subject=X509_NAME_oneline (X509_get_subject_name (ssl->cert),0,0);
192      X509_digest(ssl->cert,EVP_md5(), md5, &ssl->cert_md5_len);
193      ssl->cert_md5=xstrdup(md5);
194    
195      return TRUE;
196    
197    #else
198    
199      return FALSE;
200    
201    #endif
202    
203    }
204    
205  /**  /**
206   * Open a socket against hostname:port with the given protocol.   * Open a socket against hostname:port with the given protocol.
207   * This socket is sent through a ssl connection.   * This socket is sent through a ssl connection.
# Line 282  int cleanup_ssl_socket(ssl_connection *s Line 322  int cleanup_ssl_socket(ssl_connection *s
322    
323    }    }
324    
325      if (ssl->cert_md5 != NULL) {
326    
327        free(ssl->cert_md5);
328        ssl->cert_md5= NULL;
329    
330      }
331    
332    return TRUE;    return TRUE;
333    
334  #else  #else
# Line 341  ssl_server_connection * init_ssl_server Line 388  ssl_server_connection * init_ssl_server
388  #ifdef HAVE_OPENSSL  #ifdef HAVE_OPENSSL
389    
390    ssl_server_connection * ssl_server = new_ssl_server_connection();    ssl_server_connection * ssl_server = new_ssl_server_connection();
   /* new_ssl_server_connection()*/  
391        
392    if ((ssl_server->method= SSLv23_server_method()) == NULL ) {    if ((ssl_server->method= SSLv23_server_method()) == NULL ) {
393    
# Line 378  ssl_server_connection * init_ssl_server Line 424  ssl_server_connection * init_ssl_server
424    
425    }    }
426    
427      /**
428       * We do need this to force transmission of client certs
429       */
430      SSL_CTX_set_verify(ssl_server->ctx, SSL_VERIFY_PEER, verify_callback);
431    
432    return ssl_server;    return ssl_server;
433    
434   sslerror:   sslerror:
# Line 608  int close_accepted_ssl_socket(ssl_server Line 659  int close_accepted_ssl_socket(ssl_server
659      return FALSE;      return FALSE;
660    }    }
661    
662    return ((close(ssl->socket) >= 0) && delete_accepted_ssl_socket(ssl_server,    return (delete_accepted_ssl_socket(ssl_server,  ssl) && (close(ssl->socket) >= 0));
                                                                   ssl));  
   
   return TRUE;  
663    
664  #else  #else
665    
# Line 702  int embed_accepted_ssl_socket(ssl_connec Line 750  int embed_accepted_ssl_socket(ssl_connec
750    }    }
751    
752    ssl->cipher= (char *) SSL_get_cipher(ssl->handler);    ssl->cipher= (char *) SSL_get_cipher(ssl->handler);
   ssl->cert= SSL_get_peer_certificate(ssl->handler);  
753    
754    if ( ssl->cert!= NULL ) {    update_ssl_cert_data(ssl);
       
     ssl->cert_issuer=X509_NAME_oneline(X509_get_issuer_name(ssl->cert),  
                                        0, 0);  
     ssl->cert_subject=X509_NAME_oneline(X509_get_subject_name(ssl->cert),  
                                         0, 0);  
   
   }  
755    
756    return TRUE;    return TRUE;
757    
# Line 972  ssl_connection * new_ssl_connection(void Line 1012  ssl_connection * new_ssl_connection(void
1012    ssl->socket= 0;    ssl->socket= 0;
1013    ssl->next = NULL;    ssl->next = NULL;
1014    ssl->accepted = FALSE;    ssl->accepted = FALSE;
1015      ssl->cert_md5 = NULL;
1016      ssl->cert_md5_len = 0;
1017    
1018    if ((ssl->method= SSLv23_client_method()) == NULL ) {    if ((ssl->method= SSLv23_client_method()) == NULL ) {
1019    
# Line 1051  int have_ssl(void) { Line 1093  int have_ssl(void) {
1093  /* ----------------------------------------------------------------- Private */  /* ----------------------------------------------------------------- Private */
1094    
1095    
1096    
1097    #ifdef HAVE_OPENSSL
1098    
1099  /**  /**
1100   * Helper function for the SSL threadding support   * We do need this to force transmission of client certs
1101   * @return current thread number   * @return current thread number
1102   */   */
1103    
1104  #ifdef HAVE_OPENSSL  static int verify_callback(int preverify, X509_STORE_CTX *ctx) {
1105      return 1;
1106    }
1107    
1108    /**
1109     * Helper function for the SSL threadding support
1110     * @return current thread number
1111     */
1112    
1113  static int unsigned long ssl_thread_id(void) {  static int unsigned long ssl_thread_id(void) {
1114    

Legend:
Removed from v.1.3  
changed lines
  Added in v.1.4

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26