00001 #include "headers.h"
00002
00064
00068 SslCtx::SslCtx()
00069 {
00070 SSL_METHOD *method;
00071 method = SSLv23_method();
00072 m_sslCtx = SSL_CTX_new(method);
00073 if (m_sslCtx == NULL) {
00074 debug(DEBUG_SSL, "Error creating SslCtx object");
00075 return;
00076 }
00077
00078 setDefaultOptions();
00079 }
00080
00081
00082 SslCtx::~SslCtx()
00083 {
00084 if (m_sslCtx) {
00085 SSL_CTX_free(m_sslCtx);
00086 }
00087 }
00088
00089
00090 SSL_CTX*
00091 SslCtx::getSslCtx()
00092 {
00093 return m_sslCtx;
00094 }
00095
00096
00097 int
00098 SslCtx::verify_callback(int ok, X509_STORE_CTX *ctx)
00099 {
00100
00101
00102
00103
00104
00105
00106
00107 if(!ok) {
00108
00109
00110
00111 switch(ctx->error) {
00112 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
00113 debug(DEBUG_SSL, "error: unable to get issuer cert\n");
00114 break;
00115
00116 case X509_V_ERR_CERT_NOT_YET_VALID:
00117 debug(DEBUG_SSL, "error: cert not yet valid\n");
00118 break;
00119
00120
00121 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
00122 debug(DEBUG_SSL, "error: cert not before field\n");
00123 break;
00124
00125 case X509_V_ERR_CERT_HAS_EXPIRED:
00126 debug(DEBUG_SSL, "error: cert has expired\n");
00127 break;
00128
00129 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
00130 debug(DEBUG_SSL, "error: cert not after field\n");
00131 break;
00132
00133 default:
00134 debug(DEBUG_SSL, "error: no matching case\n");
00135 break;
00136 }
00137 }
00138
00139 return ok;
00140 }
00141
00142
00143
00144
00145
00146
00147
00148
00149
00150
00151
00152
00153
00154
00155
00156
00157
00158
00159 int
00160 SslCtx::getPrivateKeyPasswordCallback(char* buf, int size, int rwflag, void* user_data)
00161 {
00162 int len;
00163 SslCtx* sc;
00164
00165 sc = (SslCtx*) user_data;
00166
00167 len = sc->m_privateKeyPassword.size();
00168 len = (len > size) ? size : len;
00169 memcpy(buf, sc->m_privateKeyPassword.c_str(), len);
00170
00171 return len;
00172 }
00173
00174
00175
00176
00177
00178
00179
00180
00181
00182
00183
00184
00185
00186
00187
00188
00189
00190
00191
00192
00193
00194
00195
00196
00197
00198
00199
00200
00201
00206 long
00207 SslCtx::setDefaultOptions() {
00208
00209 setOptions(SSL_OP_ALL);
00210
00211
00212
00213 setOptions(SSL_OP_SINGLE_DH_USE);
00214
00215
00216 setOptions(SSL_OP_NO_SSLv2);
00217
00218 return getOptions();
00219 }
00220
00221
00225 long
00226 SslCtx::setOptions(long options) {
00227 return SSL_CTX_set_options(m_sslCtx, options);
00228 }
00229
00230
00234 long
00235 SslCtx::getOptions() {
00236 return SSL_CTX_get_options(m_sslCtx);
00237 }
00238
00239
00243 void
00244 SslCtx::setPrivateKeyPassword(string password) {
00245 m_privateKeyPassword = password;
00246
00247
00248
00249 SSL_CTX_set_default_passwd_cb(m_sslCtx, getPrivateKeyPasswordCallback);
00250
00251
00252
00253 SSL_CTX_set_default_passwd_cb_userdata(m_sslCtx, this);
00254 }
00255
00256
00264 bool
00265 SslCtx::setCertificateFile(string certificateFile) {
00266
00267 if (certificateFile.empty()) {
00268 return false;
00269 }
00270
00271 int err = SSL_CTX_use_certificate_file(m_sslCtx, certificateFile.c_str(), SSL_FILETYPE_PEM);
00272 if (err != 1) {
00273 debug(DEBUG_SSL, "Error setting certificate file.");
00274 return false;
00275 }
00276
00277 return true;
00278 }
00279
00280
00286 bool
00287 SslCtx::setPrivateKeyFile(string privateKeyFile) {
00288 if (privateKeyFile.empty()) {
00289 return false;
00290 }
00291
00292 int err = SSL_CTX_use_RSAPrivateKey_file(m_sslCtx, privateKeyFile.c_str(), SSL_FILETYPE_PEM);
00293 if (err <= 0) {
00294 debug(DEBUG_SSL, "Unable to set RSA private key file");
00295 return false;
00296 }
00297
00298 err = SSL_CTX_check_private_key(m_sslCtx);
00299 if (!err) {
00300 debug(DEBUG_SSL, "Bad password for private key.");
00301 return false;
00302 }
00303 return true;
00304 }
00305
00306
00310 bool
00311 SslCtx::setPrivateKeyFile(string privateKeyFile, string privateKeyPassword) {
00312 setPrivateKeyPassword(privateKeyPassword);
00313 return setPrivateKeyFile(privateKeyFile);
00314 }
00315
00316
00331 bool
00332 SslCtx::setCertificateAuthorityFile(string caFile, string caPath) {
00333 if (caFile.empty()) {
00334 return false;
00335 }
00336
00337 int err = SSL_CTX_load_verify_locations(m_sslCtx, caFile.c_str(), caPath.c_str());
00338 if (err <= 0) {
00339 debug(DEBUG_SSL, "Unable to load certificate verify locations.");
00340 return false;
00341 }
00342
00343
00344
00345
00346
00347 return true;
00348 }
00349
00350