1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
|
/* sslapp.c - ssl application code */
/*
* The modifications to support SSLeay were done by Tim Hudson
* tjh@cryptsoft.com
*
* You can do whatever you like with these patches except pretend that
* you wrote them.
*
* Email ssl-users-request@lists.cryptsoft.com to get instructions on how to
* join the mailing list that discusses SSLeay and also these patches.
*
*/
#ifdef USE_SSL
#include "sslapp.h"
SSL_CTX *ssl_ctx;
SSL *ssl_con;
int ssl_debug_flag=0;
int ssl_only_flag=0;
int ssl_active_flag=0;
int ssl_verify_flag=SSL_VERIFY_NONE;
int ssl_secure_flag=0;
int ssl_certsok_flag=0;
int ssl_cert_required=0;
int ssl_verbose_flag=0;
int ssl_disabled_flag=0;
char *ssl_cert_file=NULL;
char *ssl_key_file=NULL;
char *ssl_cipher_list=NULL;
char *ssl_log_file=NULL;
/* fwd decl */
static void
client_info_callback(const SSL *s, int where, int ret);
int
do_ssleay_init(int server)
{
char *p;
/* make sure we have somewhere we can log errors to */
if (bio_err==NULL) {
if ((bio_err=BIO_new(BIO_s_file()))!=NULL) {
if (ssl_log_file==NULL)
BIO_set_fp(bio_err,stderr,BIO_NOCLOSE);
else {
if (BIO_write_filename(bio_err,ssl_log_file)<=0) {
/* not a lot we can do */
}
}
}
}
/* rather simple things these days ... the old SSL_LOG and SSL_ERR
* vars are long gone now SSLeay8 has rolled around and we have
* a clean interface for doing things
*/
if (ssl_debug_flag)
BIO_printf(bio_err,"SSL_DEBUG_FLAG on\r\n");
/* init things so we will get meaningful error messages
* rather than numbers
*/
SSL_load_error_strings();
SSLeay_add_ssl_algorithms();
ssl_ctx=(SSL_CTX *)SSL_CTX_new(SSLv23_method());
/* we may require a temp 512 bit RSA key because of the
* wonderful way export things work ... if so we generate
* one now!
*/
if (server) {
if (SSL_CTX_need_tmp_RSA(ssl_ctx)) {
RSA *rsa;
if (ssl_debug_flag)
BIO_printf(bio_err,"Generating temp (512 bit) RSA key ...\r\n");
rsa=RSA_generate_key(512,RSA_F4,NULL,NULL);
if (ssl_debug_flag)
BIO_printf(bio_err,"Generation of temp (512 bit) RSA key done\r\n");
if (!SSL_CTX_set_tmp_rsa(ssl_ctx,rsa)) {
BIO_printf(bio_err,"Failed to assign generated temp RSA key!\r\n");
}
RSA_free(rsa);
if (ssl_debug_flag)
BIO_printf(bio_err,"Assigned temp (512 bit) RSA key\r\n");
}
}
/* also switch on all the interoperability and bug
* workarounds so that we will communicate with people
* that cannot read poorly written specs :-)
*/
SSL_CTX_set_options(ssl_ctx,SSL_OP_ALL);
/* the user can set whatever ciphers they want to use */
if (ssl_cipher_list==NULL) {
p=getenv("SSL_CIPHER");
if (p!=NULL)
SSL_CTX_set_cipher_list(ssl_ctx,p);
} else
SSL_CTX_set_cipher_list(ssl_ctx,ssl_cipher_list);
/* for verbose we use the 0.6.x info callback that I got
* eric to finally add into the code :-) --tjh
*/
if (ssl_verbose_flag) {
SSL_CTX_set_info_callback(ssl_ctx,client_info_callback);
}
/* Add in any certificates if you want to here ... */
if (ssl_cert_file) {
if (!SSL_CTX_use_certificate_file(ssl_ctx, ssl_cert_file,
X509_FILETYPE_PEM)) {
BIO_printf(bio_err,"Error loading %s: ",ssl_cert_file);
ERR_print_errors(bio_err);
BIO_printf(bio_err,"\r\n");
return(0);
} else {
if (!ssl_key_file)
ssl_key_file = ssl_cert_file;
if (!SSL_CTX_use_RSAPrivateKey_file(ssl_ctx, ssl_key_file,
X509_FILETYPE_PEM)) {
BIO_printf(bio_err,"Error loading %s: ",ssl_key_file);
ERR_print_errors(bio_err);
BIO_printf(bio_err,"\r\n");
return(0);
}
}
}
/* make sure we will find certificates in the standard
* location ... otherwise we don't look anywhere for
* these things which is going to make client certificate
* exchange rather useless :-)
*/
SSL_CTX_set_default_verify_paths(ssl_ctx);
/* now create a connection */
ssl_con=(SSL *)SSL_new(ssl_ctx);
SSL_set_verify(ssl_con,ssl_verify_flag,NULL);
#if 0
SSL_set_verify(ssl_con,ssl_verify_flag,client_verify_callback);
#endif
return(1);
}
static void
client_info_callback(const SSL *s, int where, int ret)
{
if (where==SSL_CB_CONNECT_LOOP) {
BIO_printf(bio_err,"SSL_connect:%s %s\r\n",
SSL_state_string(s),SSL_state_string_long(s));
} else if (where==SSL_CB_CONNECT_EXIT) {
if (ret == 0) {
BIO_printf(bio_err,"SSL_connect:failed in %s %s\r\n",
SSL_state_string(s),SSL_state_string_long(s));
} else if (ret < 0) {
BIO_printf(bio_err,"SSL_connect:error in %s %s\r\n",
SSL_state_string(s),SSL_state_string_long(s));
}
}
}
#else /* !USE_SSL */
/* something here to stop warnings if we build without SSL support */
static int dummy_func()
{
int i;
i++;
}
#endif /* USE_SSL */
|
