cb.c revision 296465
1#include "tunala.h" 2 3#ifndef NO_OPENSSL 4 5/* For callbacks generating output, here are their file-descriptors. */ 6static FILE *fp_cb_ssl_info = NULL; 7static FILE *fp_cb_ssl_verify = NULL; 8/*- 9 * Output level: 10 * 0 = nothing, 11 * 1 = minimal, just errors, 12 * 2 = minimal, all steps, 13 * 3 = detail, all steps */ 14static unsigned int cb_ssl_verify_level = 1; 15 16/* Other static rubbish (to mirror s_cb.c where required) */ 17static int int_verify_depth = 10; 18 19/* 20 * This function is largely borrowed from the one used in OpenSSL's 21 * "s_client" and "s_server" utilities. 22 */ 23void cb_ssl_info(const SSL *s, int where, int ret) 24{ 25 const char *str1, *str2; 26 int w; 27 28 if (!fp_cb_ssl_info) 29 return; 30 31 w = where & ~SSL_ST_MASK; 32 str1 = (w & SSL_ST_CONNECT ? "SSL_connect" : (w & SSL_ST_ACCEPT ? 33 "SSL_accept" : 34 "undefined")), str2 = 35 SSL_state_string_long(s); 36 37 if (where & SSL_CB_LOOP) 38 fprintf(fp_cb_ssl_info, "(%s) %s\n", str1, str2); 39 else if (where & SSL_CB_EXIT) { 40 if (ret == 0) 41 fprintf(fp_cb_ssl_info, "(%s) failed in %s\n", str1, str2); 42 /* 43 * In a non-blocking model, we get a few of these "error"s simply 44 * because we're calling "reads" and "writes" on the state-machine 45 * that are virtual NOPs simply to avoid wasting the time seeing if 46 * we *should* call them. Removing this case makes the "-out_state" 47 * output a lot easier on the eye. 48 */ 49# if 0 50 else if (ret < 0) 51 fprintf(fp_cb_ssl_info, "%s:error in %s\n", str1, str2); 52# endif 53 } 54} 55 56void cb_ssl_info_set_output(FILE *fp) 57{ 58 fp_cb_ssl_info = fp; 59} 60 61static const char *int_reason_no_issuer = 62 "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT"; 63static const char *int_reason_not_yet = "X509_V_ERR_CERT_NOT_YET_VALID"; 64static const char *int_reason_before = 65 "X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD"; 66static const char *int_reason_expired = "X509_V_ERR_CERT_HAS_EXPIRED"; 67static const char *int_reason_after = 68 "X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD"; 69 70/* Stolen wholesale from apps/s_cb.c :-) And since then, mutilated ... */ 71int cb_ssl_verify(int ok, X509_STORE_CTX *ctx) 72{ 73 char buf1[256]; /* Used for the subject name */ 74 char buf2[256]; /* Used for the issuer name */ 75 const char *reason = NULL; /* Error reason (if any) */ 76 X509 *err_cert; 77 int err, depth; 78 79 if (!fp_cb_ssl_verify || (cb_ssl_verify_level == 0)) 80 return ok; 81 err_cert = X509_STORE_CTX_get_current_cert(ctx); 82 err = X509_STORE_CTX_get_error(ctx); 83 depth = X509_STORE_CTX_get_error_depth(ctx); 84 85 buf1[0] = buf2[0] = '\0'; 86 /* Fill buf1 */ 87 X509_NAME_oneline(X509_get_subject_name(err_cert), buf1, 256); 88 /* Fill buf2 */ 89 X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf2, 256); 90 switch (ctx->error) { 91 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: 92 reason = int_reason_no_issuer; 93 break; 94 case X509_V_ERR_CERT_NOT_YET_VALID: 95 reason = int_reason_not_yet; 96 break; 97 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: 98 reason = int_reason_before; 99 break; 100 case X509_V_ERR_CERT_HAS_EXPIRED: 101 reason = int_reason_expired; 102 break; 103 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: 104 reason = int_reason_after; 105 break; 106 } 107 108 if ((cb_ssl_verify_level == 1) && ok) 109 return ok; 110 fprintf(fp_cb_ssl_verify, "chain-depth=%d, ", depth); 111 if (reason) 112 fprintf(fp_cb_ssl_verify, "error=%s\n", reason); 113 else 114 fprintf(fp_cb_ssl_verify, "error=%d\n", err); 115 if (cb_ssl_verify_level < 3) 116 return ok; 117 fprintf(fp_cb_ssl_verify, "--> subject = %s\n", buf1); 118 fprintf(fp_cb_ssl_verify, "--> issuer = %s\n", buf2); 119 if (!ok) 120 fprintf(fp_cb_ssl_verify, "--> verify error:num=%d:%s\n", err, 121 X509_verify_cert_error_string(err)); 122 fprintf(fp_cb_ssl_verify, "--> verify return:%d\n", ok); 123 return ok; 124} 125 126void cb_ssl_verify_set_output(FILE *fp) 127{ 128 fp_cb_ssl_verify = fp; 129} 130 131void cb_ssl_verify_set_depth(unsigned int verify_depth) 132{ 133 int_verify_depth = verify_depth; 134} 135 136void cb_ssl_verify_set_level(unsigned int level) 137{ 138 if (level < 4) 139 cb_ssl_verify_level = level; 140} 141 142RSA *cb_generate_tmp_rsa(SSL *s, int is_export, int keylength) 143{ 144 /* 145 * TODO: Perhaps make it so our global key can be generated on-the-fly 146 * after certain intervals? 147 */ 148 static RSA *rsa_tmp = NULL; 149 if (!rsa_tmp) 150 rsa_tmp = RSA_generate_key(keylength, RSA_F4, NULL, NULL); 151 return rsa_tmp; 152} 153 154#endif /* !defined(NO_OPENSSL) */ 155