Git-Mirrors/RetroShare
1
0
Fork 0
mirror of https://github.com/RetroShare/RetroShare.git synced 2024-10-01 02:35:48 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity
e77064eaf1
RetroShare/libretroshare/src/pqi/sslcert.cc

2032 lines
44 KiB
C++
Raw Normal View History

Created V0.3.x branch and moved the head into the trunk directory. git-svn-id: http://svn.code.sf.net/p/retroshare/code/trunk@246 b45a01b8-16f6-495d-af2f-9b41ad6348cc
2007-11-14 22:18:48 -05:00
/*
* Core PQI networking: sslcert.cc
*
* 3P/PQI network interface for RetroShare.
*
* Copyright 2004-2006 by Robert Fernie.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Library General Public
* License Version 2 as published by the Free Software Foundation.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Library General Public License for more details.
*
* You should have received a copy of the GNU Library General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
* USA.
*
* Please report all bugs and problems to "retroshare@lunamutt.com".
*
*/
#include "sslcert.h"
#include "pqi.h"
#include "pqinetwork.h"
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/pem.h>
#include <sstream>
#include <iomanip>
#include "pqidebug.h"
const int pqisslrootzone = 1211;
// other fns
std::string getCertName(cert *c)
{
std::string name = c -> certificate -> name;
// strip out bad chars.
for(int i = 0; i < (signed) name.length(); i++)
{
if ((name[i] == '/') || (name[i] == ' ') || (name[i] == '=') ||
(name[i] == '\\') || (name[i] == '\t') || (name[i] == '\n'))
{
name[i] = '_';
}
}
return name;
}
int pem_passwd_cb(char *buf, int size, int rwflag, void *password)
{
strncpy(buf, (char *)(password), size);
buf[size - 1] = '\0';
return(strlen(buf));
}
/* This class handles openssl library init/destruct.
* only one of these... handles
* the CTX and setup?
*
* it will also handle the certificates.....
* mantaining a library of recieved certs,
* and ip addresses that the connections come from...
*
*/
// the single instance of this.
static sslroot instance_sslroot;
sslroot *getSSLRoot()
{
return &instance_sslroot;
}
sslroot::sslroot()
:sslctx(NULL), init(0), certsChanged(1),
certsMajorChanged(1), pkey(NULL)
{
}
int sslroot::active()
{
return init;
}
// args: server cert, server private key, trusted certificates.
int sslroot::initssl(const char *cert_file, const char *priv_key_file,
const char *CA_FILE, const char *passwd)
{
static int initLib = 0;
if (!initLib)
{
initLib = 1;
SSL_load_error_strings();
SSL_library_init();
}
if (init == 1)
{
return 1;
}
if ((cert_file == NULL) ||
(priv_key_file == NULL) ||
(passwd == NULL))
{
fprintf(stderr, "sslroot::initssl() missing parameters!\n");
return 0;
}
SSL_load_error_strings();
SSL_library_init();
// XXX TODO
// actions_to_seed_PRNG();
pqioutput(PQL_WARNING, pqisslrootzone, "SSL Library Init!");
// setup connection method
sslctx = SSL_CTX_new(SSLv23_method());
// setup cipher lists.
SSL_CTX_set_cipher_list(sslctx, "DEFAULT");
// certificates (Set Local Server Certificate).
FILE *ownfp = fopen(cert_file, "r");
if (ownfp == NULL)
{
pqioutput(PQL_ALERT, pqisslrootzone,
"Couldn't open Own Certificate!");
return -1;
}
X509 *x509 = PEM_read_X509(ownfp, NULL, NULL, NULL);
fclose(ownfp);
if (x509 != NULL)
{
SSL_CTX_use_certificate(sslctx, x509);
own_cert = makeCertificate(x509);
if (own_cert == NULL)
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"Failed to Make Own Cert!");
return -1;
}
addCertificate(own_cert);
}
else
{
return -1;
}
// SSL_CTX_use_certificate_chain_file(sslctx, cert_file_chain);
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, "SSL Set Chain File");
SSL_CTX_load_verify_locations(sslctx, CA_FILE, 0);
// enable verification of certificates (PEER)
SSL_CTX_set_verify(sslctx, SSL_VERIFY_PEER |
SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, "SSL Verification Set");
// setup private key
FILE *pkfp = fopen(priv_key_file, "rb");
if (pkfp == NULL)
{
pqioutput(PQL_ALERT, pqisslrootzone, "Couldn't Open PrivKey File!");
closessl();
return -1;
}
pkey = PEM_read_PrivateKey(pkfp, NULL, NULL, (void *) passwd);
SSL_CTX_use_PrivateKey(sslctx, pkey);
if (1 != SSL_CTX_check_private_key(sslctx))
{
std::ostringstream out;
out << "Issues With Private Key! - Doesn't match your Cert" << std::endl;
out << "Check your input key/certificate:" << std::endl;
out << priv_key_file << " & " << cert_file;
out << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
closessl();
return -1;
}
// Load CA for clients.
STACK_OF(X509_NAME) *cert_names;
cert_names = SSL_load_client_CA_file(CA_FILE);
if (cert_names != NULL)
{
SSL_CTX_set_client_CA_list(sslctx, cert_names);
}
else
{
std::ostringstream out;
out << "Couldn't Load Client CA files!" << std::endl;
out << "Check That (" << CA_FILE << ") is valid";
out << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
closessl();
return -1;
}
/* configure basics on the certificate. */
std::string tagname; // = "LOCL:";
own_cert -> Name(tagname + getX509CNString(own_cert -> certificate -> cert_info -> subject));
init = 1;
return 1;
}
int sslroot::closessl()
{
SSL_CTX_free(sslctx);
// clean up private key....
// remove certificates etc -> opposite of initssl.
init = 0;
return 1;
}
/* Context handling */
SSL_CTX *sslroot::getCTX()
{
return sslctx;
}
int sslroot::setConfigDirs(const char *cdir, const char *ndir)
{
certdir = cdir;
neighbourdir = ndir;
return 1;
}
static const unsigned int OPT_LEN = 16;
static const unsigned int VAL_LEN = 1000;
int sslroot::saveCertificates()
{
if (certfile.length() > 1)
return saveCertificates(certfile.c_str());
return -1;
}
int sslroot::saveCertificates(const char *fname)
{
// construct file name.
//
// create the file in memory - hash + sign.
// write out data to a file.
std::string neighdir = certdir + "/" + neighbourdir + "/";
std::string configname = certdir + "/";
configname += fname;
std::map<std::string, std::string>::iterator mit;
std::string conftxt;
std::string empty("");
unsigned int i;
std::list<cert *>::iterator it;
for(it = peercerts.begin(); it != peercerts.end(); it++)
{
std::string neighfile = neighdir + getCertName(*it) + ".pqi";
savecertificate((*it), neighfile.c_str());
conftxt += "CERT ";
conftxt += getCertName(*it);
conftxt += "\n";
conftxt += (*it) -> Hash();
conftxt += "\n";
}
// Now add the options.
for(mit = settings.begin(); mit != settings.end(); mit++)
{
// only save the nonempty settings.
if (mit -> second != empty) {
conftxt += "OPT ";
for(i = 0; (i < OPT_LEN) && (i < mit -> first.length()); i++)
{
conftxt += mit -> first[i];
}
conftxt += "\n";
for(i = 0; i < VAL_LEN; i++)
{
if (i < mit -> second.length())
{
conftxt += mit -> second[i];
}
else
{
conftxt += '\0';
}
}
conftxt += "\n";
}
}
// now work out signature of it all. This relies on the
// EVP library of openSSL..... We are going to use signing
// for the moment.
unsigned int signlen = EVP_PKEY_size(pkey);
unsigned char signature[signlen];
//OpenSSL_add_all_digests();
EVP_MD_CTX *mdctx = EVP_MD_CTX_create();
if (0 == EVP_SignInit_ex(mdctx, EVP_sha1(), NULL))
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"EVP_SignInit Failure!");
}
if (0 == EVP_SignUpdate(mdctx, conftxt.c_str(), conftxt.length()))
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"EVP_SignUpdate Failure!");
}
if (0 == EVP_SignFinal(mdctx, signature, &signlen, pkey))
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"EVP_SignFinal Failure!");
}
{
std::ostringstream out;
out << "Conf Signature is(" << signlen << "): ";
for(i = 0; i < signlen; i++)
{
out << std::hex << std::setw(2) << (int) signature[i];
conftxt += signature[i];
}
out << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
FILE *cfd = fopen(configname.c_str(), "wb");
int wrec;
if (1 != (wrec = fwrite(conftxt.c_str(), conftxt.length(), 1, cfd)))
{
std::ostringstream out;
out << "Error writing: " << configname << std::endl;
out << "Wrote: " << wrec << "/" << 1 << " Records" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
EVP_MD_CTX_destroy(mdctx);
fclose(cfd);
return 1;
}
int sslroot::loadCertificates(const char *conf_fname)
{
// open the configuration file.
//
// read in CERT + Hash.
// construct file name.
//
// create the file in memory - hash + sign.
// write out data to a file.
std::string neighdir = certdir + "/" + neighbourdir + "/";
std::string configname = certdir + "/";
configname += conf_fname;
// save name for later save attempts.
certfile = conf_fname;
std::string conftxt;
unsigned int maxnamesize = 1024;
char name[maxnamesize];
int c;
unsigned int i;
FILE *cfd = fopen(configname.c_str(), "rb");
if (cfd == NULL)
{
std::ostringstream out;
out << "Unable to Load Configuration File!" << std::endl;
out << "File: " << configname << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
return -1;
}
std::list<std::string> fnames;
std::list<std::string> hashes;
std::map<std::string, std::string>::iterator mit;
std::map<std::string, std::string> tmpsettings;
unsigned int signlen = EVP_PKEY_size(pkey);
unsigned char conf_signature[signlen];
char *ret = NULL;
for(ret = fgets(name, maxnamesize, cfd);
((ret != NULL) && (!strncmp(name, "CERT ", 5)));
ret = fgets(name, maxnamesize, cfd))
{
for(i = 5; (name[i] != '\n') && (i < (unsigned) maxnamesize); i++);
if (name[i] == '\n')
{
name[i] = '\0';
}
// so the name is first....
std::string fname = &(name[5]);
// now read the
std::string hash;
std::string signature;
for(i = 0; i < signlen; i++)
{
if (EOF == (c = fgetc(cfd)))
{
std::ostringstream out;
out << "Error Reading Signature of: ";
out << fname;
out << std::endl;
out << "ABorting Load!";
out << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
return -1;
}
unsigned char uc = (unsigned char) c;
signature += (unsigned char) uc;
}
if ('\n' != (c = fgetc(cfd)))
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"Warning Mising seperator");
}
{
std::ostringstream out;
out << "Read fname:" << fname << std::endl;
out << "Signature:" << std::endl;
for(i = 0; i < signlen; i++)
{
out << std::hex << std::setw(2) << (int) signature[i];
}
out << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
// push back.....
fnames.push_back(fname);
hashes.push_back(signature);
conftxt += "CERT ";
conftxt += fname;
conftxt += "\n";
conftxt += signature;
conftxt += "\n";
// be sure to write over a bit...
name[0] = 'N';
name[1] = 'O';
}
// string already waiting!
for(; ((ret != NULL) && (!strncmp(name, "OPT ", 4)));
ret = fgets(name, maxnamesize, cfd))
{
for(i = 4; (name[i] != '\n') && (i < OPT_LEN); i++);
// terminate the string.
name[i] = '\0';
// so the name is first....
std::string opt = &(name[4]);
// now read the
std::string val; // cleaned up value.
std::string valsign; // value in the file.
for(i = 0; i < VAL_LEN; i++)
{
if (EOF == (c = fgetc(cfd)))
{
std::ostringstream out;
out << "Error Reading Value of: ";
out << opt;
out << std::endl;
out << "ABorting Load!";
out << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
return -1;
}
// remove zeros on strings...
if (c != '\0')
{
val += (unsigned char) c;
}
valsign += (unsigned char) c;
}
if ('\n' != (c = fgetc(cfd)))
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"Warning Mising seperator");
}
{
std::ostringstream out;
out << "Read OPT:" << opt;
out << " Val:" << val << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
// push back.....
tmpsettings[opt] = val;
conftxt += "OPT ";
conftxt += opt;
conftxt += "\n";
conftxt += valsign;
conftxt += "\n";
// be sure to write over a bit...
name[0] = 'N';
name[1] = 'O';
}
// only read up to the first newline symbol....
// continue...
for(i = 0; (name[i] != '\n') && (i < signlen); i++);
//printf("Stepping over [%d] %0x\n", i, name[i]);
if (i != signlen)
{
for(i++; i < signlen; i++)
{
c = fgetc(cfd);
if (c == EOF)
{
pqioutput(PQL_ALERT, pqisslrootzone,
"Error Reading Conf Signature:");
return 1;
}
unsigned char uc = (unsigned char) c;
name[i] = uc;
}
}
{
std::ostringstream out;
out << "Configuration File Signature: " << std::endl;
for(i = 0; i < signlen; i++)
{
out << std::hex << std::setw(2) << (int) name[i];
}
out << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
// when we get here - should have the final signature in the buffer.
// check.
//
// compare signatures.
// instead of verifying with the public key....
// we'll sign it again - and compare .... FIX LATER...
EVP_MD_CTX *mdctx = EVP_MD_CTX_create();
if (0 == EVP_SignInit(mdctx, EVP_sha1()))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignInit Failure!");
}
if (0 == EVP_SignUpdate(mdctx, conftxt.c_str(), conftxt.length()))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignUpdate Failure!");
}
if (0 == EVP_SignFinal(mdctx, conf_signature, &signlen, pkey))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignFinal Failure!");
}
EVP_MD_CTX_destroy(mdctx);
fclose(cfd);
{
std::ostringstream out;
out << "Recalced File Signature: " << std::endl;
for(i = 0; i < signlen; i++)
{
out << std::hex << std::setw(2) << (int) conf_signature[i];
}
out << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
bool same = true;
for(i = 0; i < signlen; i++)
{
if ((unsigned char) name[i] != conf_signature[i])
{
same = false;
}
}
if (same == false)
{
pqioutput(PQL_ALERT, pqisslrootzone,
"ERROR VALIDATING CONFIGURATION! -- PLEASE FIX!");
return -1;
}
std::list<std::string>::iterator it;
std::list<std::string>::iterator it2;
for(it = fnames.begin(), it2 = hashes.begin(); it != fnames.end(); it++, it2++)
{
std::string neighfile = neighdir + (*it) + ".pqi";
cert *nc = loadcertificate(neighfile.c_str(), (*it2));
if (nc != NULL)
{
if (0 > addCertificate(nc))
{
// cleanup.
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"Updated Certificate....but no need for addition");
// X509_free(nc -> certificate);
//delete nc;
}
}
}
for(mit = tmpsettings.begin(); mit != tmpsettings.end(); mit++)
{
settings[mit -> first] = mit -> second;
}
return 1;
}
int sslroot::savecertificate(cert *c, const char *fname)
{
// load certificates from file.
FILE *setfp = fopen(fname, "wb");
if (setfp == NULL)
{
std::ostringstream out;
out << "sslroot::savecertificate() Bad File: " << fname;
out << " Cannot be Written!" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
return -1;
}
{
std::ostringstream out;
out << "Writing out Cert...:" << c -> Name() << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
PEM_write_X509(setfp, c -> certificate);
// writing out details....
// read in a line.....
int size = 1024;
char line[size];
std::list<cert *>::iterator it;
int i;
// This will need to be made portable.....
struct sockaddr_in *addr_inet;
struct sockaddr_in *addr_inet2;
struct sockaddr_in *addr_inet3;
int pos_status = 0;
int pos_addr = sizeof(int);
int pos_addr2 = pos_addr + sizeof(*addr_inet);
int pos_addr3 = pos_addr2 + sizeof(*addr_inet2);
int pos_lcts = pos_addr3 + sizeof(*addr_inet3);
int pos_lrts = pos_lcts + sizeof(int);
int pos_ncts = pos_lrts + sizeof(int);
int pos_ncvl = pos_ncts + sizeof(int);
int pos_name = pos_ncvl + sizeof(int);
int pos_end = pos_name + 20; // \n. for readability.
int *status = (int *) &(line[pos_status]);
addr_inet = (struct sockaddr_in *) &(line[pos_addr]);
addr_inet2 = (struct sockaddr_in *) &(line[pos_addr2]);
addr_inet3 = (struct sockaddr_in *) &(line[pos_addr3]);
int *lcts = (int *) &(line[pos_lcts]);
int *lrts = (int *) &(line[pos_lrts]);
char *ncts = &(line[pos_ncts]);
char *ncvl = &(line[pos_ncvl]);
char *name = &(line[pos_name]);
char *end = &(line[pos_end]);
for(i = 0; i < 1024; i++)
line[i] = 0;
*status = c -> Status();
*addr_inet = c -> lastaddr;
*addr_inet2 = c -> localaddr;
*addr_inet3 = c -> serveraddr;
*lcts = c -> lc_timestamp;
*lrts = c -> lr_timestamp;
*ncts = c -> nc_timestamp;
*ncvl = c -> nc_timeintvl;
std::string tmpname = c -> Name();
for(i = 0; (i < (signed) tmpname.length()) && (i < 20 - 1); i++)
{
name[i] = tmpname[i];
}
name[20 - 1] = '\0';
end[0] = '\n';
if (1 != fwrite(line, size,1, setfp))
{
pqioutput(PQL_ALERT, pqisslrootzone,
"Error Writing Peer Record!");
return -1;
}
fclose(setfp);
// then reopen to generate hash.
setfp = fopen(fname, "rb");
if (setfp == NULL)
{
std::ostringstream out;
out << "sslroot::savecertificate() Bad File: " << fname;
out << " Opened for ReHash!" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
return -1;
}
unsigned int signlen = EVP_PKEY_size(pkey);
unsigned char signature[signlen];
int maxsize = 10240;
int rbytes;
char inall[maxsize];
if (0 == (rbytes = fread(inall, 1, maxsize, setfp)))
{
pqioutput(PQL_ALERT, pqisslrootzone,
"Error Writing Peer Record!");
return -1;
}
{
std::ostringstream out;
out << "Read " << rbytes << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
// so we read rbytes.
// hash.
//OpenSSL_add_all_digests();
EVP_MD_CTX *mdctx = EVP_MD_CTX_create();
if (0 == EVP_SignInit_ex(mdctx, EVP_sha1(), NULL))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignInit Failure!");
}
if (0 == EVP_SignUpdate(mdctx, inall, rbytes))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignUpdate Failure!");
}
if (0 == EVP_SignFinal(mdctx, signature, &signlen, pkey))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignFinal Failure!");
}
std::string signstr;
{
std::ostringstream out;
out << "Cert + Setting Signature is(" << signlen << "): ";
for(i = 0; i < (signed) signlen; i++)
{
out << std::hex << std::setw(2) << (int) signature[i];
signstr += signature[i];
}
out << std::dec << std::endl;
c -> Hash(signstr);
out << "Stored Hash Length: " << (c -> Hash()).length() << std::endl;
out << "Real Hash Length: " << signlen << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
fclose(setfp);
EVP_MD_CTX_destroy(mdctx);
return 1;
}
cert *sslroot::loadcertificate(const char *fname, std::string hash)
{
// if there is a hash - check that the file matches it before loading.
FILE *pcertfp;
if (hash.length() > 1)
{
pcertfp = fopen(fname, "rb");
// load certificates from file.
if (pcertfp == NULL)
{
std::ostringstream out;
out << "sslroot::loadcertificate() Bad File: " << fname;
out << " Cannot be Hashed!" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
return NULL;
}
unsigned int signlen = EVP_PKEY_size(pkey);
unsigned char signature[signlen];
int maxsize = 10240;
int rbytes;
char inall[maxsize];
if (0 == (rbytes = fread(inall, 1, maxsize, pcertfp)))
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"Error Reading Peer Record!");
return NULL;
}
EVP_MD_CTX *mdctx = EVP_MD_CTX_create();
if (0 == EVP_SignInit_ex(mdctx, EVP_sha1(), NULL))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignInit Failure!");
}
if (0 == EVP_SignUpdate(mdctx, inall, rbytes))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignUpdate Failure!");
}
if (0 == EVP_SignFinal(mdctx, signature, &signlen, pkey))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignFinal Failure!");
}
fclose(pcertfp);
EVP_MD_CTX_destroy(mdctx);
bool same = true;
if (signlen != hash.length())
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"Different Length Signatures... Cannot Load Cert!");
return NULL;
}
for(int i = 0; i < (signed) signlen; i++)
{
if (signature[i] != (unsigned char) hash[i])
{
same = false;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"Invalid Signature... Cannot Load Certificate!");
return NULL;
}
}
{
std::ostringstream out;
out << "Verified Signature for: " << fname;
out << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
}
else
{
pqioutput(PQL_ALERT, pqisslrootzone, "Not checking cert signature");
}
pcertfp = fopen(fname, "rb");
// load certificates from file.
if (pcertfp == NULL)
{
std::ostringstream out;
out << "sslroot::loadcertificate() Bad File: " << fname;
out << " Cannot be Read!" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
return NULL;
}
X509 *pc;
cert *npc = NULL;
if ((pc = PEM_read_X509(pcertfp, NULL, NULL, NULL)) != NULL)
{
// read a certificate.
std::ostringstream out;
out << "Loaded Certificate: ";
out << pc -> name << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
npc = makeCertificate(pc);
if (npc == NULL)
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, "Failed to Create Cert!");
return NULL;
}
}
else // (pc == NULL)
{
unsigned long err = ERR_get_error();
std::ostringstream out;
out << "Read Failed .... CODE(" << err << ")" << std::endl;
out << ERR_error_string(err, NULL) << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
return NULL;
}
// Now we try to read in 1024 bytes.....
// if successful, then have settings!
// read in a line.....
int size = 1024;
char line[size];
// Data arrangment.
// so far
// ------------
// 4 - (int) status
// 8 - sockaddr
// 8 - sockaddr
// 8 - sockaddr
// 4 - lc_timestamp
// 4 - lr_timestamp
// 4 - nc_timestamp
// 4 - nc_timeintvl
// 20 - name.
// 1 - end
// This will need to be made portable.....
struct sockaddr_in *addr_inet;
struct sockaddr_in *addr_inet2;
struct sockaddr_in *addr_inet3;
//int pos_status = 0;
int pos_addr = sizeof(int);
int pos_addr2 = pos_addr + sizeof(*addr_inet);
int pos_addr3 = pos_addr2 + sizeof(*addr_inet2);
int pos_lcts = pos_addr3 + sizeof(*addr_inet3);
int pos_lrts = pos_lcts + sizeof(int);
int pos_ncts = pos_lrts + sizeof(int);
int pos_ncvl = pos_ncts + sizeof(int);
int pos_name = pos_ncvl + sizeof(int);
//int pos_end = pos_name + 20; // \n. for readability.
int *status = (int *) line;
addr_inet = (struct sockaddr_in *) &(line[pos_addr]);
addr_inet2 = (struct sockaddr_in *) &(line[pos_addr2]);
addr_inet3 = (struct sockaddr_in *) &(line[pos_addr3]);
int *lcts = (int *) &(line[pos_lcts]);
int *lrts = (int *) &(line[pos_lrts]);
char *ncts = &(line[pos_ncts]);
char *ncvl = &(line[pos_ncvl]);
char *name = &(line[pos_name]);
//char *end = &(line[pos_end]);
// end of data structures....
if (1 != (signed) fread(line, size,1, pcertfp))
{
pqioutput(PQL_WARNING, pqisslrootzone,
"Error Reading Setting: Only Cert Retrieved");
return npc;
}
// fill in the data.
cert *c = npc;
c -> Status(*status);
// but ensure that inUse is not set.
c -> InUse(false);
c -> lastaddr = *addr_inet;
c -> localaddr = *addr_inet2;
c -> serveraddr = *addr_inet3;
c -> lc_timestamp = *lcts;
c -> lr_timestamp = *lrts;
c -> nc_timestamp = *ncts;
c -> nc_timeintvl = *ncvl;
name[20 - 1] = '\0';
c -> Name(std::string(name));
// save the hash.
c -> Hash(hash);
fclose(pcertfp);
// small hack - as the timestamps seem wrong.....
// could be a saving thing - or a bug....
c -> lc_timestamp = 0;
c -> lr_timestamp = 0;
// reset these. as well.
c -> nc_timestamp = 0;
c -> nc_timeintvl = 5;
return c;
}
int sslroot::printCertificate(cert *c, std::ostream &out)
{
out << "Cert Name:" << (c -> certificate) -> name << std::endl;
//X509_print_fp(stderr, c -> certificate);
return 1;
}
// This function will clean up X509 *c if necessary.
cert *sslroot::makeCertificate(X509 *c)
{
if (c == NULL)
{
return NULL;
}
// At this point we check to see if there is a duplicate.
cert *dup = checkDuplicateX509(c);
cert *npc = NULL;
if (dup == NULL)
{
npc = new cert();
npc -> certificate = c;
if (!addtosignmap(npc)) // only allow the cert if no dup
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"sslroot::makeCertificate() Failed to Get Signature - Not Allowed!");
// failed!... cannot add it!.
delete npc;
return NULL;
}
allcerts.push_back(npc);
{
std::ostringstream out;
out << "sslroot::makeCertificate() For " << c -> name;
out << " A-Okay!" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
// at this point we need to add to the signaturelist....
}
else if (c == dup -> certificate)
{
// identical - so okay.
npc = dup;
std::ostringstream out;
out << "sslroot::makeCertificate() For " << c -> name;
out << " Found Identical - A-Okay!" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
else
{
std::ostringstream out;
out << "sslroot::makeCertificate() For " << c -> name;
out << " Cleaning up other X509!" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
// clean up c.
X509_free(c);
npc = dup;
}
return npc;
}
cert *sslroot::checkDuplicateX509(X509 *x)
{
if (x == NULL)
return NULL;
// loop through and print - then check.
std::list<cert *>::iterator it;
for(it = allcerts.begin(); it != allcerts.end(); it++)
{
if (0 == X509_cmp((*it) -> certificate, x))
{
return (*it);
}
}
return NULL;
}
cert *sslroot::checkPeerX509(X509 *x)
{
if (x == NULL)
return NULL;
// loop through and print - then check.
std::list<cert *>::iterator it;
for(it = peercerts.begin(); it != peercerts.end(); it++)
{
if (0 == X509_cmp((*it) -> certificate, x))
{
return (*it);
}
}
return NULL;
}
cert *sslroot::findpeercert(const char *name)
{
// loop through and print - then check.
//std::cerr << "Checking Certs for: " << name << std::endl;
std::list<cert *>::iterator it;
for(it = peercerts.begin(); it != peercerts.end(); it++)
{
char *certname = ((*it) -> certificate) -> name;
//std::cerr << "Cert Name:" << certname << std::endl;
if (strstr(certname, name) != NULL)
{
//std::cerr << "Matches!" << std::endl;
return (*it);
}
}
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"sslroot::findpeercert() Failed!");
return NULL;
}
// returns zero for the same.
int sslroot::compareCerts(cert *a, cert *b)
{
// std::cerr << "Comparing Certificates:" << std::endl;
//printCertificate(a);
//printCertificate(b);
//X509_print_fp(stderr, a -> certificate);
//X509_print_fp(stderr, b -> certificate);
int val = X509_cmp(a -> certificate, b -> certificate);
{
std::ostringstream out;
out << "Certificate Comparison Returned: " << val << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
return val;
}
cert * sslroot::registerCertificate(X509 *nc, struct sockaddr_in raddr, bool in)
{
if (nc == NULL)
return NULL;
// shoud check all certs.
cert *c = checkDuplicateX509(nc);
if (c != NULL)
{
if (c -> certificate == nc)
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"sslroot::registerCertificate() Found Identical X509 cert");
}
else
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"sslroot::registerCertificate() Found Same X509 cert/diff mem - Clean");
X509_free(nc);
}
if (!c -> Connected())
{
c -> lastaddr = raddr;
if (in == true)
{
c -> lr_timestamp = time(NULL);
// likely to be server address
// (with default port)
// if null!
if (!isValidNet(&(c -> serveraddr.sin_addr)))
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"Guessing Default Server Addr!");
c -> serveraddr = raddr;
c -> serveraddr.sin_port =
htons(PQI_DEFAULT_PORT);
}
}
else
{
c -> lc_timestamp = time(NULL);
// also likely to be servera address,
// but we can check and see if its local.
// can flag local
if (0 == inaddr_cmp(c -> localaddr, raddr))
{
c -> Local(true);
// don't set serveraddr -> just ignore
}
else
{
c -> serveraddr = raddr;
c -> Firewalled(false);
}
}
}
else
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"WARNING: attempt to reg CONNECTED Cert!");
}
return c;
}
{
std::ostringstream out;
out << "sslroot::registerCertificate() Certificate Not Found!" << std::endl;
out << "Saving :" << nc -> name << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
cert *npc = makeCertificate(nc);
if (npc == NULL)
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"Failed to Make Certificate");
return NULL;
}
npc -> Name(nc -> name);
npc -> lastaddr = raddr;
if (in == true)
{
npc -> lr_timestamp = time(NULL);
// likely to be server address (with default port)
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, "Guessing Default Server Addr!");
npc -> serveraddr = raddr;
npc -> serveraddr.sin_port = htons(PQI_DEFAULT_PORT);
}
else
{
npc -> lc_timestamp = time(NULL);
// as it is a new cert... all fields are
// null and the earlier tests must be
// delayed until the discovery packets.
// also likely to be server.
npc -> serveraddr = raddr;
}
// push back onto collected.
npc -> nc_timestamp = 0;
collectedcerts.push_back(npc);
// return NULL to indicate that it dosen't yet exist in dbase.
return NULL;
}
cert * sslroot::getCollectedCert()
{
if (collectedcerts.size() < 1)
return NULL;
cert *c = collectedcerts.front();
collectedcerts.pop_front();
return c;
}
bool sslroot::collectedCerts()
{
return (collectedcerts.size() > 0);
}
int sslroot::removeCertificate(cert *c)
{
if (c -> InUse())
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"sslroot::removeCertificate() Failed: cert is in use.");
return -1;
}
std::list<cert *>::iterator it;
for(it = peercerts.begin(); it != peercerts.end(); it++)
{
if (c == (*it))
{
peercerts.erase(it);
c -> InUse(false);
c -> Accepted(false);
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"sslroot::removeCertificate() Success! Moved to Coll Certs");
collectedcerts.push_back(c);
certsChanged.IndicateChanged();
certsMajorChanged.IndicateChanged();
return 1;
}
}
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"sslroot::removeCertificate() Failed to Match Cert!");
return 0;
}
int sslroot::addCertificate(cert *c)
{
c -> InUse(false);
// let most flags through.
//c -> Accepted(false);
//c -> WillConnect(false);
if (c -> certificate == NULL)
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"sslroot::addCertificate() certificate==NULL, Not Adding");
return 0;
}
cert *dup = checkPeerX509(c -> certificate);
if (dup != NULL)
{
std::ostringstream out;
out << "sslroot::addCertificate() Not Adding";
out << "Certificate with duplicate...." << std::endl;
out << "\t\tTry RegisterCertificate() " << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
return -1;
}
// else put in in the list.
peercerts.push_back(c);
certsChanged.IndicateChanged();
certsMajorChanged.IndicateChanged();
return 1;
}
int sslroot::addUntrustedCertificate(cert *c)
{
// blank it all.
c -> Status(PERSON_STATUS_MANUAL);
// set Tag to be their X509CN.
c -> Name(getX509CNString(c -> certificate -> cert_info -> subject));
return addCertificate(c);
}
int sslroot::validateCertificate(cert *c)
{
std::ostringstream out;
out << "sslroot::validateCertificate() Why Not!" << std::endl;
c -> Valid(true);
out << "Cert Status: " << c -> Status() << std::endl;
pqioutput(PQL_ALERT, pqisslrootzone, out.str());
return 1;
}
/***** REMOVED!
*
*
std::list<std::string> sslroot::listCertificates()
{
std::list<std::string> names;
std::list<cert *>::iterator it;
for(it = peercerts.begin(); it != peercerts.end(); it++)
{
names.push_back(((*it) -> certificate) -> name);
}
return names;
}
*
*
*****/
bool sslroot::CertsChanged()
{
return certsChanged.Changed(0);
}
bool sslroot::CertsMajorChanged()
{
return certsMajorChanged.Changed(0);
}
void sslroot::IndicateCertsChanged()
{
certsChanged.IndicateChanged();
}
std::list<cert *> &sslroot::getCertList()
{
return peercerts;
}
std::string sslroot::getSetting(std::string opt)
{
std::map<std::string, std::string>::iterator it;
if (settings.end() != (it = settings.find(opt)))
{
// found setting.
std::ostringstream out;
out << "sslroot::getSetting(" << opt << ") = ";
out << it -> second << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
return it -> second;
}
// else return empty string.
{
std::ostringstream out;
out << "sslroot::getSetting(" << opt;
out << ") Not There!" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
std::string empty("");
return empty;
}
void sslroot::setSetting(std::string opt, std::string val)
{
// check settings..
std::ostringstream out;
out << "sslroot::saveSetting(" << opt << ", ";
out << val << ")" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
settings[opt] = val;
return;
}
cert *sslroot::getOwnCert()
{
return own_cert;
}
int sslroot::checkNetAddress()
{
std::list<std::string> addrs = getLocalInterfaces();
std::list<std::string>::iterator it;
bool found = false;
for(it = addrs.begin(); (!found) && (it != addrs.end()); it++)
{
if ((*it) == inet_ntoa(own_cert -> localaddr.sin_addr))
{
found = true;
}
}
/* check that we didn't catch 0.0.0.0 - if so go for prefered */
if ((found) && (own_cert -> localaddr.sin_addr.s_addr == 0))
{
found = false;
}
if (!found)
{
own_cert -> localaddr.sin_addr = getPreferredInterface();
}
if ((isPrivateNet(&(own_cert -> localaddr.sin_addr))) ||
(isLoopbackNet(&(own_cert -> localaddr.sin_addr))))
{
own_cert -> Firewalled(true);
}
else
{
//own_cert -> Firewalled(false);
}
int port = ntohs(own_cert -> localaddr.sin_port);
if ((port < PQI_MIN_PORT) || (port > PQI_MAX_PORT))
{
own_cert -> localaddr.sin_port = htons(PQI_DEFAULT_PORT);
}
/* if localaddr = serveraddr, then ensure that the ports
* are the same (modify server)... this mismatch can
* occur when the local port is changed....
*/
if (own_cert -> localaddr.sin_addr.s_addr ==
own_cert -> serveraddr.sin_addr.s_addr)
{
own_cert -> serveraddr.sin_port =
own_cert -> localaddr.sin_port;
}
// ensure that address family is set, otherwise windows Barfs.
own_cert -> localaddr.sin_family = AF_INET;
own_cert -> serveraddr.sin_family = AF_INET;
own_cert -> lastaddr.sin_family = AF_INET;
return 1;
}
/********** SSL ERROR STUFF ******************************************/
int printSSLError(SSL *ssl, int retval, int err, unsigned long err2,
std::ostream &out)
{
std::string reason;
std::string mainreason = std::string("UNKNOWN ERROR CODE");
if (err == SSL_ERROR_NONE)
{
mainreason = std::string("SSL_ERROR_NONE");
}
else if (err == SSL_ERROR_ZERO_RETURN)
{
mainreason = std::string("SSL_ERROR_ZERO_RETURN");
}
else if (err == SSL_ERROR_WANT_READ)
{
mainreason = std::string("SSL_ERROR_WANT_READ");
}
else if (err == SSL_ERROR_WANT_WRITE)
{
mainreason = std::string("SSL_ERROR_WANT_WRITE");
}
else if (err == SSL_ERROR_WANT_CONNECT)
{
mainreason = std::string("SSL_ERROR_WANT_CONNECT");
}
else if (err == SSL_ERROR_WANT_ACCEPT)
{
mainreason = std::string("SSL_ERROR_WANT_ACCEPT");
}
else if (err == SSL_ERROR_WANT_X509_LOOKUP)
{
mainreason = std::string("SSL_ERROR_WANT_X509_LOOKUP");
}
else if (err == SSL_ERROR_SYSCALL)
{
mainreason = std::string("SSL_ERROR_SYSCALL");
}
else if (err == SSL_ERROR_SSL)
{
mainreason = std::string("SSL_ERROR_SSL");
}
out << "RetVal(" << retval;
out << ") -> SSL Error: " << mainreason << std::endl;
out << "\t + ERR Error: " << ERR_error_string(err2, NULL) << std::endl;
return 1;
}
cert::cert()
:certificate(NULL), hash("")
{
return;
}
cert::~cert()
{
return;
}
std::string cert::Signature()
{
if (certificate == NULL)
{
return Name();
}
else
{
// get signature from cert....
return Name();
}
}
std::string cert::Hash()
{
return hash;
}
void cert::Hash(std::string h)
{
hash = h;
return;
}
/********************* signature stuff *********************/
bool certsign::operator<(const certsign &ref) const
{
//compare the signature.
if (0 > strncmp(data, ref.data, CERTSIGNLEN))
return true;
return false;
}
bool certsign::operator==(const certsign &ref) const
{
//compare the signature.
return (0 == strncmp(data, ref.data, CERTSIGNLEN));
}
/* Fns for relating cert signatures to structures */
cert *sslroot::findcertsign(certsign &sign)
{
std::map<certsign, cert *>::iterator it;
std::ostringstream out;
out << "sslroot::findcertsign()" << std::endl;
for (it = signmap.begin(); it != signmap.end(); it++)
{
out << "Checking Vs " << it -> second -> Name();
if (sign == it -> first)
{
out << "Match!";
}
out << std::endl;
}
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
if (signmap.end() != (it = signmap.find(sign)))
{
return it -> second;
}
return NULL;
}
int sslroot::getcertsign(cert *c, certsign &sign)
{
if ((c == NULL) || (c->certificate == NULL))
{
pqioutput(PQL_ALERT, pqisslrootzone,
"sslroot::getcertsign() ERROR: NULL c || c->certificate");
return 0;
}
// get the signature from the cert, and copy to the array.
ASN1_BIT_STRING *signature = c -> certificate -> signature;
int signlen = ASN1_STRING_length(signature);
if (signlen < CERTSIGNLEN)
{
pqioutput(PQL_ALERT, pqisslrootzone,
"sslroot::getcertsign() ERROR: short Signature");
return 0;
}
// else copy in the first CERTSIGNLEN.
unsigned char *signdata = ASN1_STRING_data(signature);
memcpy(sign.data, signdata, CERTSIGNLEN);
return 1;
}
int sslroot::addtosignmap(cert *c)
{
certsign cs;
if (!getcertsign(c, cs))
{
// error.
pqioutput(PQL_ALERT, pqisslrootzone,
"sslroot::addsigntomap() ERROR: Fail to getcertsign()");
return 0;
}
cert *c2 = findcertsign(cs);
if (c2 == NULL)
{
// add, and return okay.
signmap[cs] = c;
return 1;
}
if (c2 != c)
{
// error.
pqioutput(PQL_ALERT, pqisslrootzone,
"sslroot::addsigntomap() ERROR: Duplicate Entry()");
return 0;
}
// else already exists.
return 1;
}
int sslroot::hashFile(std::string fname, unsigned char *hash, unsigned int hlen)
{
// open the file.
// setup the hash.
// pipe the file through.
return 1;
}
int sslroot::hashDigest(char *data, unsigned int dlen,
unsigned char *hash, unsigned int hlen)
{
EVP_MD_CTX *mdctx = EVP_MD_CTX_create();
if (0 == EVP_DigestInit_ex(mdctx, EVP_sha1(), NULL))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_DigestInit Failure!");
return -1;
}
if (0 == EVP_DigestUpdate(mdctx, data, dlen))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_DigestUpdate Failure!");
return -1;
}
unsigned int signlen = hlen;
if (0 == EVP_DigestFinal_ex(mdctx, hash, &signlen))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_DigestFinal Failure!");
return -1;
}
EVP_MD_CTX_destroy(mdctx);
return signlen;
}
int sslroot::signDigest(EVP_PKEY *key, char *data, unsigned int dlen,
unsigned char *sign, unsigned int slen)
{
unsigned int signlen = EVP_PKEY_size(key);
{
std::ostringstream out;
out << "sslroot::signDigest(" << (void *) key;
out << ", " << (void *) data << ", " << dlen << ", ";
out << (void *) sign << ", " << slen << ")" << std::endl;
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, out.str());
}
if (signlen > slen)
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone,
"sslroot::signDigest() Sign Length too short");
return -1;
}
EVP_MD_CTX *mdctx = EVP_MD_CTX_create();
if (0 == EVP_SignInit_ex(mdctx, EVP_sha1(), NULL))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignInit Failure!");
return -1;
}
if (0 == EVP_SignUpdate(mdctx, data, dlen))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignUpdate Failure!");
return -1;
}
signlen = slen;
if (0 == EVP_SignFinal(mdctx, sign, &signlen, key))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_SignFinal Failure!");
return -1;
}
EVP_MD_CTX_destroy(mdctx);
return signlen;
}
int sslroot::verifyDigest(EVP_PKEY *key, char *data, unsigned int dlen,
unsigned char *enc, unsigned int elen)
{
EVP_MD_CTX *mdctx = EVP_MD_CTX_create();
if (0 == EVP_VerifyInit_ex(mdctx, EVP_sha1(), NULL))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_VerifyInit Failure!");
return -1;
}
if (0 == EVP_VerifyUpdate(mdctx, data, dlen))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_VerifyUpdate Failure!");
return -1;
}
int vv;
if (0 > (vv = EVP_VerifyFinal(mdctx, enc, elen, key)))
{
pqioutput(PQL_ALERT, pqisslrootzone, "EVP_VerifyFinal Failure!");
return -1;
}
if (vv == 1)
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, "Verified Signature OKAY");
}
else
{
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, "Failed Verification!");
}
EVP_MD_CTX_destroy(mdctx);
return vv;
}
// Think both will fit in the one Structure.
int sslroot::generateKeyPair(EVP_PKEY *keypair, unsigned int keylen)
{
RSA *rsa = RSA_generate_key(2048, 65537, NULL, NULL);
EVP_PKEY_assign_RSA(keypair, rsa);
pqioutput(PQL_DEBUG_BASIC, pqisslrootzone, "sslroot::generateKeyPair()");
return 1;
}
std::string getX509NameString(X509_NAME *name)
{
std::string namestr;
for(int i = 0; i < X509_NAME_entry_count(name); i++)
{
X509_NAME_ENTRY *entry = X509_NAME_get_entry(name, i);
ASN1_STRING *entry_data = X509_NAME_ENTRY_get_data(entry);
ASN1_OBJECT *entry_obj = X509_NAME_ENTRY_get_object(entry);
namestr += "\t";
namestr += OBJ_nid2ln(OBJ_obj2nid(entry_obj));
namestr += " : ";
//namestr += entry_obj -> flags;
//namestr += entry_data -> length;
//namestr += entry_data -> type;
//namestr += entry_data -> flags;
//entry -> set;
if (entry_data -> data != NULL)
{
namestr += (char *) entry_data -> data;
}
else
{
namestr += "NULL";
}
if (i + 1 < X509_NAME_entry_count(name))
{
namestr += "\n";
}
}
return namestr;
}
std::string getX509CNString(X509_NAME *name)
{
std::string namestr;
for(int i = 0; i < X509_NAME_entry_count(name); i++)
{
X509_NAME_ENTRY *entry = X509_NAME_get_entry(name, i);
ASN1_STRING *entry_data = X509_NAME_ENTRY_get_data(entry);
ASN1_OBJECT *entry_obj = X509_NAME_ENTRY_get_object(entry);
if (0 == strncmp("CN", OBJ_nid2sn(OBJ_obj2nid(entry_obj)), 2))
{
if (entry_data -> data != NULL)
{
namestr += (char *) entry_data -> data;
}
else
{
namestr += "Unknown";
}
return namestr;
}
}
return namestr;
}
std::string getX509TypeString(X509_NAME *name, char *type, int len)
{
std::string namestr;
for(int i = 0; i < X509_NAME_entry_count(name); i++)
{
X509_NAME_ENTRY *entry = X509_NAME_get_entry(name, i);
ASN1_STRING *entry_data = X509_NAME_ENTRY_get_data(entry);
ASN1_OBJECT *entry_obj = X509_NAME_ENTRY_get_object(entry);
if (0 == strncmp(type, OBJ_nid2sn(OBJ_obj2nid(entry_obj)), len))
{
if (entry_data -> data != NULL)
{
namestr += (char *) entry_data -> data;
}
else
{
namestr += "Unknown";
}
return namestr;
}
}
return namestr;
}
std::string getX509LocString(X509_NAME *name)
{
return getX509TypeString(name, "L", 2);
}
std::string getX509OrgString(X509_NAME *name)
{
return getX509TypeString(name, "O", 2);
}
std::string getX509CountryString(X509_NAME *name)
{
return getX509TypeString(name, "C", 2);
}
std::string convert_to_str(certsign &sign)
{
std::ostringstream id;
for(int i = 0; i < CERTSIGNLEN; i++)
{
id << std::hex << std::setw(2) << std::setfill('0')
<< (uint16_t) (((uint8_t *) (sign.data))[i]);
}
return id.str();
}
bool convert_to_certsign(std::string id, certsign &sign)
{
char num[3];
if (id.length() < CERTSIGNLEN * 2)
{
return false;
}
for(int i = 0; i < CERTSIGNLEN; i++)
{
num[0] = id[i * 2];
num[1] = id[i * 2 + 1];
num[2] = '\0';
int32_t val;
if (1 != sscanf(num, "%x", &val))
{
return false;
}
sign.data[i] = (uint8_t) val;
}
return true;
}
Reference in New Issue Copy Permalink