Main Page | Class Hierarchy | Alphabetical List | Class List | File List | Class Members | File Members | Related Pages | Search for 

ACE_SSL_Context Class Reference

A wrapper for the OpenSSL SSL_CTX related functions. More...

#include <SSL_Context.h>

Collaboration diagram for ACE_SSL_Context:

Collaboration graph
[legend]
List of all members.

Public Types

typedef ACE_SYNCH_MUTEX lock_type
enum  {
  INVALID_METHOD = -1, SSLv2_client = 1, SSLv2_server, SSLv2,
  SSLv3_client, SSLv3_server, SSLv3, SSLv23_client,
  SSLv23_server, SSLv23, TLSv1_client, TLSv1_server,
  TLSv1
}

Public Member Functions

 ACE_SSL_Context (void)
 Constructor.

 ~ACE_SSL_Context (void)
 Destructor.

int set_mode (int mode=ACE_SSL_Context::SSLv23)
int get_mode (void) const
SSL_CTX * context (void)
 Get the SSL context.

int private_key_type (void) const
 Get the file name and file format used for the private key.

const char * private_key_file_name (void) const
int private_key (const char *file_name, int type=SSL_FILETYPE_PEM)
 Set the private key file.

int verify_private_key (void)
 Verify that the private key is valid.

int certificate_type (void) const
 Get the file name and file format used for the certificate file.

const char * certificate_file_name (void) const
int certificate (const char *file_name, int type=SSL_FILETYPE_PEM)
 Set the certificate file.

int load_trusted_ca (const char *ca_file=0, const char *ca_dir=0, bool use_env_defaults=true)
int have_trusted_ca (void) const
void set_verify_peer (int strict=0, int once=1, int depth=0)
void default_verify_mode (int mode)
int default_verify_mode (void) const
Diffie-Hellman (DH) Parameters
When using DSS-based certificates, Diffie-Hellman keys need to be exchanged. These must be provided in the form of DH key generation parameters loaded in, or as fixed keys hardcoded into the code itself. ACE_SSL supports loaded parameters.

int dh_params (const char *file_name, int type=SSL_FILETYPE_PEM)
const char * dh_params_file_name () const
int dh_params_file_type () const

Static Public Member Functions

ACE_SSL_Context * instance (void)
void report_error (unsigned long error_code)
 Print SSL error corresponding to the given error code.

void report_error (void)
 Print the last SSL error for the current thread.

OpenSSL Random Number Generator Seed Related Methods
These are methods that can be used to seed OpenSSL's pseudo-random number generator. These methods can be called more than once.

int random_seed (const char *seed)
int egd_file (const char *socket_file)
int seed_file (const char *seed_file, long bytes=-1)

Private Member Functions

void check_context (void)
 Verify if the context has been initialized or not.

void ssl_library_init ()
 More to document.

void ssl_library_fini ()
 ACE_SSL_Context (const ACE_SSL_Context &)
ACE_SSL_Context & operator= (const ACE_SSL_Context &)

Private Attributes

SSL_CTX * context_
 The SSL_CTX structure.

int mode_
 Cache the mode so we can answer fast.

ACE_SSL_Data_File private_key_
 The private key, certificate, and Diffie-Hellman paramters files.

ACE_SSL_Data_File certificate_
ACE_SSL_Data_File dh_params_
int default_verify_mode_
 The default verify mode.

int have_ca_
 count of successful CA load attempts


Static Private Attributes

lock_type * locks_

Detailed Description

A wrapper for the OpenSSL SSL_CTX related functions.

This class provides a wrapper for the SSL_CTX data structure. Since most applications have a single SSL_CTX structure, this class can be used as a singleton.

Definition at line 75 of file SSL_Context.h.

Member Typedef Documentation

typedef ACE_SYNCH_MUTEX ACE_SSL_Context::lock_type
 

Definition at line 80 of file SSL_Context.h.

Member Enumeration Documentation

anonymous enum
 

Enumeration values:
INVALID_METHOD 
SSLv2_client 
SSLv2_server 
SSLv2 
SSLv3_client 
SSLv3_server 
SSLv3 
SSLv23_client 
SSLv23_server 
SSLv23 
TLSv1_client 
TLSv1_server 
TLSv1 

Definition at line 83 of file SSL_Context.h. 

00083        {
00084     INVALID_METHOD = -1,
00085     SSLv2_client = 1,
00086     SSLv2_server,
00087     SSLv2,
00088     SSLv3_client,
00089     SSLv3_server,
00090     SSLv3,
00091     SSLv23_client,
00092     SSLv23_server,
00093     SSLv23,
00094     TLSv1_client,
00095     TLSv1_server,
00096     TLSv1
00097   };

Constructor & Destructor Documentation

ACE_SSL_Context::ACE_SSL_Context (  void   ) 
 

Constructor.

Definition at line 110 of file SSL_Context.cpp.

References ssl_library_init(). 

00111   : context_ (0),
00112     mode_ (-1),
00113     default_verify_mode_ (SSL_VERIFY_NONE),
00114     have_ca_ (0)
00115 {
00116   ACE_SSL_Context::ssl_library_init ();
00117 }

ACE_SSL_Context::~ACE_SSL_Context (  void   ) 
 

Destructor.

Definition at line 119 of file SSL_Context.cpp.

References ssl_library_fini(). 

00120 {
00121   if (this->context_)
00122     {
00123       ::SSL_CTX_free (this->context_);
00124       this->context_ = 0;
00125     }
00126 
00127   ACE_SSL_Context::ssl_library_fini ();
00128 }

ACE_SSL_Context::ACE_SSL_Context (  const ACE_SSL_Context &   )  [private]
 

Member Function Documentation

int ACE_SSL_Context::certificate (  const char *  file_name,
int  type = SSL_FILETYPE_PEM
) 
 

Set the certificate file.

Definition at line 441 of file SSL_Context.cpp.

References certificate_, check_context(), ACE_SSL_Data_File::file_name(), and ACE_SSL_Data_File::type(). 

00443 {
00444   if (this->certificate_.type () != -1)
00445     return 0;
00446 
00447   this->certificate_ = ACE_SSL_Data_File (file_name, type);
00448 
00449   this->check_context ();
00450 
00451   if (::SSL_CTX_use_certificate_file (this->context_,
00452                                       this->certificate_.file_name (),
00453                                       this->certificate_.type ()) <= 0)
00454     {
00455       this->certificate_ = ACE_SSL_Data_File ();
00456       return -1;
00457     }
00458   else
00459     return 0;
00460 }

ACE_INLINE const char * ACE_SSL_Context::certificate_file_name (  void   )  const
 

Definition at line 71 of file SSL_Context.inl.

References certificate_, and ACE_SSL_Data_File::file_name(). 

00072 {
00073   return this->certificate_.file_name ();
00074 }

ACE_INLINE int ACE_SSL_Context::certificate_type (  void   )  const
 

Get the file name and file format used for the certificate file.

Definition at line 65 of file SSL_Context.inl.

References certificate_, and ACE_SSL_Data_File::type(). 

00066 {
00067   return this->certificate_.type ();
00068 }

ACE_INLINE void ACE_SSL_Context::check_context (  void   )  [private]
 

Verify if the context has been initialized or not.

Definition at line 36 of file SSL_Context.inl.

References default_verify_mode(), and set_mode().

Referenced by certificate(), context(), dh_params(), load_trusted_ca(), private_key(), set_verify_peer(), and verify_private_key(). 

00037 {
00038   if (this->context_ == 0)
00039     {
00040       this->set_mode ();
00041       ::SSL_CTX_set_verify (this->context_, this->default_verify_mode (), 0);
00042     }
00043 }

ACE_INLINE SSL_CTX * ACE_SSL_Context::context (  void   ) 
 

Get the SSL context.

Definition at line 46 of file SSL_Context.inl.

References check_context().

Referenced by ACE_RCSID(), and ACE_SSL_Asynch_Stream::ACE_SSL_Asynch_Stream(). 

00047 {
00048   this->check_context ();
00049   return this->context_;
00050 }

ACE_INLINE int ACE_SSL_Context::default_verify_mode (  void   )  const
 

Definition at line 95 of file SSL_Context.inl.

References default_verify_mode_.

Referenced by check_context(), and set_verify_peer(). 

00096 {
00097   return this->default_verify_mode_;
00098 }

ACE_INLINE void ACE_SSL_Context::default_verify_mode (  int  mode  ) 
 

Set and query the default verify mode for this context, it is inherited by all the ACE_SSL objects created using the context. It can be overriden on a per-ACE_SSL object.

Definition at line 89 of file SSL_Context.inl.

References default_verify_mode_. 

00090 {
00091   this->default_verify_mode_ = mode;
00092 }

int ACE_SSL_Context::dh_params (  const char *  file_name,
int  type = SSL_FILETYPE_PEM
) 
 

Load Diffie-Hellman parameters from file_name. The specified file can be a standalone file containing only DH parameters (e.g., as created by openssl dhparam), or it can be a certificate which has a PEM-encoded set of DH params concatenated on to i.

Definition at line 558 of file SSL_Context.cpp.

References check_context(), dh_params_, ACE_SSL_Data_File::file_name(), and ACE_SSL_Data_File::type(). 

00560 {
00561   if (this->dh_params_.type () != -1)
00562     return 0;
00563 
00564   // For now we only support PEM encodings
00565   if (type != SSL_FILETYPE_PEM)
00566     return -1;
00567 
00568   this->dh_params_ = ACE_SSL_Data_File (file_name, type);
00569 
00570   this->check_context ();
00571 
00572   {
00573     // Swiped from Rescorla's examples and the OpenSSL s_server.c app
00574     DH * ret=0;
00575     BIO * bio = 0;
00576 
00577     if ((bio = ::BIO_new_file (this->dh_params_.file_name (), "r")) == NULL)
00578       {
00579         this->dh_params_ = ACE_SSL_Data_File ();
00580         return -1;
00581       }
00582 
00583     ret = PEM_read_bio_DHparams (bio, NULL, NULL, NULL);
00584     BIO_free (bio);
00585 
00586     if (ret == 0)
00587       {
00588         this->dh_params_ = ACE_SSL_Data_File ();
00589         return -1;
00590       }
00591 
00592     if (::SSL_CTX_set_tmp_dh (this->context_, ret) < 0)
00593       {
00594         this->dh_params_ = ACE_SSL_Data_File ();
00595         return -1;
00596       }
00597     DH_free (ret);
00598   }
00599 
00600   return 0;
00601 }

ACE_INLINE const char * ACE_SSL_Context::dh_params_file_name (   )  const
 

Load Diffie-Hellman parameters from file_name. The specified file can be a standalone file containing only DH parameters (e.g., as created by openssl dhparam), or it can be a certificate which has a PEM-encoded set of DH params concatenated on to i.

Definition at line 83 of file SSL_Context.inl.

References dh_params_, and ACE_SSL_Data_File::file_name(). 

00084 {
00085   return this->dh_params_.file_name ();
00086 }

ACE_INLINE int ACE_SSL_Context::dh_params_file_type (   )  const
 

Load Diffie-Hellman parameters from file_name. The specified file can be a standalone file containing only DH parameters (e.g., as created by openssl dhparam), or it can be a certificate which has a PEM-encoded set of DH params concatenated on to i.

Definition at line 77 of file SSL_Context.inl.

References dh_params_, and ACE_SSL_Data_File::type(). 

00078 {
00079   return this->dh_params_.type ();
00080 }

int ACE_SSL_Context::egd_file (  const char *  socket_file  )  [static]
 

Set the Entropy Gathering Daemon (EGD) UNIX domain socket file to read random seed values from.

Definition at line 499 of file SSL_Context.cpp.

References ACE_NOTSUP_RETURN.

Referenced by ssl_library_init(). 

00500 {
00501 #if OPENSSL_VERSION_NUMBER < 0x00905100L
00502   // OpenSSL < 0.9.5 doesn't have EGD support.
00503   ACE_UNUSED_ARG (socket_file);
00504   ACE_NOTSUP_RETURN (-1);
00505 #else
00506   // RAND_egd() returns the amount of entropy used to seed the random
00507   // number generator.  The actual value should be greater than 16,
00508   // i.e. 128 bits.
00509   if (::RAND_egd (socket_file) > 0)
00510     return 0;
00511   else
00512     return -1;
00513 #endif  /* OPENSSL_VERSION_NUMBER >= 0x00905100L */
00514 }

ACE_INLINE int ACE_SSL_Context::get_mode (  void   )  const
 

Definition at line 101 of file SSL_Context.inl. 

00102 {
00103   return this->mode_;
00104 }

ACE_INLINE int ACE_SSL_Context::have_trusted_ca (  void   )  const
 

Test whether any CA locations have been successfully loaded and return the number of successful attempts.

Return values:
>0 The number of successful CA load attempts.
0 If all CA load attempts have failed.

Definition at line 107 of file SSL_Context.inl.

References have_ca_. 

00108 {
00109   return this->have_ca_;
00110 }

ACE_SSL_Context * ACE_SSL_Context::instance (  void   )  [static]
 

The Singleton context, the SSL components use the singleton if nothing else is available.

Definition at line 131 of file SSL_Context.cpp.

References ACE_Singleton< TYPE, ACE_LOCK >::instance().

Referenced by ACE_RCSID(), and ACE_SSL_Asynch_Stream::ACE_SSL_Asynch_Stream(). 

00132 {
00133   return ACE_Singleton<ACE_SSL_Context, ACE_SYNCH_MUTEX>::instance ();
00134 }

int ACE_SSL_Context::load_trusted_ca (  const char *  ca_file = 0,
const char *  ca_dir = 0,
bool  use_env_defaults = true
) 
 

Load the location of the trusted certification authority certificates. Note that CA certificates are stored in PEM format as a sequence of certificates in ca_file or as a set of individual certificates in ca_dir (or both).

Note this method is called by set_mode() to load the default environment settings for ca_file and ca_dir, if any. This allows for automatic service configuration (and backward compatibility with previous versions).

Note that the underlying SSL function will add valid file and directory names to the load location lists maintained as part of the SSL_CTX table. It therefore doesn't make sense to keep a copy of the file and path name of the most recently added ca_file or ca_path.

Parameters:
in] ca_file CA file pathname. Passed to SSL_CTX_load_verify_locations() if not 0. If 0, behavior depends on the value of use_env_defaults.
in] ca_dir CA directory pathname. Passed to SSL_CTX_load_verify_locations() if not 0. If 0, behavior depends on the value of use_env_defaults.
in] use_env_defaults If false, the specified ca_file argument is passed to SSL_CTX_load_verify_locations(), regardless of its value. If true (the default), additional defaults can be applied to either ca_file, ca_dir, or both. The following additional defaults are applied when the ca_file argument is 0:
  • The SSL_CERT_FILE environment variable will be queried for a file name to use as the ca_file argument. The environment variable name to query can be changed by supplying a ACE_SSL_CERT_FILE_ENV configuration item when building ACE.
  • If there is no SSL_CERT_FILE in the current environment, the file specified by the ACE_DEFAULT_SSL_CERT_FILE ACE configuration item will be used. The default value is "cert.pem" on Windows and "/etc/ssl/cert.pem" on all other platforms. The following additional defaults are applied when the ca_dir argument is 0:
  • The SSL_CERT_DIR environment variable will be queried for a file name to use as the ca_dir argument. The environment variable name to query can be changed by supplying a ACE_SSL_CERT_DIR_ENV configuration item when building ACE.
  • If there is no SSL_CERT_DIR in the current environment, the directory specified by the ACE_DEFAULT_SSL_CERT_DIR ACE configuration item will be used. The default value is "certs" on Windows and "/etc/ssl/certs" on all other platforms.
Returns:
0 for success or -1 on error.
See also:
OpenSSL manual SSL_CTX_load_verify_locations(3) for a detailed description of the CA file and directory requirements and processing.

Definition at line 297 of file SSL_Context.cpp.

References ACE_DEFAULT_SSL_CERT_DIR, ACE_DEFAULT_SSL_CERT_FILE, ACE_SSL_CERT_DIR_ENV, ACE_SSL_CERT_FILE_ENV, check_context(), ACE::debug(), ACE_OS::getenv(), have_ca_, report_error(), SSLv2, SSLv23, SSLv23_server, SSLv2_server, SSLv3, SSLv3_server, TLSv1, and TLSv1_server.

Referenced by set_mode(). 

00300 {
00301   this->check_context ();
00302 
00303   if (ca_file == 0 && use_env_defaults)
00304     {
00305       // Use the default environment settings.
00306       ca_file = ACE_OS::getenv (ACE_SSL_CERT_FILE_ENV);
00307       if (ca_file == 0)
00308         ca_file = ACE_DEFAULT_SSL_CERT_FILE;
00309     }
00310 
00311   if (ca_dir == 0 && use_env_defaults)
00312     {
00313       // Use the default environment settings.
00314       ca_dir = ACE_OS::getenv (ACE_SSL_CERT_DIR_ENV);
00315       if (ca_dir == 0)
00316         ca_dir = ACE_DEFAULT_SSL_CERT_DIR;
00317     }
00318 
00319   // NOTE: SSL_CTX_load_verify_locations() returns 0 on error.
00320   if (::SSL_CTX_load_verify_locations (this->context_,
00321                                        ca_file,
00322                                        ca_dir) <= 0)
00323     {
00324       if (ACE::debug ())
00325         ACE_SSL_Context::report_error ();
00326       return -1;
00327     }
00328 
00329   ++this->have_ca_;
00330 
00331   // For TLS/SSL servers scan all certificates in ca_file and ca_dir and
00332   // list them as acceptable CAs when requesting a client certificate.
00333   if (mode_ == SSLv23
00334       || mode_ == SSLv23_server
00335       || mode_ == TLSv1
00336       || mode_ == TLSv1_server
00337       || mode_ == SSLv3
00338       || mode_ == SSLv3_server
00339       || mode_ == SSLv2
00340       || mode_ == SSLv2_server)
00341     {
00342       // Note: The STACK_OF(X509_NAME) pointer is a copy of the pointer in
00343       // the CTX; any changes to it by way of these function calls will
00344       // change the CTX directly.
00345       STACK_OF (X509_NAME) * cert_names;
00346       cert_names = ::SSL_CTX_get_client_CA_list (this->context_);
00347       bool error = false;
00348 
00349       // Add CAs from both the file and dir, if specified. There should
00350       // already be a STACK_OF(X509_NAME) in the CTX, but if not, we create
00351       // one.
00352       if (ca_file)
00353         {
00354           if (cert_names == 0)
00355             {
00356               if ((cert_names = ::SSL_load_client_CA_file (ca_file)) != 0)
00357                 ::SSL_CTX_set_client_CA_list (this->context_, cert_names);
00358               else
00359                 error = true;
00360             }
00361           else
00362             {
00363               // Add new certificate names to the list.
00364               error = (0 == ::SSL_add_file_cert_subjects_to_stack (cert_names,
00365                                                                    ca_file));
00366             }
00367 
00368           if (error)
00369             {
00370               if (ACE::debug ())
00371                 ACE_SSL_Context::report_error ();
00372               return -1;
00373             }
00374         }
00375 
00376       // SSL_add_dir_cert_subjects_to_stack is defined at 0.9.8a (but not
00377       // on OpenVMS or Mac Classic); it may be available earlier. Change
00378       // this comparison if so.
00379 #if defined (OPENSSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x0090801fL)
00380 #  if !defined (OPENSSL_SYS_VMS) && !defined (OPENSSL_SYS_MACINTOSH_CLASSIC)
00381 
00382       if (ca_dir != 0)
00383         {
00384           if (cert_names == 0)
00385             {
00386               if ((cert_names = sk_X509_NAME_new_null ()) == 0)
00387                 {
00388                   if (ACE::debug ())
00389                     ACE_SSL_Context::report_error ();
00390                   return -1;
00391                 }
00392               ::SSL_CTX_set_client_CA_list (this->context_, cert_names);
00393             }
00394           if (0 == ::SSL_add_dir_cert_subjects_to_stack (cert_names, ca_dir))
00395             {
00396               if (ACE::debug ())
00397                 ACE_SSL_Context::report_error ();
00398               return -1;
00399             }
00400         }
00401 #  endif /* !OPENSSL_SYS_VMS && !OPENSSL_SYS_MACINTOSH_CLASSIC */
00402 #endif /* OPENSSL_VERSION_NUMBER >= 0.9.8a release */
00403 
00404     }
00405 
00406   return 0;
00407 }

ACE_SSL_Context& ACE_SSL_Context::operator= (  const ACE_SSL_Context &   )  [private]
 

int ACE_SSL_Context::private_key (  const char *  file_name,
int  type = SSL_FILETYPE_PEM
) 
 

Set the private key file.

Note:
This method should only be called after a certificate has been set since key verification is performed against the certificate, among other things.

Definition at line 411 of file SSL_Context.cpp.

References check_context(), ACE_SSL_Data_File::file_name(), private_key_, ACE_SSL_Data_File::type(), and verify_private_key(). 

00413 {
00414   if (this->private_key_.type () != -1)
00415     return 0;
00416 
00417   this->check_context ();
00418 
00419   this->private_key_ = ACE_SSL_Data_File (file_name, type);
00420 
00421   if (::SSL_CTX_use_PrivateKey_file (this->context_,
00422                                      this->private_key_.file_name (),
00423                                      this->private_key_.type ()) <= 0)
00424     {
00425       this->private_key_ = ACE_SSL_Data_File ();
00426       return -1;
00427     }
00428   else
00429     return this->verify_private_key ();
00430 }

ACE_INLINE const char * ACE_SSL_Context::private_key_file_name (  void   )  const
 

Definition at line 59 of file SSL_Context.inl.

References ACE_SSL_Data_File::file_name(), and private_key_. 

00060 {
00061   return this->private_key_.file_name ();
00062 }

ACE_INLINE int ACE_SSL_Context::private_key_type (  void   )  const
 

Get the file name and file format used for the private key.

Definition at line 53 of file SSL_Context.inl.

References private_key_, and ACE_SSL_Data_File::type(). 

00054 {
00055   return this->private_key_.type ();
00056 }

int ACE_SSL_Context::random_seed (  const char *  seed  )  [static]
 

Seed the underlying random number generator. This value should have at least 128 bits of entropy.

Definition at line 486 of file SSL_Context.cpp.

References ACE_OS::strlen(). 

00487 {
00488   ::RAND_seed (seed, ACE_OS::strlen (seed));
00489 
00490 #if OPENSSL_VERSION_NUMBER >= 0x00905100L
00491   // RAND_status() returns 1 if the PRNG has enough entropy.
00492   return (::RAND_status () == 1 ? 0 : -1);
00493 #else
00494   return 0;  // Ugly, but OpenSSL <= 0.9.4 doesn't have RAND_status().
00495 #endif  /* OPENSSL_VERSION_NUMBER >= 0x00905100L */
00496 }

void ACE_SSL_Context::report_error (  void   )  [static]
 

Print the last SSL error for the current thread.

Definition at line 550 of file SSL_Context.cpp.

References ACE_OS::last_error().

Referenced by ACE_SSL_SOCK_Stream::close(), load_trusted_ca(), ACE_SSL_SOCK_Stream::recv_i(), ACE_SSL_SOCK_Stream::send_i(), ACE_SSL_SOCK_Acceptor::ssl_accept(), and ACE_SSL_SOCK_Connector::ssl_connect(). 

00551 {
00552   unsigned long error = ::ERR_get_error ();
00553   ACE_SSL_Context::report_error (error);
00554   ACE_OS::last_error (error);
00555 }

void ACE_SSL_Context::report_error (  unsigned long  error_code  )  [static]
 

Print SSL error corresponding to the given error code.

Definition at line 534 of file SSL_Context.cpp.

References ACE_ERROR, ACE_TEXT, and LM_ERROR. 

00535 {
00536   if (error_code == 0)
00537     return;
00538 
00539   char error_string[256];
00540 
00541   (void) ::ERR_error_string (error_code, error_string);
00542 
00543   ACE_ERROR ((LM_ERROR,
00544               ACE_TEXT ("ACE_SSL (%P|%t) error code: %u - %C\n"),
00545               error_code,
00546               error_string));
00547 }

int ACE_SSL_Context::seed_file (  const char *  seed_file,
long  bytes = -1
)  [static]
 

Set the file that contains the random seed value state, and the amount of bytes to read. "-1" bytes causes the entire file to be read.

Definition at line 517 of file SSL_Context.cpp.

Referenced by ssl_library_init(). 

00518 {
00519   // RAND_load_file() returns the number of bytes used to seed the
00520   // random number generator. If the file reads ok, check RAND_status to
00521   // see if it got enough entropy.
00522   if (::RAND_load_file (seed_file, bytes) > 0)
00523 #if OPENSSL_VERSION_NUMBER >= 0x00905100L
00524     // RAND_status() returns 1 if the PRNG has enough entropy.
00525     return (::RAND_status () == 1 ? 0 : -1);
00526 #else
00527     return 0;  // Ugly, but OpenSSL <= 0.9.4 doesn't have RAND_status().
00528 #endif  /* OPENSSL_VERSION_NUMBER >= 0x00905100L */
00529   else
00530     return -1;
00531 }

int ACE_SSL_Context::set_mode (  int  mode = ACE_SSL_Context::SSLv23  ) 
 

Set the CTX mode. The mode can be set only once, afterwards the function has no effect and returns -1. Once the mode is set the underlying SSL_CTX is initialized and the class can be used. If the mode is not set, then the class automatically initializes itself to the default mode.

Definition at line 224 of file SSL_Context.cpp.

References ACE_GUARD_RETURN, load_trusted_ca(), SSLv2, SSLv23, SSLv23_client, SSLv23_server, SSLv2_client, SSLv2_server, SSLv3, SSLv3_client, SSLv3_server, TLSv1, TLSv1_client, and TLSv1_server.

Referenced by check_context(). 

00225 {
00226   ACE_MT (ACE_GUARD_RETURN (ACE_Recursive_Thread_Mutex,
00227                             ace_ssl_mon,
00228                             *ACE_Static_Object_Lock::instance (),
00229                             -1));
00230 
00231   if (this->context_ != 0)
00232     return -1;
00233 
00234   SSL_METHOD *method = 0;
00235 
00236   switch (mode)
00237     {
00238     case ACE_SSL_Context::SSLv2_client:
00239       method = ::SSLv2_client_method ();
00240       break;
00241     case ACE_SSL_Context::SSLv2_server:
00242       method = ::SSLv2_server_method ();
00243       break;
00244     case ACE_SSL_Context::SSLv2:
00245       method = ::SSLv2_method ();
00246       break;
00247     case ACE_SSL_Context::SSLv3_client:
00248       method = ::SSLv3_client_method ();
00249       break;
00250     case ACE_SSL_Context::SSLv3_server:
00251       method = ::SSLv3_server_method ();
00252       break;
00253     case ACE_SSL_Context::SSLv3:
00254       method = ::SSLv3_method ();
00255       break;
00256     case ACE_SSL_Context::SSLv23_client:
00257       method = ::SSLv23_client_method ();
00258       break;
00259     case ACE_SSL_Context::SSLv23_server:
00260       method = ::SSLv23_server_method ();
00261       break;
00262     case ACE_SSL_Context::SSLv23:
00263       method = ::SSLv23_method ();
00264       break;
00265     case ACE_SSL_Context::TLSv1_client:
00266       method = ::TLSv1_client_method ();
00267       break;
00268     case ACE_SSL_Context::TLSv1_server:
00269       method = ::TLSv1_server_method ();
00270       break;
00271     case ACE_SSL_Context::TLSv1:
00272       method = ::TLSv1_method ();
00273       break;
00274     default:
00275       method = ::SSLv3_method ();
00276       break;
00277     }
00278 
00279   this->context_ = ::SSL_CTX_new (method);
00280   if (this->context_ == 0)
00281     return -1;
00282 
00283   this->mode_ = mode;
00284 
00285   // Load the trusted certificate authority (default) certificate
00286   // locations. But do not return -1 on error, doing so confuses CTX
00287   // allocation (severe error) with the less important loading of CA
00288   // certificate location error.  If it is important for your
00289   // application then call ACE_SSL_Context::have_trusted_ca(),
00290   // immediately following this call to set_mode().
00291   (void) this->load_trusted_ca ();
00292 
00293   return 0;
00294 }

void ACE_SSL_Context::set_verify_peer (  int  strict = 0,
int  once = 1,
int  depth = 0
) 
 

Todo:
Complete this documentation where elipses(...) are used
Use this method when certificate chain verification is required. The default server behaviour is SSL_VERIFY_NONE i.e. client certicates are requested for verified. This method can be used to configure server to request client certificates and perform the certificate verification. If is set true the client connection is rejected when certificate verification fails. Otherwise the session is accepted with a warning, which is the default behaviour. If is set true (default), certificates are requested only once per session. The last parameter can be used to set the verification depth.

Note for verification to work correctly there should be a valid CA name list set using load_trusted_ca().

See also:
OpenSSL documentation of SSL_CTX_set_verify(3) for details of the verification process.

OpenSSL documentation ... set_verify_depth(3) ...

Note that this method overrides the use of the default_verify_mode() method.

Definition at line 463 of file SSL_Context.cpp.

References check_context(), and default_verify_mode(). 

00464 {
00465   this->check_context ();
00466 
00467   // Setup the peer verififcation mode.
00468 
00469   int verify_mode = SSL_VERIFY_PEER;
00470   if (once)
00471     verify_mode |= SSL_VERIFY_CLIENT_ONCE;
00472   if (strict)
00473     verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
00474 
00475   // set the default verify mode
00476   this->default_verify_mode (verify_mode);
00477 
00478   // Set the max certificate depth but later let the verify_callback
00479   // catch the depth error by adding one to the required depth.
00480   if (depth > 0)
00481     ::SSL_CTX_set_verify_depth (this->context_, depth + 1);
00482 }

void ACE_SSL_Context::ssl_library_fini (   )  [private]
 

Definition at line 198 of file SSL_Context.cpp.

References ACE_GUARD, and locks_.

Referenced by ~ACE_SSL_Context(). 

00199 {
00200   ACE_MT (ACE_GUARD (ACE_Recursive_Thread_Mutex,
00201                      ace_ssl_mon,
00202                      *ACE_Static_Object_Lock::instance ()));
00203 
00204   --ssl_library_init_count;
00205   if (ssl_library_init_count == 0)
00206     {
00207       ::ERR_free_strings ();
00208       ::EVP_cleanup ();
00209 
00210       // Clean up the locking callbacks after everything else has been
00211       // cleaned up.
00212 #ifdef ACE_HAS_THREADS
00213       ::CRYPTO_set_locking_callback (0);
00214       ssl_locks = 0;
00215 
00216       delete [] this->locks_;
00217       this->locks_ = 0;
00218 
00219 #endif  /* ACE_HAS_THREADS */
00220     }
00221 }

void ACE_SSL_Context::ssl_library_init (   )  [private]
 

More to document.

@

Definition at line 137 of file SSL_Context.cpp.

References ACE_GUARD, ACE_SSL_EGD_FILE_ENV, ACE_SSL_LOCKING_CALLBACK_NAME, ACE_SSL_RAND_FILE_ENV, ACE_SSL_THREAD_ID_NAME, egd_file(), ACE_OS::getenv(), locks_, and seed_file().

Referenced by ACE_SSL_Context(). 

00138 {
00139   ACE_MT (ACE_GUARD (ACE_Recursive_Thread_Mutex,
00140                      ace_ssl_mon,
00141                      *ACE_Static_Object_Lock::instance ()));
00142 
00143   if (ssl_library_init_count == 0)
00144     {
00145       // Initialize the locking callbacks before initializing anything
00146       // else.
00147 #ifdef ACE_HAS_THREADS
00148       int const num_locks = ::CRYPTO_num_locks ();
00149 
00150       this->locks_ = new lock_type[num_locks];
00151       ssl_locks    = this->locks_;
00152 
00153 # if !defined (WIN32)
00154       // This call isn't necessary on some platforms.  See the CRYPTO
00155       // library's threads(3) man page for details.
00156       ::CRYPTO_set_id_callback (ACE_SSL_THREAD_ID_NAME);
00157 # endif  /* !WIN32 */
00158       ::CRYPTO_set_locking_callback (ACE_SSL_LOCKING_CALLBACK_NAME);
00159 #endif  /* ACE_HAS_THREADS */
00160 
00161       ::SSLeay_add_ssl_algorithms ();
00162       ::SSL_load_error_strings ();
00163 
00164       // Seed the random number generator.  Note that the random
00165       // number generator can be seeded more than once to "stir" its
00166       // state.
00167 
00168 #ifdef WIN32
00169       // Seed the random number generator by sampling the screen.
00170       ::RAND_screen ();
00171 #endif  /* WIN32 */
00172 
00173 #if OPENSSL_VERSION_NUMBER >= 0x00905100L
00174       // OpenSSL < 0.9.5 doesn't have EGD support.
00175 
00176       const char *egd_socket_file =
00177         ACE_OS::getenv (ACE_SSL_EGD_FILE_ENV);
00178 
00179       if (egd_socket_file != 0)
00180         (void) this->egd_file (egd_socket_file);
00181 #endif  /* OPENSSL_VERSION_NUMBER */
00182 
00183       const char *rand_file =
00184         ACE_OS::getenv (ACE_SSL_RAND_FILE_ENV);
00185 
00186       if (rand_file != 0)
00187         (void) this->seed_file (rand_file);
00188 
00189       // Initialize the mutexes that will be used by the SSL and
00190       // crypto library.
00191 
00192     }
00193 
00194   ++ssl_library_init_count;
00195 }

int ACE_SSL_Context::verify_private_key (  void   ) 
 

Verify that the private key is valid.

Note:
This method should only be called after a certificate has been set since key verification is performed against the certificate, among other things.

Definition at line 433 of file SSL_Context.cpp.

References check_context().

Referenced by private_key(). 

00434 {
00435   this->check_context ();
00436 
00437   return (::SSL_CTX_check_private_key (this->context_) <= 0 ? -1 : 0);
00438 }

Member Data Documentation

ACE_SSL_Data_File ACE_SSL_Context::certificate_ [private]
 

Definition at line 362 of file SSL_Context.h.

Referenced by certificate(), certificate_file_name(), and certificate_type().

SSL_CTX* ACE_SSL_Context::context_ [private]
 

The SSL_CTX structure.

Definition at line 355 of file SSL_Context.h.

int ACE_SSL_Context::default_verify_mode_ [private]
 

The default verify mode.

Definition at line 366 of file SSL_Context.h.

Referenced by default_verify_mode().

ACE_SSL_Data_File ACE_SSL_Context::dh_params_ [private]
 

Definition at line 363 of file SSL_Context.h.

Referenced by dh_params(), dh_params_file_name(), and dh_params_file_type().

int ACE_SSL_Context::have_ca_ [private]
 

count of successful CA load attempts

Definition at line 369 of file SSL_Context.h.

Referenced by have_trusted_ca(), and load_trusted_ca().

lock_type* ACE_SSL_Context::locks_ [static, private]
 

Array of mutexes used internally by OpenSSL when the SSL application is multithreaded.

Definition at line 374 of file SSL_Context.h.

Referenced by ssl_library_fini(), and ssl_library_init().

int ACE_SSL_Context::mode_ [private]
 

Cache the mode so we can answer fast.

Definition at line 358 of file SSL_Context.h.

ACE_SSL_Data_File ACE_SSL_Context::private_key_ [private]
 

The private key, certificate, and Diffie-Hellman paramters files.

Definition at line 361 of file SSL_Context.h.

Referenced by private_key(), private_key_file_name(), and private_key_type().

The documentation for this class was generated from the following files:
Generated on Thu Nov 9 11:42:19 2006 for ACE_SSL by doxygen 1.3.6