TAO::SSLIOP::Protocol_Factory Class Reference

SSLIOP-specific protocol factory implementation. More...

#include <SSLIOP_Factory.h>

Inheritance diagram for TAO::SSLIOP::Protocol_Factory:

[legend]Collaboration diagram for TAO::SSLIOP::Protocol_Factory:

[legend]List of all members.

Public Member Functions
	Protocol_Factory (void)
	Constructor.
virtual	~Protocol_Factory (void)
	Destructor.
virtual int	init (int argc, char *argv[])
	Dynamic linking hook.
virtual int	match_prefix (const ACE_CString &prefix)
	Verify prefix is a match.
virtual const char *	prefix (void) const
	Returns the prefix used by the protocol.
virtual char	options_delimiter (void) const
virtual TAO_Acceptor *	make_acceptor (void)
virtual TAO_Connector *	make_connector (void)
virtual int	requires_explicit_endpoint (void) const
Private Member Functions
int	register_orb_initializer (CSIIOP::AssociationOptions csiv2_target_supports, CSIIOP::AssociationOptions csiv2_target_requires)
	Create and register the SSLIOP ORB initializer.
Static Private Member Functions
static int	parse_x509_file (char *arg, char **path)
Private Attributes
::Security::QOP	qop_
ACE_Time_Value	timeout_
	The accept() timeout.

---

Detailed Description

SSLIOP-specific protocol factory implementation.

This class implements the SSLIOP-specific protocol factory implementation for use in TAO's pluggable protocols framework.

Definition at line 54 of file SSLIOP_Factory.h.

---

Constructor & Destructor Documentation

TAO::SSLIOP::Protocol_Factory::Protocol_Factory

(

void

)

Constructor.

Definition at line 47 of file SSLIOP_Factory.cpp.

  :  TAO_Protocol_Factory (IOP::TAG_INTERNET_IOP),
     qop_ (::Security::SecQOPIntegrityAndConfidentiality),
     timeout_ (TAO::SSLIOP::ACCEPT_TIMEOUT)
{
}

TAO::SSLIOP::Protocol_Factory::~Protocol_Factory

(

void

)

[virtual]

Destructor.

Definition at line 54 of file SSLIOP_Factory.cpp.

{
}

---

Member Function Documentation

int TAO::SSLIOP::Protocol_Factory::init	(	int	argc,
		char *	argv[]
	)			[virtual]

Dynamic linking hook.

Implements TAO_Protocol_Factory.

Definition at line 119 of file SSLIOP_Factory.cpp.

References ACE_ASSERT, ACE_CLR_BITS, ACE_DEBUG, ACE_ERROR, ACE_ERROR_RETURN, ACE_SET_BITS, ACE_TEXT(), Confidentiality, EstablishTrustInClient, EstablishTrustInTarget, Integrity, LM_DEBUG, LM_ERROR, LM_INFO, NoProtection, parse_x509_file(), qop_, SecQOPNoProtection, session_id_context_, ACE_Time_Value::set(), ACE_OS::strcasecmp(), ACE_OS::strtok_r(), TAO_debug_level, TAO_PATH_SEPARATOR_STRING, and timeout_.

{
  char *certificate_path = 0;
  char *private_key_path = 0;
  char *dhparams_path = 0;
  char *ca_file = 0;
  char *ca_dir = 0;
  char *rand_path = 0;

  int certificate_type = -1;
  int private_key_type = -1;
  int dhparams_type = -1;

  int prevdebug = -1;

  CSIIOP::AssociationOptions csiv2_target_supports =
    CSIIOP::Integrity | CSIIOP::Confidentiality;
  CSIIOP::AssociationOptions csiv2_target_requires =
    CSIIOP::Integrity | CSIIOP::Confidentiality;

  // Force the Singleton instance to be initialized/instantiated.
  // Some SSLIOP option combinations below will result in the
  // Singleton instance never being initialized.  In that case,
  // problems may occur later on due to lack of initialization of the
  // underlying SSL library (e.g. OpenSSL), which occurs when an
  // ACE_SSL_Context is instantiated.

  // The code is cleaner this way anyway.
  ACE_SSL_Context * ssl_ctx = ACE_SSL_Context::instance ();
  ACE_ASSERT (ssl_ctx != 0);

  size_t session_id_len =
    (sizeof session_id_context_ >= SSL_MAX_SSL_SESSION_ID_LENGTH)
      ? SSL_MAX_SSL_SESSION_ID_LENGTH
      : sizeof session_id_context_;

  // Note that this function returns 1, if the operation succeded.
  // See SSL_CTX_set_session_id_context(3)
  if( 1 != ::SSL_CTX_set_session_id_context (ssl_ctx->context(),
                                             session_id_context_,
                                             session_id_len))
  {
    if (TAO_debug_level > 0)
      ACE_ERROR ((LM_ERROR,
                  ACE_TEXT ("TAO (%P|%t) Unable to set the session id ")
                  ACE_TEXT ("context to \'%s\'\n"), session_id_context_));

    return -1;
  }

  for (int curarg = 0; curarg != argc; ++curarg)
    {
      if ((ACE_OS::strcasecmp (argv[curarg],
                               "-verbose") == 0)
          || (ACE_OS::strcasecmp (argv[curarg],
                                  "-v") == 0))
        {
          if (TAO_debug_level == 0)
            {
              prevdebug = TAO_debug_level;
              TAO_debug_level = 1;
            }
        }

      else if (ACE_OS::strcasecmp (argv[curarg],
                                   "-SSLNoProtection") == 0)
        {
          // Enable the eNULL cipher.  Note that enabling the "eNULL"
          // cipher only disables encryption.  However, certificate
          // exchanges will still occur.
          if (::SSL_CTX_set_cipher_list (ssl_ctx->context (),
                                         "DEFAULT:eNULL") == 0)
            {
              if (TAO_debug_level > 0)
                ACE_DEBUG ((LM_ERROR,
                            ACE_TEXT ("TAO (%P|%t) Unable to set eNULL ")
                            ACE_TEXT ("SSL cipher in SSLIOP ")
                            ACE_TEXT ("factory.\n")));

              return -1;
            }

          // This does not disable secure invocations on the server
          // side.  It merely enables insecure ones.  On the client
          // side, secure invocations will be disabled unless
          // overridden by a SecurityLevel2::QOPPolicy in the object
          // reference.
          this->qop_ = ::Security::SecQOPNoProtection;

          ACE_SET_BITS (csiv2_target_supports,
                        CSIIOP::NoProtection);

          ACE_CLR_BITS (csiv2_target_requires,
                        CSIIOP::Confidentiality);
        }

      else if (ACE_OS::strcasecmp (argv[curarg],
                                   "-SSLCertificate") == 0)
        {
          curarg++;
          if (curarg < argc)
            {
              certificate_type = parse_x509_file (argv[curarg], &certificate_path);
            }
        }

      else if (ACE_OS::strcasecmp (argv[curarg],
                                   "-SSLPrivateKey") == 0)
        {
          curarg++;
          if (curarg < argc)
            {
              private_key_type = parse_x509_file (argv[curarg], &private_key_path);
            }
        }

      else if (ACE_OS::strcasecmp (argv[curarg],
                                   "-SSLAuthenticate") == 0)
        {
          curarg++;
          if (curarg < argc)
            {
              int mode = SSL_VERIFY_NONE;
              if (ACE_OS::strcasecmp (argv[curarg], "NONE") == 0)
                {
                  mode = SSL_VERIFY_NONE;
                }
              else if (ACE_OS::strcasecmp (argv[curarg], "SERVER") == 0)
                {
                  mode = SSL_VERIFY_PEER;

                  ACE_SET_BITS (csiv2_target_supports,
                                CSIIOP::EstablishTrustInTarget
                                | CSIIOP::EstablishTrustInClient);
                }
              else if (ACE_OS::strcasecmp (argv[curarg], "CLIENT") == 0
                       || ACE_OS::strcasecmp (argv[curarg],
                                              "SERVER_AND_CLIENT") == 0)
                {
                  mode = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT;

                  ACE_SET_BITS (csiv2_target_supports,
                                CSIIOP::EstablishTrustInTarget
                                | CSIIOP::EstablishTrustInClient);

                  ACE_SET_BITS (csiv2_target_requires,
                                CSIIOP::EstablishTrustInClient);
                }

              ssl_ctx->default_verify_mode (mode);
            }
        }

      else if (ACE_OS::strcasecmp (argv[curarg],
                                   "-SSLAcceptTimeout") == 0)
        {
          curarg++;
          if (curarg < argc)
            {
              float timeout = 0;

              if (sscanf (argv[curarg], "%f", &timeout) != 1
                  || timeout < 0)
                ACE_ERROR_RETURN ((LM_ERROR,
                                   "ERROR: Invalid -SSLAcceptTimeout "
                                   "value: %s.\n",
                                   argv[curarg]),
                                  -1);
              else
                this->timeout_.set (timeout);
            }
        }

      else if (ACE_OS::strcasecmp (argv[curarg],
                                   "-SSLDHparams") == 0)
        {
          curarg++;
          if (curarg < argc)
            {
              dhparams_type = parse_x509_file (argv[curarg], &dhparams_path);
            }
        }

      else if (ACE_OS::strcasecmp (argv[curarg],
                                   "-SSLCAfile") == 0)
        {
          curarg++;
          if (curarg < argc)
            {
              (void) parse_x509_file (argv[curarg], &ca_file);
            }
        }

      else if (ACE_OS::strcasecmp (argv[curarg],
                                   "-SSLCApath") == 0)
        {
          curarg++;
          if (curarg < argc)
            {
              ca_dir = argv[curarg];
            }
        }

      else if (ACE_OS::strcasecmp (argv[curarg],
                                   "-SSLrand") == 0)
        {
          curarg++;
          if (curarg < argc)
            {
              rand_path = argv[curarg];
            }
        }
    }

  // Load some (more) entropy from the user specified sources
  // in addition to what's pointed to by ACE_SSL_RAND_FILE_ENV
  if (rand_path != 0)
  {
    short errors = 0;
    char *file_name = 0;
    const char *path = ACE_OS::strtok_r (rand_path,
                                         TAO_PATH_SEPARATOR_STRING,
                                         &file_name);
    while ( path != 0)
    {
      if( -1 == ssl_ctx->seed_file (path, -1))
      {
        ++errors;

        if (TAO_debug_level > 0)
          ACE_ERROR ((LM_ERROR,
                      ACE_TEXT ("TAO (%P|%t) Failed to load ")
                      ACE_TEXT ("more entropy from <%s>: %m\n"), path));
      }
      else
      {
          if (TAO_debug_level > 0)
            ACE_DEBUG ((LM_DEBUG,
                        ACE_TEXT ("TAO (%P|%t) Loaded ")
                        ACE_TEXT ("more entropy from <%s>\n"), path));
      }

      path = ACE_OS::strtok_r (0, TAO_PATH_SEPARATOR_STRING, &file_name);
    }

    if (errors > 0)
      return -1;
  }

  // Load any trusted certificates explicitely rather than relying on
  // previously set SSL_CERT_FILE and/or SSL_CERT_PATH environment variable
  if (ca_file != 0 || ca_dir != 0)
    {
      if (ssl_ctx->load_trusted_ca (ca_file, ca_dir) != 0)
        {
          if (TAO_debug_level > 0)
            ACE_ERROR ((LM_ERROR,
                        ACE_TEXT ("TAO (%P|%t) Unable to load ")
                        ACE_TEXT ("CA certs from %s%s%s\n"),
                        ((ca_file != 0) ? ca_file : ACE_TEXT ("a file pointed to by ")
                                                    ACE_TEXT (ACE_SSL_CERT_FILE_ENV)
                                                    ACE_TEXT (" env var (if any)")),
                        ACE_TEXT (" and "),
                        ((ca_dir != 0) ? ca_dir : ACE_TEXT ("a directory pointed to by ")
                                                  ACE_TEXT (ACE_SSL_CERT_DIR_ENV)
                                                  ACE_TEXT (" env var (if any)"))));

          return -1;
        }
      else
        {
          if (TAO_debug_level > 0)
            ACE_DEBUG ((LM_INFO,
                        ACE_TEXT ("TAO (%P|%t) SSLIOP loaded ")
                        ACE_TEXT ("Trusted Certificates from %s%s%s\n"),
                        ((ca_file != 0) ? ca_file : ACE_TEXT ("a file pointed to by ")
                                                    ACE_TEXT (ACE_SSL_CERT_FILE_ENV)
                                                    ACE_TEXT (" env var (if any)")),
                        ACE_TEXT (" and "),
                        ((ca_dir != 0) ? ca_dir : ACE_TEXT ("a directory pointed to by ")
                                                  ACE_TEXT (ACE_SSL_CERT_DIR_ENV)
                                                  ACE_TEXT (" env var (if any)"))));
        }
    }

  // Load in the DH params.  If there was a file explicitly specified,
  // then we do that here, otherwise we load them in from the cert file.
  // Note that we only do this on the server side, I think so we might
  // need to defer this 'til later in the acceptor or something...
  if (dhparams_path == 0)
    {
      // If the user didn't explicitly specify a DH parameters file, we
      // also might find it concatenated in the certificate file.
      // So, we set the dhparams to that if it wasn't explicitly set.
      dhparams_path = certificate_path;
      dhparams_type = certificate_type;
    }

  if (dhparams_path != 0)
    {
      if (ssl_ctx->dh_params (dhparams_path,
                              dhparams_type) != 0)
        {
          if (dhparams_path != certificate_path)
            {
              // We only want to fail catastrophically if the user specified
              // a dh parameter file and we were unable to actually find it
              // and load from it.
              if (TAO_debug_level > 0)
                ACE_ERROR ((LM_ERROR,
                            ACE_TEXT ("(%P|%t) SSLIOP_Factory: ")
                            ACE_TEXT ("unable to set ")
                            ACE_TEXT ("DH parameters <%s>\n"),
                            dhparams_path));
              return -1;
            }
          else
            {
              if (TAO_debug_level > 0)
                ACE_DEBUG ((LM_INFO,
                            ACE_TEXT ("(%P|%t) SSLIOP_Factory: ")
                            ACE_TEXT ("No DH parameters found in ")
                            ACE_TEXT ("certificate <%s>; either none ")
                            ACE_TEXT ("are needed (RSA) or problems ")
                            ACE_TEXT ("will ensue later.\n"),
                            dhparams_path));
            }
        }
      else
        {
          if (TAO_debug_level > 0)
            ACE_DEBUG ((LM_INFO,
                        ACE_TEXT ("(%P|%t) SSLIOP loaded ")
                        ACE_TEXT ("Diffie-Hellman params ")
                        ACE_TEXT ("from %s\n"),
                        dhparams_path));
        }
    }

  // The certificate must be set before the private key since the
  // ACE_SSL_Context attempts to check the private key for
  // consistency.  That check requires the certificate to be available
  // in the underlying SSL_CTX.
  if (certificate_path != 0)
    {
      if (ssl_ctx->certificate (certificate_path,
                                certificate_type) != 0)
        {
          if (TAO_debug_level > 0)
            ACE_ERROR ((LM_ERROR,
                        ACE_TEXT ("TAO (%P|%t) Unable to set ")
                        ACE_TEXT ("SSL certificate <%s> ")
                        ACE_TEXT ("in SSLIOP factory.\n"),
                        certificate_path));

          return -1;
        }
      else
        {
          if (TAO_debug_level > 0)
            ACE_DEBUG ((LM_INFO,
                        ACE_TEXT ("TAO (%P|%t) SSLIOP loaded ")
                        ACE_TEXT ("SSL certificate ")
                        ACE_TEXT ("from %s\n"),
                        certificate_path));
        }
    }

  if (private_key_path != 0)
    {
      if (ssl_ctx->private_key (private_key_path, private_key_type) != 0)
        {
          if (TAO_debug_level > 0)
            {
              ACE_ERROR ((LM_ERROR,
                          ACE_TEXT ("TAO (%P|%t) Unable to set ")
                          ACE_TEXT ("SSL private key ")
                          ACE_TEXT ("<%s> in SSLIOP factory.\n"),
                          private_key_path));
            }

          return -1;
        }
      else
        {
          if (TAO_debug_level > 0)
            ACE_DEBUG ((LM_INFO,
                        ACE_TEXT ("TAO (%P|%t) SSLIOP loaded ")
                        ACE_TEXT ("Private Key ")
                        ACE_TEXT ("from %s\n"),
                        private_key_path));
        }
    }

  if (this->register_orb_initializer (csiv2_target_supports,
                                      csiv2_target_requires) != 0)
    return -1;

  if (prevdebug != -1)
    TAO_debug_level = prevdebug;

  return 0;
}

TAO_Acceptor * TAO::SSLIOP::Protocol_Factory::make_acceptor

(

void

)

[virtual]

Implements TAO_Protocol_Factory.

Definition at line 83 of file SSLIOP_Factory.cpp.

References ACE_NEW_RETURN.

{
  TAO_Acceptor *acceptor = 0;

  ACE_NEW_RETURN (acceptor,
                  TAO::SSLIOP::Acceptor (this->qop_,
                                         this->timeout_),
                  0);

  return acceptor;
}

TAO_Connector * TAO::SSLIOP::Protocol_Factory::make_connector

(

void

)

[virtual]

Implements TAO_Protocol_Factory.

Definition at line 575 of file SSLIOP_Factory.cpp.

References ACE_NEW_RETURN.

{
  TAO_Connector *connector = 0;

  ACE_NEW_RETURN (connector,
                  TAO::SSLIOP::Connector (this->qop_),
                  0);
  return connector;
}

int TAO::SSLIOP::Protocol_Factory::match_prefix

(

const ACE_CString &

prefix

)

[virtual]

Verify prefix is a match.

Implements TAO_Protocol_Factory.

Definition at line 59 of file SSLIOP_Factory.cpp.

References prefix(), ACE_OS::strcasecmp(), and the_prefix.

{
  // Check for the proper prefix for this protocol.
  return (ACE_OS::strcasecmp (prefix.c_str (), ::the_prefix[0]) == 0)
     || (ACE_OS::strcasecmp (prefix.c_str (), ::the_prefix[1]) == 0);
}

char TAO::SSLIOP::Protocol_Factory::options_delimiter

(

void

)

const [virtual]

Return the character used to mark where an endpoint ends and where its options begin.

Implements TAO_Protocol_Factory.

Definition at line 77 of file SSLIOP_Factory.cpp.

{
  return '/';
}

int TAO::SSLIOP::Protocol_Factory::parse_x509_file	(	char *	arg,
		char **	path
	)			[static, private]

Parse an X509 file path, which is expected to looks like: <X509Path> ::= <Prefix> ':' <Path> <Prefix> ::= 'PEM' | 'ASN1' <Path> ::= any-string Returns either SSL_FILETYPE_ASN1, SSL_FILETYPE_PEM or -1 if the prefix can not be recognized. The *path will point to the part of the original buffer, after the initial ':', or will contain 0, if no path was specified.

Beware: This function modifies the buffer pointed to by arg!

Definition at line 99 of file SSLIOP_Factory.cpp.

References ACE_ASSERT, ACE_OS::strcasecmp(), and ACE_OS::strtok_r().

Referenced by init().

{
  ACE_ASSERT (arg != 0);
  ACE_ASSERT (path != 0);

  char *lst = 0;
  const char *type_name = ACE_OS::strtok_r (arg, ":", &lst);
  *path = ACE_OS::strtok_r (0, "", &lst);

  if (ACE_OS::strcasecmp (type_name, "ASN1") == 0)
      return SSL_FILETYPE_ASN1;

  if (ACE_OS::strcasecmp (type_name, "PEM") == 0)
      return SSL_FILETYPE_PEM;

  return -1;
}

const char * TAO::SSLIOP::Protocol_Factory::prefix

(

void

)

const [virtual]

Returns the prefix used by the protocol.

Implements TAO_Protocol_Factory.

Definition at line 67 of file SSLIOP_Factory.cpp.

References the_prefix.

Referenced by match_prefix().

{
   // Note: This method doesn't seem to be used anywhere. Moreover,
   // keeping it may make things more confusing - a Factory can
   // well be handling multiple protocol prefixes, not just one!
   // Shouldn't it be deprecated?
  return ::the_prefix[0];
}

int TAO::SSLIOP::Protocol_Factory::register_orb_initializer	(	CSIIOP::AssociationOptions	csiv2_target_supports,
		CSIIOP::AssociationOptions	csiv2_target_requires
	)			[private]

Create and register the SSLIOP ORB initializer.

Definition at line 524 of file SSLIOP_Factory.cpp.

References CORBA::SystemException::_tao_minor_code(), CORBA::Exception::_tao_print_exception(), ACE_NEW_THROW_EX, CORBA::COMPLETED_NO, PortableInterceptor::register_orb_initializer(), and TAO::VMCID.

{
  try
    {
      // @todo: This hard-coding should be fixed once SECIOP is
      // supported.
      // Register the Security ORB initializer.
      PortableInterceptor::ORBInitializer_ptr tmp;
      ACE_NEW_THROW_EX (tmp,
                        TAO::Security::ORBInitializer,
                        CORBA::NO_MEMORY (
                          CORBA::SystemException::_tao_minor_code (
                            TAO::VMCID,
                            ENOMEM),
                          CORBA::COMPLETED_NO));

      PortableInterceptor::ORBInitializer_var initializer = tmp;

      PortableInterceptor::register_orb_initializer (initializer.in ());

      // Register the SSLIOP ORB initializer.
      // PortableInterceptor::ORBInitializer_ptr tmp;
      ACE_NEW_THROW_EX (tmp,
                        TAO::SSLIOP::ORBInitializer (this->qop_,
                                                     csiv2_target_supports,
                                                     csiv2_target_requires),
                        CORBA::NO_MEMORY (
                          CORBA::SystemException::_tao_minor_code (
                            TAO::VMCID,
                            ENOMEM),
                          CORBA::COMPLETED_NO));

      //PortableInterceptor::ORBInitializer_var initializer = tmp;
      initializer = tmp;

      PortableInterceptor::register_orb_initializer (initializer.in ());
    }
  catch (const CORBA::Exception& ex)
    {
      ex._tao_print_exception (
        "Unable to register SSLIOP ORB initializer.");
      return -1;
    }

  return 0;
}

int TAO::SSLIOP::Protocol_Factory::requires_explicit_endpoint

(

void

)

const [virtual]

Implements TAO_Protocol_Factory.

Definition at line 586 of file SSLIOP_Factory.cpp.

{
  return 0;
}

---

Member Data Documentation

::Security::QOP TAO::SSLIOP::Protocol_Factory::qop_ [private]

Default quality-of-protection settings for the SSLIOP pluggable protocol.

Definition at line 108 of file SSLIOP_Factory.h.

Referenced by init().

ACE_Time_Value TAO::SSLIOP::Protocol_Factory::timeout_ [private]

The accept() timeout.

This timeout includes the overall time to complete the SSL handshake. This includes both the TCP handshake and the SSL handshake.

Definition at line 116 of file SSLIOP_Factory.h.

Referenced by init().

---

The documentation for this class was generated from the following files:

• SSLIOP_Factory.h
• SSLIOP_Factory.cpp

---