static SSL_CTX *initialise_ssl_ctx(int server_mode, const char *engine_id,
const char *CAfile, const char *cert, const char *key,
- const char *cipher_list, int out_state);
+ const char *dcert, const char *dkey, const char *cipher_list,
+ int out_state, int out_verify, int verify_mode,
+ unsigned int verify_depth);
static void selector_init(tunala_selector_t *selector);
static void selector_add_listener(tunala_selector_t *selector, int fd);
static void selector_add_tunala(tunala_selector_t *selector, tunala_item_t *t);
static const char *def_cacert = NULL;
static const char *def_cert = NULL;
static const char *def_key = NULL;
+static const char *def_dcert = NULL;
+static const char *def_dkey = NULL;
static const char *def_engine_id = NULL;
static int def_server_mode = 0;
static const char *def_cipher_list = NULL;
static int def_out_state = 0;
+static unsigned int def_out_verify = 0;
+static int def_verify_mode = 0;
+static unsigned int def_verify_depth = 10;
static const char *helpstring =
- "\n'Tunala' (A tunneler with a New Zealand accent)\n"
- "Usage: tunala [options], where options are from;\n"
- " -listen [host:]<port> (default = 127.0.0.1:8080)\n"
- " -proxy <host>:<port> (default = 127.0.0.1:443)\n"
- " -maxtunnels <num> (default = 50)\n"
- " -cacert <path|NULL> (default = NULL)\n"
- " -cert <path|NULL> (default = NULL)\n"
- " -key <path|NULL> (default = whatever '-cert' is)\n"
- " -engine <id|NULL> (default = NULL)\n"
- " -server <0|1> (default = 0, ie. an SSL client)\n"
- " -cipher <list> (specifies cipher list to use)\n"
- " -out_state (prints SSL handshake states)\n"
- " -<h|help|?> (displays this help screen)\n"
- "NB: It is recommended to specify a cert+key when operating as an\n"
- "SSL server. If you only specify '-cert', the same file must\n"
- "contain a matching private key.\n";
+"\n'Tunala' (A tunneler with a New Zealand accent)\n"
+"Usage: tunala [options], where options are from;\n"
+" -listen [host:]<port> (default = 127.0.0.1:8080)\n"
+" -proxy <host>:<port> (default = 127.0.0.1:443)\n"
+" -maxtunnels <num> (default = 50)\n"
+" -cacert <path|NULL> (default = NULL)\n"
+" -cert <path|NULL> (default = NULL)\n"
+" -key <path|NULL> (default = whatever '-cert' is)\n"
+" -dcert <path|NULL> (usually for DSA, default = NULL)\n"
+" -dkey <path|NULL> (usually for DSA, default = whatever '-dcert' is)\n"
+" -engine <id|NULL> (default = NULL)\n"
+" -server <0|1> (default = 0, ie. an SSL client)\n"
+" -cipher <list> (specifies cipher list to use)\n"
+" -out_state (prints SSL handshake states)\n"
+" -out_verify <0|1|2|3> (prints certificate verification states: def=1)\n"
+" -v_peer (verify the peer certificate)\n"
+" -v_strict (do not continue if peer doesn't authenticate)\n"
+" -v_once (no verification in renegotiates)\n"
+" -v_depth <num> (limit certificate chain depth, default = 10)\n"
+" -<h|help|?> (displays this help screen)\n"
+"NB: It is recommended to specify a cert+key when operating as an\n"
+"SSL server. If you only specify '-cert', the same file must\n"
+"contain a matching private key.\n";
static int usage(const char *errstr, int isunknownarg)
{
return 1;
}
+static int parse_verify_level(const char *s, unsigned int *verify_level)
+{
+ unsigned long l;
+ char *temp;
+ l = strtoul(s, &temp, 10);
+ if((temp == s) || (*temp != '\0') || (l > 3)) {
+ fprintf(stderr, "Error, '%s' is an invalid value for "
+ "out_verify\n", s);
+ return 0;
+ }
+ *verify_level = (unsigned int)l;
+ return 1;
+}
+
+static int parse_verify_depth(const char *s, unsigned int *verify_depth)
+{
+ unsigned long l;
+ char *temp;
+ l = strtoul(s, &temp, 10);
+ if((temp == s) || (*temp != '\0') || (l < 1) || (l > 50)) {
+ fprintf(stderr, "Error, '%s' is an invalid value for "
+ "verify_depth\n", s);
+ return 0;
+ }
+ *verify_depth = (unsigned int)l;
+ return 1;
+}
+
int main(int argc, char *argv[])
{
unsigned int loop;
const char *cacert = def_cacert;
const char *cert = def_cert;
const char *key = def_key;
+ const char *dcert = def_dcert;
+ const char *dkey = def_dkey;
const char *engine_id = def_engine_id;
int server_mode = def_server_mode;
const char *cipher_list = def_cipher_list;
int out_state = def_out_state;
+ unsigned int out_verify = def_out_verify;
+ int verify_mode = def_verify_mode;
+ unsigned int verify_depth = def_verify_depth;
/* Parse command-line arguments */
next_arg:
else
key = *argv;
goto next_arg;
+ } else if(strcmp(*argv, "-dcert") == 0) {
+ if(argc < 2)
+ return usage("-dcert requires an argument", 0);
+ argc--; argv++;
+ if(strcmp(*argv, "NULL") == 0)
+ dcert = NULL;
+ else
+ dcert = *argv;
+ goto next_arg;
+ } else if(strcmp(*argv, "-dkey") == 0) {
+ if(argc < 2)
+ return usage("-dkey requires an argument", 0);
+ argc--; argv++;
+ if(strcmp(*argv, "NULL") == 0)
+ dkey = NULL;
+ else
+ dkey = *argv;
+ goto next_arg;
} else if(strcmp(*argv, "-engine") == 0) {
if(argc < 2)
return usage("-engine requires an argument", 0);
} else if(strcmp(*argv, "-out_state") == 0) {
out_state = 1;
goto next_arg;
+ } else if(strcmp(*argv, "-out_verify") == 0) {
+ if(argc < 2)
+ return usage("-out_verify requires an argument", 0);
+ argc--; argv++;
+ if(!parse_verify_level(*argv, &out_verify))
+ return 1;
+ goto next_arg;
+ } else if(strcmp(*argv, "-v_peer") == 0) {
+ verify_mode |= SSL_VERIFY_PEER;
+ goto next_arg;
+ } else if(strcmp(*argv, "-v_strict") == 0) {
+ verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
+ goto next_arg;
+ } else if(strcmp(*argv, "-v_once") == 0) {
+ verify_mode |= SSL_VERIFY_CLIENT_ONCE;
+ goto next_arg;
+ } else if(strcmp(*argv, "-v_depth") == 0) {
+ if(argc < 2)
+ return usage("-v_depth requires an argument", 0);
+ argc--; argv++;
+ if(!parse_verify_depth(*argv, &verify_depth))
+ return 1;
+ goto next_arg;
} else if((strcmp(*argv, "-h") == 0) ||
(strcmp(*argv, "-help") == 0) ||
(strcmp(*argv, "-?") == 0)) {
err_str0("ip_initialise succeeded");
/* Create the SSL_CTX */
if((world.ssl_ctx = initialise_ssl_ctx(server_mode, engine_id,
- cacert, cert, key, cipher_list, out_state)) == NULL)
+ cacert, cert, key, dcert, dkey, cipher_list, out_state,
+ out_verify, verify_mode, verify_depth)) == NULL)
return err_str1("initialise_ssl_ctx(engine_id=%s) failed",
(engine_id == NULL) ? "NULL" : engine_id);
err_str1("initialise_ssl_ctx(engine_id=%s) succeeded",
/* OpenSSL bits */
/****************/
-static SSL_CTX *initialise_ssl_ctx(int server_mode, const char *engine_id,
- const char *CAfile, const char *cert, const char *key,
- const char *cipher_list, int out_state)
+static int ctx_set_cert(SSL_CTX *ctx, const char *cert, const char *key)
{
- SSL_CTX *ctx, *ret = NULL;
- SSL_METHOD *meth;
- ENGINE *e = NULL;
FILE *fp = NULL;
X509 *x509 = NULL;
EVP_PKEY *pkey = NULL;
+ int toret = 0; /* Assume an error */
- OpenSSL_add_ssl_algorithms();
- SSL_load_error_strings();
-
- meth = (server_mode ? SSLv23_server_method() : SSLv23_client_method());
- if(meth == NULL)
- goto err;
- if(engine_id) {
- if((e = ENGINE_by_id(engine_id)) == NULL) {
- fprintf(stderr, "Error obtaining '%s' engine, openssl "
- "errors follow\n", engine_id);
- goto err;
- }
- if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
- fprintf(stderr, "Error assigning '%s' engine, openssl "
- "errors follow\n", engine_id);
- goto err;
- }
- ENGINE_free(e);
- }
- if((ctx = SSL_CTX_new(meth)) == NULL)
- goto err;
- /* cacert */
- if(CAfile) {
- if(!X509_STORE_load_locations(SSL_CTX_get_cert_store(ctx),
- CAfile, NULL)) {
- fprintf(stderr, "Error loading CA cert(s) in '%s'\n",
- CAfile);
- goto err;
- }
- fprintf(stderr, "Info, operating with CA cert(s) in '%s'\n",
- CAfile);
- } else
- fprintf(stderr, "Info, operating without a CA cert(-list)\n");
- if(!SSL_CTX_set_default_verify_paths(ctx)) {
- fprintf(stderr, "Error setting default verify paths\n");
- goto err;
- }
/* cert */
if(cert) {
if((fp = fopen(cert, "r")) == NULL) {
cert);
goto err;
}
- fprintf(stderr, "Info, operating with cert in '%s'\n", cert);
+ /* Clear the FILE* for reuse in the "key" code */
fclose(fp);
fp = NULL;
+ fprintf(stderr, "Info, operating with cert in '%s'\n", cert);
/* If a cert was given without matching key, we assume the same
* file contains the required key. */
if(!key)
key = cert;
- } else
- if(key) {
+ } else {
+ if(key)
fprintf(stderr, "Error, can't specify a key without a "
"corresponding certificate\n");
- goto err;
- }
+ else
+ fprintf(stderr, "Error, ctx_set_cert called with "
+ "NULLs!\n");
+ goto err;
+ }
/* key */
if(key) {
if((fp = fopen(key, "r")) == NULL) {
fprintf(stderr, "Info, operating with key in '%s'\n", key);
} else
fprintf(stderr, "Info, operating without a cert or key\n");
+ /* Success */
+ toret = 1; err:
+ if(x509)
+ X509_free(x509);
+ if(pkey)
+ EVP_PKEY_free(pkey);
+ if(fp)
+ fclose(fp);
+ return toret;
+}
+
+static SSL_CTX *initialise_ssl_ctx(int server_mode, const char *engine_id,
+ const char *CAfile, const char *cert, const char *key,
+ const char *dcert, const char *dkey, const char *cipher_list,
+ int out_state, int out_verify, int verify_mode,
+ unsigned int verify_depth)
+{
+ SSL_CTX *ctx, *ret = NULL;
+ SSL_METHOD *meth;
+ ENGINE *e = NULL;
+
+ OpenSSL_add_ssl_algorithms();
+ SSL_load_error_strings();
+
+ meth = (server_mode ? SSLv23_server_method() : SSLv23_client_method());
+ if(meth == NULL)
+ goto err;
+ if(engine_id) {
+ if((e = ENGINE_by_id(engine_id)) == NULL) {
+ fprintf(stderr, "Error obtaining '%s' engine, openssl "
+ "errors follow\n", engine_id);
+ goto err;
+ }
+ if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
+ fprintf(stderr, "Error assigning '%s' engine, openssl "
+ "errors follow\n", engine_id);
+ goto err;
+ }
+ ENGINE_free(e);
+ }
+ if((ctx = SSL_CTX_new(meth)) == NULL)
+ goto err;
+ /* cacert */
+ if(CAfile) {
+ if(!X509_STORE_load_locations(SSL_CTX_get_cert_store(ctx),
+ CAfile, NULL)) {
+ fprintf(stderr, "Error loading CA cert(s) in '%s'\n",
+ CAfile);
+ goto err;
+ }
+ fprintf(stderr, "Info, operating with CA cert(s) in '%s'\n",
+ CAfile);
+ } else
+ fprintf(stderr, "Info, operating without a CA cert(-list)\n");
+ if(!SSL_CTX_set_default_verify_paths(ctx)) {
+ fprintf(stderr, "Error setting default verify paths\n");
+ goto err;
+ }
+
+ /* cert and key */
+ if((cert || key) && !ctx_set_cert(ctx, cert, key))
+ goto err;
+ /* dcert and dkey */
+ if((dcert || dkey) && !ctx_set_cert(ctx, dcert, dkey))
+ goto err;
/* cipher_list */
if(cipher_list) {
fprintf(stderr, "Info, operating with default cipher list\n");
/* out_state (output of SSL handshake states to screen). */
- if(out_state) {
- SSL_CTX_set_info_callback(ctx, cb_ssl_info);
+ if(out_state)
cb_ssl_info_set_output(stderr);
+
+ /* out_verify */
+ if(out_verify > 0) {
+ cb_ssl_verify_set_output(stderr);
+ cb_ssl_verify_set_level(out_verify);
}
- /* Success! */
+ /* verify_depth */
+ cb_ssl_verify_set_depth(verify_depth);
+
+ /* Success! (includes setting verify_mode) */
+ SSL_CTX_set_info_callback(ctx, cb_ssl_info);
+ SSL_CTX_set_verify(ctx, verify_mode, cb_ssl_verify);
ret = ctx;
err:
if(!ret) {
if(ctx)
SSL_CTX_free(ctx);
}
- if(fp)
- fclose(fp);
- if(x509)
- X509_free(x509);
- if(pkey)
- EVP_PKEY_free(pkey);
return ret;
}
return 0;
}
if((item->dirty_read == -1) || (item->dirty_send == -1)) {
- if(state_machine_close_dirty(&item->sm))
+ if(!state_machine_close_dirty(&item->sm))
return 0;
}
return 1;
projects / openssl.git / blobdiff