diff options
| -rw-r--r-- | src/afserver.c | 119 | ||||
| -rw-r--r-- | src/file_server.c | 8 | ||||
| -rw-r--r-- | src/server_configuration_struct.c | 119 | ||||
| -rw-r--r-- | src/server_configuration_struct.h | 12 | ||||
| -rw-r--r-- | src/server_realm_struct.c | 153 | ||||
| -rw-r--r-- | src/server_realm_struct.h | 15 |
6 files changed, 241 insertions, 185 deletions
diff --git a/src/afserver.c b/src/afserver.c index 1e7c9d2..461f476 100644 --- a/src/afserver.c +++ b/src/afserver.c @@ -119,7 +119,6 @@ main(int argc, char **argv) static char* stemp = NULL; const SSL_METHOD* method; - SSL_CTX* ctx; SSL* tmp_ssl; sigfillset(&(act.sa_mask)); @@ -349,12 +348,6 @@ main(int argc, char **argv) else { ServerConfiguration_set_certificateFile(config, certif); } - if (cacertif != NULL) { - ServerConfiguration_set_cacertificateFile(config, cacertif); - } - if (cerdepth != NULL) { - ServerConfiguration_set_sCertificateDepth(config, cerdepth); - } if (keys == NULL) { if (ServerConfiguration_get_keysFile(config) == NULL) { ServerConfiguration_set_keysFile(config, "server.rsa"); @@ -395,8 +388,6 @@ main(int argc, char **argv) exit(1); } ServerConfiguration_set_certificateFile(config, certif); - ServerConfiguration_set_cacertificateFile(config, cacertif); - ServerConfiguration_set_sCertificateDepth(config, cerdepth); ServerConfiguration_set_keysFile(config, keys); ServerConfiguration_set_dateFormat(config, dateformat); @@ -475,6 +466,9 @@ main(int argc, char **argv) ServerRealm_set_dnsLookupsOn(pointer, dnslookups); ServerRealm_set_realmName(pointer, realmname); ServerRealm_set_password(pointer, pass); + ServerRealm_set_cacertificateFile(pointer, cacertif); + ServerRealm_set_sCertificateDepth(pointer, cerdepth); + if (strcmp(type, "tcp") == 0) { temp = ServerRealm_get_realmType(pointer); TYPE_SET_TCP(temp); @@ -524,13 +518,7 @@ main(int argc, char **argv) the latest APF/OpenSSL versions used on the server. */ method = SSLv23_server_method(); - ctx = SSL_CTX_new(method); - if (SSL_CTX_set_cipher_list(ctx, "ALL:@STRENGTH") == 0) { - aflog(LOG_T_INIT, LOG_I_CRIT, - "Setting ciphers list failed... exiting"); - exit(1); - } if ((flags = create_apf_dir(0))) { aflog(LOG_T_INIT, LOG_I_WARNING, "Warning: Creating ~/.apf directory failed (%d)", flags); @@ -545,45 +533,12 @@ main(int argc, char **argv) "Warning: Something bad happened when generating rsa keys... (%d)", flags); } ServerConfiguration_set_keysFile(config, keys); - if (SSL_CTX_use_RSAPrivateKey_file(ctx, ServerConfiguration_get_keysFile(config), SSL_FILETYPE_PEM) != 1) { - aflog(LOG_T_INIT, LOG_I_CRIT, - "Setting rsa key failed (%s)... exiting", ServerConfiguration_get_keysFile(config)); - exit(1); - } certif = ServerConfiguration_get_certificateFile(config); if ((flags = generate_certificate(&certif, ServerConfiguration_get_keysFile(config)))) { aflog(LOG_T_INIT, LOG_I_WARNING, "Warning: Something bad happened when generating certificate... (%d)", flags); } ServerConfiguration_set_certificateFile(config, certif); - if (SSL_CTX_use_certificate_file(ctx, - ServerConfiguration_get_certificateFile(config), SSL_FILETYPE_PEM) != 1) { - aflog(LOG_T_INIT, LOG_I_CRIT, - "Setting certificate failed (%s)... exiting", ServerConfiguration_get_certificateFile(config)); - exit(1); - } - - cacertif = ServerConfiguration_get_cacertificateFile(config); - if (cacertif) { - if (SSL_CTX_load_verify_locations(ctx, - cacertif, - NULL) - != 1) - { - aflog(LOG_T_INIT, LOG_I_CRIT, - "Setting CA certificate failed (%s)... exiting", cacertif); - exit(1); - } - - SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, - NULL); - - cerdepth = ServerConfiguration_get_sCertificateDepth (config); - if (cerdepth == NULL) { - cerdepth = "9"; - } - SSL_CTX_set_verify_depth(ctx, check_value_liberal (cerdepth, "Invalid max certificate-depth")); - } if (ServerConfiguration_get_realmsNumber(config) == 0) { aflog(LOG_T_INIT, LOG_I_CRIT, @@ -622,6 +577,64 @@ main(int argc, char **argv) exit(1); } } + + + /* Set up an SSL context for this realm, which may or may not use + a realm-specific CA to authenticate clients: + */ + ServerRealm_set_SslCtx(scRealmsTable[i], SSL_CTX_new(method)); + if (SSL_CTX_set_cipher_list(ServerRealm_get_SslCtx (scRealmsTable[i]), + "ALL:@STRENGTH") + == 0) + { + aflog(LOG_T_INIT, LOG_I_CRIT, + "Setting ciphers list failed... exiting"); + exit(1); + } + + if (SSL_CTX_use_RSAPrivateKey_file(ServerRealm_get_SslCtx (scRealmsTable[i]), + ServerConfiguration_get_keysFile(config), + SSL_FILETYPE_PEM) + != 1) + { + aflog(LOG_T_INIT, LOG_I_CRIT, "Setting rsa key failed (%s)... exiting", + ServerConfiguration_get_keysFile(config)); + exit(1); + } + if (SSL_CTX_use_certificate_file(ServerRealm_get_SslCtx (scRealmsTable[i]), + ServerConfiguration_get_certificateFile(config), + SSL_FILETYPE_PEM) + != 1) + { + aflog(LOG_T_INIT, LOG_I_CRIT, "Setting certificate failed (%s)... exiting", + ServerConfiguration_get_certificateFile(config)); + exit(1); + } + + cacertif = ServerRealm_get_cacertificateFile(scRealmsTable[i]); + if (cacertif) { + if (SSL_CTX_load_verify_locations(ServerRealm_get_SslCtx (scRealmsTable[i]), + cacertif, NULL) + != 1) + { + aflog(LOG_T_INIT, LOG_I_CRIT, + "Setting CA certificate failed (%s)... exiting", cacertif); + exit(1); + } + + SSL_CTX_set_verify (ServerRealm_get_SslCtx (scRealmsTable[i]), + SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, + NULL); + + cerdepth = ServerRealm_get_sCertificateDepth (scRealmsTable[i]); + if (cerdepth == NULL) { + cerdepth = "9"; + } + SSL_CTX_set_verify_depth(ServerRealm_get_SslCtx (scRealmsTable[i]), + check_value_liberal (cerdepth, "Invalid max certificate-depth")); + } + + /* checking type of the realm */ if (!TYPE_IS_SET(ServerRealm_get_realmType(scRealmsTable[i]))) { if (type != NULL) { @@ -881,7 +894,7 @@ main(int argc, char **argv) ServerRealm_get_clientsLimit(scRealmsTable[i]) + ServerRealm_get_raClientsLimit(scRealmsTable[i]), (ServerRealm_get_tunnelType(scRealmsTable[i]) - 1), - ctx)) { + ServerRealm_get_SslCtx(scRealmsTable[i]))) { aflog(LOG_T_INIT, LOG_I_CRIT, #ifdef AF_INET6 "http%s_proxy_listen_%s error for %s, %s", @@ -925,7 +938,8 @@ main(int argc, char **argv) } for (j = 0; j < ServerRealm_get_clientsLimit(scRealmsTable[i]); ++j) { - SslFd_set_ssl(ConnectClient_get_sslFd(srClientsTable[j]), SSL_new(ctx)); + SslFd_set_ssl(ConnectClient_get_sslFd(srClientsTable[j]), + SSL_new(ServerRealm_get_SslCtx(scRealmsTable[i]))); if (SslFd_get_ssl(ConnectClient_get_sslFd(srClientsTable[j])) == NULL) { aflog(LOG_T_INIT, LOG_I_CRIT, "Creation of ssl object failed... exiting"); @@ -934,7 +948,8 @@ main(int argc, char **argv) } for (j = 0; j < ServerRealm_get_raClientsLimit(scRealmsTable[i]); ++j) { - SslFd_set_ssl(ConnectClient_get_sslFd(srRaClientsTable[j]), SSL_new(ctx)); + SslFd_set_ssl(ConnectClient_get_sslFd(srRaClientsTable[j]), + SSL_new(ServerRealm_get_SslCtx(scRealmsTable[i]))); if (SslFd_get_ssl(ConnectClient_get_sslFd(srRaClientsTable[j])) == NULL) { aflog(LOG_T_INIT, LOG_I_CRIT, "Creation of ssl object failed... exiting"); @@ -1449,7 +1464,7 @@ main(int argc, char **argv) /* This SSL-object is busted; don't reuse it (SSL_clear isn't sufficient because ssl->new_session is set): */ SslFd_set_ssl(ConnectClient_get_sslFd(srClientsTable[k]), - SSL_new (ctx)); + SSL_new (ServerRealm_get_SslCtx(pointer))); ConnectClient_set_state(srClientsTable[k], CONNECTCLIENT_STATE_FREE); if ((task = ConnectClient_get_task(srClientsTable[k]))) { diff --git a/src/file_server.c b/src/file_server.c index 3abfc57..35ed235 100644 --- a/src/file_server.c +++ b/src/file_server.c @@ -270,10 +270,14 @@ parsefile(char* name, int* status) ServerConfiguration_set_certificateFile(cfg, helpbuf2); } else if (strcmp(helpbuf1, "cacerfile") == 0) { - ServerConfiguration_set_cacertificateFile(cfg, helpbuf2); + ServerRealm_set_cacertificateFile( + ServerConfiguration_get_realmsTable(cfg)[ServerConfiguration_get_realmsNumber(cfg) - 1], + helpbuf2); } else if (strcmp(helpbuf1, "cerdepth") == 0) { - ServerConfiguration_set_sCertificateDepth(cfg, helpbuf2); + ServerRealm_set_sCertificateDepth( + ServerConfiguration_get_realmsTable(cfg)[ServerConfiguration_get_realmsNumber(cfg) - 1], + helpbuf2); } else if ((strcmp(helpbuf1, "key") == 0) || (strcmp(helpbuf1, "keyfile") == 0)) { ServerConfiguration_set_keysFile(cfg, helpbuf2); diff --git a/src/server_configuration_struct.c b/src/server_configuration_struct.c index 7f88275..9170a0c 100644 --- a/src/server_configuration_struct.c +++ b/src/server_configuration_struct.c @@ -66,18 +66,6 @@ ServerConfiguration_free(ServerConfiguration** sc) free((*sc)->certificateFile); (*sc)->certificateFile = NULL; } - if ((*sc)->cacertificateFile) { - free((*sc)->cacertificateFile); - (*sc)->cacertificateFile = NULL; - } - if ((*sc)->cacertificatePath) { - free((*sc)->cacertificatePath); - (*sc)->cacertificatePath = NULL; - } - if ((*sc)->sCertificateDepth) { - free((*sc)->sCertificateDepth); - (*sc)->sCertificateDepth = NULL; - } if ((*sc)->keysFile) { free((*sc)->keysFile); (*sc)->keysFile = NULL; @@ -117,59 +105,6 @@ ServerConfiguration_set_certificateFile(ServerConfiguration* sc, char* certifica } /* - * Function name: ServerConfiguration_set_cacertificateFile - * Description: Set CA certificate filename. - * Arguments: sc - pointer to ServerConfiguration structure - * certificateFile - CA certificate filename - */ - -void -ServerConfiguration_set_cacertificateFile(ServerConfiguration* sc, char* cacertificateFile) -{ - assert(sc != NULL); - if (sc == NULL) { - return; - } - string_cp(&(sc->cacertificateFile), cacertificateFile); -} - -/* - * Function name: ServerConfiguration_set_cacertificatePath - * Description: Set CA certificate filename. - * Arguments: sc - pointer to ServerConfiguration structure - * cacertificateFile - CA certificate path - */ - -void -ServerConfiguration_set_cacertificatePath(ServerConfiguration* sc, char* cacertificatePath) -{ - assert(sc != NULL); - if (sc == NULL) { - return; - } - string_cp(&(sc->cacertificatePath), cacertificatePath); -} - -void -ServerConfiguration_set_sCertificateDepth(ServerConfiguration* sc, char* sCertificateDepth) -{ - assert(sc != NULL); - if (sc == NULL) { - return; - } - string_cp(&(sc->sCertificateDepth), sCertificateDepth); -} -void -ServerConfiguration_set_certificateDepth(ServerConfiguration* sc, int certificateDepth) -{ - assert(sc != NULL); - if (sc == NULL) { - return; - } - sc->certificateDepth = certificateDepth; -} - -/* * Function name: ServerConfiguration_set_keysFile * Description: Set keys filename. * Arguments: sc - pointer to ServerConfiguration structure @@ -282,60 +217,6 @@ ServerConfiguration_get_certificateFile(ServerConfiguration* sc) } /* - * Function name: ServerConfiguration_get_cacertificateFile - * Description: Get CA certificate filename. - * Arguments: sc - pointer to ServerConfiguration structure - * Returns: CA Certificate filename. - */ - -char* -ServerConfiguration_get_cacertificateFile(ServerConfiguration* sc) -{ - assert(sc != NULL); - if (sc == NULL) { - return NULL; - } - return sc->cacertificateFile; -} - -/* - * Function name: ServerConfiguration_get_cacertificatePath - * Description: Get CA certificate path - * Arguments: sc - pointer to ServerConfiguration structure - * Returns: CA Certificate path. - */ - -char* -ServerConfiguration_get_cacertificatePath(ServerConfiguration* sc) -{ - assert(sc != NULL); - if (sc == NULL) { - return NULL; - } - return sc->cacertificatePath; -} - -char* -ServerConfiguration_get_sCertificateDepth(ServerConfiguration* sc) -{ - assert(sc != NULL); - if (sc == NULL) { - return NULL; - } - return sc->sCertificateDepth; -} - -int -ServerConfiguration_get_certificateDepth(ServerConfiguration* sc) -{ - assert(sc != NULL); - if (sc == NULL) { - return -1; - } - return sc->certificateDepth; -} - -/* * Function name: ServerConfiguration_get_keysFile * Description: Get keys filename. * Arguments: sc - pointer to ServerConfiguration structure diff --git a/src/server_configuration_struct.h b/src/server_configuration_struct.h index caf7a9e..b302f53 100644 --- a/src/server_configuration_struct.h +++ b/src/server_configuration_struct.h @@ -25,10 +25,6 @@ #include "server_realm_struct.h" typedef struct { - char* cacertificateFile; - char* cacertificatePath; - char* sCertificateDepth; - int certificateDepth; char* certificateFile; char* keysFile; char* dateFormat; @@ -43,10 +39,6 @@ ServerConfiguration* ServerConfiguration_new(); void ServerConfiguration_free(ServerConfiguration** sc); /* setters */ void ServerConfiguration_set_certificateFile(ServerConfiguration* sc, char* certificateFile); -void ServerConfiguration_set_cacertificateFile(ServerConfiguration* sc, char* cacertificateFile); -void ServerConfiguration_set_cacertificatePath(ServerConfiguration* sc, char* cacertificatePath); -void ServerConfiguration_set_sCertificateDepth(ServerConfiguration* sc, char* sCertificateDepth); -void ServerConfiguration_set_certificateDepth(ServerConfiguration* sc, int certificateDepth); void ServerConfiguration_set_keysFile(ServerConfiguration* sc, char* keysFile); void ServerConfiguration_set_dateFormat(ServerConfiguration* sc, char* dateFormat); void ServerConfiguration_set_realmsNumber(ServerConfiguration* sc, int realmsNumber); @@ -54,10 +46,6 @@ void ServerConfiguration_set_startTime(ServerConfiguration* sc, time_t startTime void ServerConfiguration_set_realmsTable(ServerConfiguration* sc, ServerRealm** realmsTable); /* getters */ char* ServerConfiguration_get_certificateFile(ServerConfiguration* sc); -char* ServerConfiguration_get_cacertificateFile(ServerConfiguration* sc); -char* ServerConfiguration_get_cacertificatePath(ServerConfiguration* sc); -char* ServerConfiguration_get_sCertificateDepth(ServerConfiguration* sc); -int ServerConfiguration_get_certificateDepth(ServerConfiguration* sc); char* ServerConfiguration_get_keysFile(ServerConfiguration* sc); char* ServerConfiguration_get_dateFormat(ServerConfiguration* sc); int ServerConfiguration_get_realmsNumber(ServerConfiguration* sc); diff --git a/src/server_realm_struct.c b/src/server_realm_struct.c index c816ae3..4c55245 100644 --- a/src/server_realm_struct.c +++ b/src/server_realm_struct.c @@ -98,6 +98,18 @@ ServerRealm_free(ServerRealm** sr) free((*sr)->realmName); (*sr)->realmName = NULL; } + if ((*sr)->cacertificateFile) { + free((*sr)->cacertificateFile); + (*sr)->cacertificateFile = NULL; + } + if ((*sr)->cacertificatePath) { + free((*sr)->cacertificatePath); + (*sr)->cacertificatePath = NULL; + } + if ((*sr)->sCertificateDepth) { + free((*sr)->sCertificateDepth); + (*sr)->sCertificateDepth = NULL; + } if ((*sr)->clientAddress) { free((*sr)->clientAddress); (*sr)->clientAddress = NULL; @@ -313,6 +325,76 @@ ServerRealm_set_password(ServerRealm* sr, unsigned char* password) } /* + * Function name: ServerRealm_set_SslCtx + * Description: Set SSL context + * Arguments: sr - pointer to ServerRealm structure + * ctx - pointer to SSL_CTX object + */ +void +ServerRealm_set_SslCtx(ServerRealm* sr, SSL_CTX* ctx) +{ + assert(sr != NULL); + if (sr == NULL) { + return; + } + + sr->sslCtx = ctx; +} + +/* + * Function name: ServerRealm_set_cacertificateFile + * Description: Set CA certificate filename. + * Arguments: sr - pointer to ServerRealm structure + * certificateFile - CA certificate filename + */ + +void +ServerRealm_set_cacertificateFile(ServerRealm* sr, char* cacertificateFile) +{ + assert(sr != NULL); + if (sr == NULL) { + return; + } + string_cp(&(sr->cacertificateFile), cacertificateFile); +} + +/* + * Function name: ServerRealm_set_cacertificatePath + * Description: Set CA certificate filename. + * Arguments: sr - pointer to ServerRealm structure + * cacertificateFile - CA certificate path + */ + +void +ServerRealm_set_cacertificatePath(ServerRealm* sr, char* cacertificatePath) +{ + assert(sr != NULL); + if (sr == NULL) { + return; + } + string_cp(&(sr->cacertificatePath), cacertificatePath); +} + +void +ServerRealm_set_sCertificateDepth(ServerRealm* sr, char* sCertificateDepth) +{ + assert(sr != NULL); + if (sr == NULL) { + return; + } + string_cp(&(sr->sCertificateDepth), sCertificateDepth); +} +void +ServerRealm_set_certificateDepth(ServerRealm* sr, int certificateDepth) +{ + assert(sr != NULL); + if (sr == NULL) { + return; + } + sr->certificateDepth = certificateDepth; +} + +/* * Function name: ServerRealm_set_connectedUsers * Description: Set number of connected users. * Arguments: sr - pointer to ServerRealm structure @@ -935,6 +1017,77 @@ ServerRealm_get_password(ServerRealm* sr) } /* + * Function name: ServerRealm_get_SslCtx + * Description: Get SSL context + * Arguments: sr - pointer to ServerRealm structure + * Returns: pointer to SSL_CTX object + */ +SSL_CTX* +ServerRealm_get_SslCtx(ServerRealm* sr) +{ + assert(sr != NULL); + if (sr == NULL) { + return NULL; + } + + return sr->sslCtx; +} + +/* + * Function name: ServerRealm_get_cacertificateFile + * Description: Get CA certificate filename. + * Arguments: sc - pointer to ServerRealm structure + * Returns: CA Certificate filename. + */ + +char* +ServerRealm_get_cacertificateFile(ServerRealm* sr) +{ + assert(sr != NULL); + if (sr == NULL) { + return NULL; + } + return sr->cacertificateFile; +} + +/* + * Function name: ServerRealm_get_cacertificatePath + * Description: Get CA certificate path + * Arguments: sr - pointer to ServerRealm structure + * Returns: CA Certificate path. + */ + +char* +ServerRealm_get_cacertificatePath(ServerRealm* sr) +{ + assert(sr != NULL); + if (sr == NULL) { + return NULL; + } + return sr->cacertificatePath; +} + +char* +ServerRealm_get_sCertificateDepth(ServerRealm* sr) +{ + assert(sr != NULL); + if (sr == NULL) { + return NULL; + } + return sr->sCertificateDepth; +} + +int +ServerRealm_get_certificateDepth(ServerRealm* sr) +{ + assert(sr != NULL); + if (sr == NULL) { + return -1; + } + return sr->certificateDepth; +} + +/* * Function name: ServerRealm_get_connectedUsers * Description: Get number of connected users. * Arguments: sr - pointer to ServerRealm structure diff --git a/src/server_realm_struct.h b/src/server_realm_struct.h index e057c99..cbaa7e6 100644 --- a/src/server_realm_struct.h +++ b/src/server_realm_struct.h @@ -34,6 +34,11 @@ typedef struct { char* sMaxIdle; char* realmName; unsigned char password[4]; + SSL_CTX* sslCtx; + char* cacertificateFile; + char* cacertificatePath; + char* sCertificateDepth; + int certificateDepth; int connectedUsers; int usersLimit; int connectedClients; @@ -75,6 +80,11 @@ void ServerRealm_set_sTimeout(ServerRealm* sr, char* sTimeout); void ServerRealm_set_sMaxIdle(ServerRealm* sr, char* sMaxIdle); void ServerRealm_set_realmName(ServerRealm* sr, char* realmName); void ServerRealm_set_password(ServerRealm* sr, unsigned char* password); +void ServerRealm_set_SslCtx(ServerRealm* sr, SSL_CTX* ctx); +void ServerRealm_set_cacertificateFile(ServerRealm* sr, char* cacertificateFile); +void ServerRealm_set_cacertificatePath(ServerRealm* sr, char* cacertificatePath); +void ServerRealm_set_sCertificateDepth(ServerRealm* sr, char* sCertificateDepth); +void ServerRealm_set_certificateDepth(ServerRealm* sr, int certificateDepth); void ServerRealm_set_connectedUsers(ServerRealm* sr, int connectedUsers); void ServerRealm_set_usersLimit(ServerRealm* sr, int usersLimit); void ServerRealm_set_connectedClients(ServerRealm* sr, int connectedClients); @@ -110,6 +120,11 @@ char* ServerRealm_get_sTimeout(ServerRealm* sr); char* ServerRealm_get_sMaxIdle(ServerRealm* sr); char* ServerRealm_get_realmName(ServerRealm* sr); unsigned char* ServerRealm_get_password(ServerRealm* sr); +SSL_CTX* ServerRealm_get_SslCtx(ServerRealm* sr); +char* ServerRealm_get_cacertificateFile(ServerRealm* sr); +char* ServerRealm_get_cacertificatePath(ServerRealm* sr); +char* ServerRealm_get_sCertificateDepth(ServerRealm* sr); +int ServerRealm_get_certificateDepth(ServerRealm* sr); int ServerRealm_get_connectedUsers(ServerRealm* sr); int ServerRealm_get_usersLimit(ServerRealm* sr); int ServerRealm_get_connectedClients(ServerRealm* sr); |