Defines | |
#define | CTDL_CRYPTO_DIR "./keys" |
#define | CTDL_KEY_PATH CTDL_CRYPTO_DIR "/citadel.key" |
#define | CTDL_CSR_PATH CTDL_CRYPTO_DIR "/citadel.csr" |
#define | CTDL_CER_PATH CTDL_CRYPTO_DIR "/citadel.cer" |
#define | SIGN_DAYS 365 |
Functions | |
void | init_ssl (void) |
initialize ssl engine load certs and initialize openssl internals | |
int | starttls (int sock) |
starts SSL/TLS encryption for the current session. | |
void | endtls (void) |
shuts down the TLS connection | |
void | ssl_lock (int mode, int n, const char *file, int line) |
callback for OpenSSL mutex locks | |
void | client_write_ssl (char *buf, int nbytes) |
Send binary data to the client encrypted. | |
int | client_read_ssl (char *buf, int bytes, int timeout) |
read data from the encrypted layer. | |
Variables | |
SSL_CTX * | ssl_ctx |
pthread_mutex_t ** | SSLCritters |
pthread_key_t | ThreadSSL |
#define CTDL_CRYPTO_DIR "./keys" |
#define CTDL_KEY_PATH CTDL_CRYPTO_DIR "/citadel.key" |
#define CTDL_CSR_PATH CTDL_CRYPTO_DIR "/citadel.csr" |
#define CTDL_CER_PATH CTDL_CRYPTO_DIR "/citadel.cer" |
#define SIGN_DAYS 365 |
how long our certificate should live
Definition at line 21 of file crypto.c.
Referenced by init_ssl().
void init_ssl | ( | void | ) |
initialize ssl engine load certs and initialize openssl internals
Nothing's been initialized, just die
Initialize SSL transport layer
Get our certificates in order.
Before attempting to generate keys/certificates, first try link to them from the Citadel server if it's on the same host. We ignore any error return because it either meant that there was nothing in Citadel to link from (in which case we just generate new files) or the target files already exist (which is not fatal either).
If we still don't have a private key, generate one.
< modulus size
< exponent
< no callback
< no callback
< the file
< the key
< no enc
< no passphr
< no passphr
< no callbk
< no callbk
Generate a CSR if we don't have one.
Read our key from the file. No, we don't just keep this in memory from the above key-generation function, because there is the possibility that the key was already on disk and we didn't just generate it now.
Create a public key from the private key
Set the public key
Tell it who we are
Sign the CSR
Write it to disk.
Generate a self-signed certificate if we don't have one.
Same deal as before: always read the key from disk because it may or may not have just been generated.
This also holds true for the CSR.
Sign the cert
Write it to disk.
Now try to bind to the key and certificate. Note that we use SSL_CTX_use_certificate_chain_file() which allows the certificate file to contain intermediate certificates.
Definition at line 41 of file crypto.c.
References CTDL_CER_PATH, CTDL_CRYPTO_DIR, CTDL_CSR_PATH, CTDL_KEY_PATH, ctdlhost, ctdlport, lprintf(), SIGN_DAYS, ssl_ctx, ssl_lock(), and SSLCritters.
Referenced by main().
int starttls | ( | int | sock | ) |
starts SSL/TLS encryption for the current session.
sock | the socket connection |
Can't notify the client of an error here; they will discover the problem at the SSL layer and should revert to unencrypted communications.
Definition at line 322 of file crypto.c.
References lprintf(), ssl_ctx, and ThreadSSL.
Referenced by worker_entry().
void endtls | ( | void | ) |
shuts down the TLS connection
WARNING: This may make your session vulnerable to a known plaintext attack in the current implmentation.
I don't think this is needed, and it crashes the server anyway
if (ctx != NULL) { lprintf(9, "Freeing CTX at %x\n", (int)ctx ); SSL_CTX_free(ctx); }
Definition at line 379 of file crypto.c.
References lprintf(), and ThreadSSL.
Referenced by client_read_ssl(), client_write_ssl(), and worker_entry().
void ssl_lock | ( | int | mode, | |
int | n, | |||
const char * | file, | |||
int | line | |||
) |
callback for OpenSSL mutex locks
mode | which mode?????? | |
n | how many??? | |
file | which filename ??? | |
line | what line???? |
Definition at line 409 of file crypto.c.
References SSLCritters.
Referenced by init_ssl().
void client_write_ssl | ( | char * | buf, | |
int | nbytes | |||
) |
Send binary data to the client encrypted.
buf | chars to send to the client | |
nbytes | how many chars |
Definition at line 422 of file crypto.c.
References endtls(), and lprintf().
Referenced by client_write().
int client_read_ssl | ( | char * | buf, | |
int | bytes, | |||
int | timeout | |||
) |
read data from the encrypted layer.
buf | charbuffer to read to | |
bytes | how many | |
timeout | how long should we wait? |
Definition at line 468 of file crypto.c.
References endtls(), and lprintf().
Referenced by client_read_to().
SSL_CTX* ssl_ctx |
pthread_mutex_t** SSLCritters |
Things needing locking
Definition at line 24 of file crypto.c.
Referenced by init_ssl(), and ssl_lock().
pthread_key_t ThreadSSL |
Per-thread SSL context
Definition at line 26 of file crypto.c.
Referenced by endtls(), main(), and starttls().