Provides HTTPS, when the OpenSSL library is available.
[the Webserver part]


Defines

#define CTDL_CRYPTO_DIR   "./keys"
#define CTDL_KEY_PATH   CTDL_CRYPTO_DIR "/citadel.key"
#define CTDL_CSR_PATH   CTDL_CRYPTO_DIR "/citadel.csr"
#define CTDL_CER_PATH   CTDL_CRYPTO_DIR "/citadel.cer"
#define SIGN_DAYS   365

Functions

void init_ssl (void)
 initialize ssl engine load certs and initialize openssl internals
int starttls (int sock)
 starts SSL/TLS encryption for the current session.
void endtls (void)
 shuts down the TLS connection
void ssl_lock (int mode, int n, const char *file, int line)
 callback for OpenSSL mutex locks
void client_write_ssl (char *buf, int nbytes)
 Send binary data to the client encrypted.
int client_read_ssl (char *buf, int bytes, int timeout)
 read data from the encrypted layer.

Variables

SSL_CTX * ssl_ctx
pthread_mutex_t ** SSLCritters
pthread_key_t ThreadSSL

Define Documentation

#define CTDL_CRYPTO_DIR   "./keys"

where to find the keys

Definition at line 17 of file crypto.c.

Referenced by init_ssl().

#define CTDL_KEY_PATH   CTDL_CRYPTO_DIR "/citadel.key"

the key

Definition at line 18 of file crypto.c.

Referenced by init_ssl().

#define CTDL_CSR_PATH   CTDL_CRYPTO_DIR "/citadel.csr"

the csr file

Definition at line 19 of file crypto.c.

Referenced by init_ssl().

#define CTDL_CER_PATH   CTDL_CRYPTO_DIR "/citadel.cer"

the cer file

Definition at line 20 of file crypto.c.

Referenced by init_ssl().

#define SIGN_DAYS   365

how long our certificate should live

Definition at line 21 of file crypto.c.

Referenced by init_ssl().


Function Documentation

void init_ssl ( void   ) 

initialize ssl engine load certs and initialize openssl internals

Nothing's been initialized, just die

Initialize SSL transport layer

Get our certificates in order.

Todo:
dirify. this is a setup job. First, create the key/cert directory if it's not there already...

Before attempting to generate keys/certificates, first try link to them from the Citadel server if it's on the same host. We ignore any error return because it either meant that there was nothing in Citadel to link from (in which case we just generate new files) or the target files already exist (which is not fatal either).

Todo:
dirify

If we still don't have a private key, generate one.

< modulus size

< exponent

< no callback

< no callback

< the file

< the key

< no enc

< no passphr

< no passphr

< no callbk

< no callbk

Generate a CSR if we don't have one.

Read our key from the file. No, we don't just keep this in memory from the above key-generation function, because there is the possibility that the key was already on disk and we didn't just generate it now.

Create a public key from the private key

Set the public key

Tell it who we are

Sign the CSR

Write it to disk.

Generate a self-signed certificate if we don't have one.

Same deal as before: always read the key from disk because it may or may not have just been generated.

This also holds true for the CSR.

Sign the cert

Write it to disk.

Now try to bind to the key and certificate. Note that we use SSL_CTX_use_certificate_chain_file() which allows the certificate file to contain intermediate certificates.

Definition at line 41 of file crypto.c.

References CTDL_CER_PATH, CTDL_CRYPTO_DIR, CTDL_CSR_PATH, CTDL_KEY_PATH, ctdlhost, ctdlport, lprintf(), SIGN_DAYS, ssl_ctx, ssl_lock(), and SSLCritters.

Referenced by main().

int starttls ( int  sock  ) 

starts SSL/TLS encryption for the current session.

Parameters:
sock the socket connection
Returns:
Zero if the SSL/TLS handshake succeeded, non-zero otherwise.

Can't notify the client of an error here; they will discover the problem at the SSL layer and should revert to unencrypted communications.

Definition at line 322 of file crypto.c.

References lprintf(), ssl_ctx, and ThreadSSL.

Referenced by worker_entry().

void endtls ( void   ) 

shuts down the TLS connection

WARNING: This may make your session vulnerable to a known plaintext attack in the current implmentation.

I don't think this is needed, and it crashes the server anyway

if (ctx != NULL) { lprintf(9, "Freeing CTX at %x\n", (int)ctx ); SSL_CTX_free(ctx); }

Definition at line 379 of file crypto.c.

References lprintf(), and ThreadSSL.

Referenced by client_read_ssl(), client_write_ssl(), and worker_entry().

void ssl_lock ( int  mode,
int  n,
const char *  file,
int  line 
)

callback for OpenSSL mutex locks

Parameters:
mode which mode??????
n how many???
file which filename ???
line what line????

Definition at line 409 of file crypto.c.

References SSLCritters.

Referenced by init_ssl().

void client_write_ssl ( char *  buf,
int  nbytes 
)

Send binary data to the client encrypted.

Parameters:
buf chars to send to the client
nbytes how many chars

Definition at line 422 of file crypto.c.

References endtls(), and lprintf().

Referenced by client_write().

int client_read_ssl ( char *  buf,
int  bytes,
int  timeout 
)

read data from the encrypted layer.

Parameters:
buf charbuffer to read to
bytes how many
timeout how long should we wait?
Returns:
what???

Definition at line 468 of file crypto.c.

References endtls(), and lprintf().

Referenced by client_read_to().


Variable Documentation

SSL_CTX* ssl_ctx

SSL context

Definition at line 23 of file crypto.c.

Referenced by init_ssl(), and starttls().

pthread_mutex_t** SSLCritters

Things needing locking

Definition at line 24 of file crypto.c.

Referenced by init_ssl(), and ssl_lock().

pthread_key_t ThreadSSL

Per-thread SSL context

Definition at line 26 of file crypto.c.

Referenced by endtls(), main(), and starttls().


Generated on Wed Jun 20 23:13:12 2007 for webcit by  doxygen 1.5.2