15 #include "tlsopenssl.h"
28 :
TLSBase( th, server ), m_ssl( 0 ), m_ctx( 0 ), m_buf( 0 ), m_bufsize( 17000 )
30 m_buf = (
char*)calloc( m_bufsize + 1,
sizeof(
char ) );
34 SSL_COMP_add_compression_method( 193, COMP_zlib() );
36 m_ctx = SSL_CTX_new( SSLv23_client_method() );
40 if( !SSL_CTX_set_cipher_list( m_ctx,
"HIGH:MEDIUM:AES:@STRENGTH" ) )
43 m_ssl = SSL_new( m_ctx );
44 SSL_set_connect_state( m_ssl );
46 if( !BIO_new_bio_pair( &m_ibio, 0, &m_nbio, 0 ) )
50 SSL_set_bio( m_ssl, m_ibio, m_ibio );
51 SSL_set_mode( m_ssl, SSL_MODE_AUTO_RETRY | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER | SSL_MODE_ENABLE_PARTIAL_WRITE );
58 SSL_CTX_free( m_ctx );
59 SSL_shutdown( m_ssl );
75 doTLSOperation( TLSWrite );
89 doTLSOperation( TLSRead );
97 StringList::const_iterator it = m_cacerts.begin();
98 for( ; it != m_cacerts.end(); ++it )
99 SSL_CTX_load_verify_locations( m_ctx, (*it).c_str(), 0 );
104 m_clientKey = clientKey;
105 m_clientCerts = clientCerts;
107 if( !m_clientKey.empty() && !m_clientCerts.empty() )
109 SSL_CTX_use_certificate_chain_file( m_ctx, m_clientCerts.c_str() );
110 SSL_CTX_use_PrivateKey_file( m_ctx, m_clientKey.c_str(), SSL_FILETYPE_PEM );
120 void OpenSSL::doTLSOperation( TLSOperation op )
126 bool onceAgain =
false;
133 ret = SSL_connect( m_ssl );
136 ret = SSL_write( m_ssl, m_sendBuffer.c_str(), m_sendBuffer.length() );
139 ret = SSL_read( m_ssl, m_buf, m_bufsize );
143 switch( SSL_get_error( m_ssl, ret ) )
145 case SSL_ERROR_WANT_READ:
146 case SSL_ERROR_WANT_WRITE:
150 if( op == TLSHandshake )
152 else if( op == TLSWrite )
153 m_sendBuffer.erase( 0, ret );
154 else if( op == TLSRead )
164 if( !onceAgain && !m_recvBuffer.length() )
169 while( ( ( onceAgain || m_recvBuffer.length() ) && ( !m_secure || op == TLSRead ) )
170 || ( ( op == TLSWrite ) && ( ret > 0 ) ));
173 int OpenSSL::openSSLTime2UnixTime(
const char* time_string )
179 for(
int n = 0; n < 12; n += 2 )
181 tstring[m] = time_string[n];
182 tstring[m + 1] = time_string[n + 1];
189 time_st.tm_year = ( atoi( &tstring[3 * 0] ) >= 70 ) ? atoi( &tstring[3 * 0] )
190 : atoi( &tstring[3 * 0] ) + 100;
191 time_st.tm_mon = atoi( &tstring[3 * 1] ) - 1;
192 time_st.tm_mday = atoi( &tstring[3 * 2] );
193 time_st.tm_hour = atoi( &tstring[3 * 3] );
194 time_st.tm_min = atoi( &tstring[3 * 4] );
195 time_st.tm_sec = atoi( &tstring[3 * 5] );
197 time_t unixt = mktime( &time_st );
204 doTLSOperation( TLSHandshake );
209 int res = SSL_get_verify_result( m_ssl );
210 if( res != X509_V_OK )
215 X509 *peer = SSL_get_peer_certificate( m_ssl );
219 X509_NAME_get_text_by_NID( X509_get_issuer_name( peer ), NID_commonName, peer_CN,
sizeof( peer_CN ) );
220 m_certInfo.
issuer = peer_CN;
221 X509_NAME_get_text_by_NID( X509_get_subject_name( peer ), NID_commonName, peer_CN,
sizeof( peer_CN ) );
222 m_certInfo.
server = peer_CN;
223 m_certInfo.
date_from = openSSLTime2UnixTime( (
char*)(peer->cert_info->validity->notBefore->data) );
224 m_certInfo.
date_to = openSSLTime2UnixTime( (
char*)(peer->cert_info->validity->notAfter->data) );
227 std::transform( p.begin(), p.end(), p.begin(), tolower );
231 if( ASN1_UTCTIME_cmp_time_t( X509_get_notBefore( peer ), time( 0 ) ) != -1 )
234 if( ASN1_UTCTIME_cmp_time_t( X509_get_notAfter( peer ), time( 0 ) ) != 1 )
243 tmp = SSL_get_cipher_name( m_ssl );
247 tmp = SSL_get_cipher_version( m_ssl );
257 void OpenSSL::pushFunc()
264 while( ( wantwrite = BIO_ctrl_pending( m_nbio ) ) > 0 )
266 if( wantwrite > m_bufsize )
267 wantwrite = m_bufsize;
272 frombio = BIO_read( m_nbio, m_buf, wantwrite );
278 while( ( wantread = BIO_ctrl_get_read_request( m_nbio ) ) > 0 )
280 if( wantread > m_recvBuffer.length() )
281 wantread = m_recvBuffer.length();
286 tobio = BIO_write( m_nbio, m_recvBuffer.c_str(), wantread );
287 m_recvBuffer.erase( 0, tobio );
293 #endif // HAVE_OPENSSL