XrdCryptosslAux.cc File Reference

#include <ctime>
#include <cerrno>
#include <cstdlib>
#include <sys/types.h>
#include <sys/stat.h>
#include "XrdCrypto/XrdCryptoX509Chain.hh"
#include "XrdCrypto/XrdCryptosslAux.hh"
#include "XrdCrypto/XrdCryptosslRSA.hh"
#include "XrdCrypto/XrdCryptosslX509.hh"
#include "XrdCrypto/XrdCryptosslTrace.hh"
#include "XrdTls/XrdTlsPeerCerts.hh"
#include <openssl/pem.h>

Include dependency graph for XrdCryptosslAux.cc:

Go to the source code of this file.

Functions
time_t	XrdCryptosslASN1toUTC (const ASN1_TIME *tsn1)
int	XrdCryptosslKDFun (const char *pass, int plen, const char *salt, int slen, char *key, int klen)
int	XrdCryptosslKDFunLen ()
void	XrdCryptosslNameOneLine (X509_NAME *nm, XrdOucString &s)
int	XrdCryptosslX509ChainToFile (XrdCryptoX509Chain *ch, const char *fn)
XrdSutBucket *	XrdCryptosslX509ExportChain (XrdCryptoX509Chain *chain, bool withprivatekey)
int	XrdCryptosslX509ParseBucket (XrdSutBucket *b, XrdCryptoX509Chain *chain)
int	XrdCryptosslX509ParseFile (const char *fname, XrdCryptoX509Chain *chain, const char *fkey)
int	XrdCryptosslX509ParseFile (FILE *fcer, XrdCryptoX509Chain *chain, const char *fname, const char *fkey)
int	XrdCryptosslX509ParseStack (XrdTlsPeerCerts *pc, XrdCryptoX509Chain *chain)
int	XrdCryptosslX509ToFile (XrdCryptoX509 *x509, FILE *file, const char *fname)
int	XrdCryptosslX509VerifyCB (int ok, X509_STORE_CTX *ctx)
bool	XrdCryptosslX509VerifyCert (XrdCryptoX509 *cert, XrdCryptoX509 *ref)
bool	XrdCryptosslX509VerifyChain (XrdCryptoX509Chain *chain, int &errcode)

Variables
static int	gErrVerifyChain = 0
XrdOucTrace *	sslTrace = 0

Function Documentation

XrdCryptosslASN1toUTC()

time_t XrdCryptosslASN1toUTC

(

const ASN1_TIME *

tsn1

)

Definition at line 675 of file XrdCryptosslAux.cc.

{
   // Function to convert from ASN1 time format into UTC
   // since Epoch (Jan 1, 1970) 
   // Return -1 if something went wrong
   time_t etime = -1;
// EPNAME("ASN1toUTC");
 
   //
   // Make sure there is something to convert
   if (!tsn1) return etime;
 
   //
   // Parse the input string: here we basically cut&paste from GRIDSITE
   // They finally use timegm to convert to UTC seconds, which is less
   // standard and seems to give an offset of 3600 secs.
   // Our result is in agreement with 'date +%s`. 
   struct tm ltm;
   char zz;
   if ((sscanf((const char *)(tsn1->data),
       "%02d%02d%02d%02d%02d%02d%c", 
       &(ltm.tm_year), &(ltm.tm_mon), &(ltm.tm_mday),
       &(ltm.tm_hour), &(ltm.tm_min), &(ltm.tm_sec),
                                      &zz) != 7) || (zz != 'Z')) {
       // Try GeneralizedTime
       if ((sscanf((const char *)(tsn1->data),
           "%04d%02d%02d%02d%02d%02d%c", 
           &(ltm.tm_year), &(ltm.tm_mon), &(ltm.tm_mday),
           &(ltm.tm_hour), &(ltm.tm_min), &(ltm.tm_sec),
                                          &zz) != 7) || (zz != 'Z')) {
           return -1;
       }
   }
   // Init also the ones not used by mktime
   ltm.tm_wday  = 0;        // day of the week 
   ltm.tm_yday  = 0;        // day in the year
   ltm.tm_isdst = 0;        // we will correct with an offset without dst
   //
   // Renormalize some values (year should be modulo 1900), honouring all cases
   if (ltm.tm_year < 50) {
      ltm.tm_year += 2000;
   } else if (ltm.tm_year < 100) {
      ltm.tm_year += 1900;
   }
   ltm.tm_year -= 1900;
   //
   // month should in [0, 11]
   (ltm.tm_mon)--;
   //
   // Calculate as if the UTC stamp was a localtime with no dst
   etime = mktime(&ltm);
   // Correct to UTC
   etime += XrdCryptoTZCorr();
   // Notify, if requested
// DEBUG(" UTC: "<<etime<<"  isdst: "<<ltm.tm_isdst);
   //
   // We are done
   return etime;
} 

References XrdCryptoTZCorr().

Referenced by XrdCryptosslX509Crl::LastUpdate(), XrdCryptosslX509Crl::NextUpdate(), XrdCryptosslX509::NotAfter(), and XrdCryptosslX509::NotBefore().

Here is the call graph for this function:

Here is the caller graph for this function:

XrdCryptosslKDFun()

int XrdCryptosslKDFun	(	const char *	pass,
		int	plen,
		const char *	salt,
		int	slen,
		char *	key,
		int	klen )

Definition at line 78 of file XrdCryptosslAux.cc.

{
   // Password-Based Key Derivation Function 2, specified in PKCS #5
   // Following (J.Viega, M.Messier, "Secure programming Cookbook", p.141),
   // the default number of iterations is set to 10000 .
   // It can be specified at the beginning of the salt using a construct
   // like this: salt = "$$<number_of_iterations>$<effective_salt>"
  
   klen = (klen <= 0) ? 24 : klen;
 
   // Defaults
   char *realsalt = (char *)salt;
   int realslen = slen;
   int it = 10000;
   //
   // Extract iteration number from salt, if any
   char *ibeg = (char *)memchr(salt+1,'$',slen-1);
   if (ibeg) {
      char *del = 0;
      int newit = strtol(ibeg+1, &del, 10);
      if (newit > 0 && del[0] == '$' && errno != ERANGE) {
         // found iteration number
         it = newit;
         realsalt = del+1;
         realslen = slen - (int)(realsalt-salt);
      }
   }
 
   PKCS5_PBKDF2_HMAC_SHA1(pass, plen,
                         (unsigned char *)realsalt, realslen, it,
                          klen, (unsigned char *)key);
   return klen;
}

Referenced by XrdCryptosslFactory::KDFun().

Here is the caller graph for this function:

XrdCryptosslKDFunLen()

int XrdCryptosslKDFunLen

(

)

Definition at line 71 of file XrdCryptosslAux.cc.

{
   // default buffer length
   return kSslKDFunDefLen;
}

References kSslKDFunDefLen.

Referenced by XrdCryptosslFactory::KDFunLen().

Here is the caller graph for this function:

XrdCryptosslNameOneLine()

void XrdCryptosslNameOneLine	(	X509_NAME *	nm,
		XrdOucString &	s )

Definition at line 736 of file XrdCryptosslAux.cc.

{
   // Function to convert X509_NAME into a one-line human readable string
 
#ifndef USEX509NAMEONELINE
   BIO *mbio = BIO_new(BIO_s_mem());
   X509_NAME_print_ex(mbio, nm, 0, XN_FLAG_SEP_MULTILINE);
   char *data = 0;
   long len = BIO_get_mem_data(mbio, &data);
   s = "/";
   s.insert(data, 1, len);
   BIO_free(mbio);
   s.replace("\n", "/");
#else
   char *xn = X509_NAME_oneline(nm, 0, 0);
   s = xn;
   OPENSSL_free(xn);
#endif
 
   // Done
   return;
}

References XrdOucString::insert(), and XrdOucString::replace().

Referenced by XrdCryptosslX509::Issuer(), XrdCryptosslX509Crl::Issuer(), XrdCryptosslX509::Subject(), and XrdCryptosslX509Req::Subject().

Here is the call graph for this function:

Here is the caller graph for this function:

XrdCryptosslX509ChainToFile()

int XrdCryptosslX509ChainToFile	(	XrdCryptoX509Chain *	ch,
		const char *	fn )

Definition at line 307 of file XrdCryptosslAux.cc.

{
   // Dump non-CA content of chain 'c' into file 'fn'
   EPNAME("X509ChainToFile");
 
   // Check inputs
   if (!ch || !fn) {
      DEBUG("Invalid inputs");
      return -1;
   }
 
   // We proceed only if we can lock for write
   FILE *fp = fopen(fn,"w");
   if (!fp) {
      DEBUG("cannot open file to save chain (file: "<<fn<<")"); 
      return -1;
   }
   int ifp = fileno(fp);
   if (ifp == -1) {
      DEBUG("got invalid file descriptor (file: "<<fn<<")"); 
      fclose(fp);
      return -1;
   }
 
   // We need to lock from now on
   {  XrdSutFileLocker fl(ifp,XrdSutFileLocker::kExcl);
 
      // If not successful, return
      if (!fl.IsValid()) { 
         DEBUG("could not lock file: "<<fn<<")"); 
         fclose(fp);
         return -1;
      }
 
      // Set permissions to 0600
      if (fchmod(ifp, 0600) == -1) {
         DEBUG("cannot set permissions on file: "<<fn<<" (errno: "<<errno<<")"); 
         fclose(fp);
         return -1;
      }
 
      // Reorder the chain
      ch->Reorder();
 
      // Write the last cert first
      XrdCryptoX509 *c = ch->End();
      if (PEM_write_X509(fp, (X509 *)c->Opaque()) != 1) {
         DEBUG("error while writing proxy certificate"); 
         fclose(fp);
         return -1;
      }
      // Write its private key, if any
      XrdCryptoRSA *k = c->PKI();
      if (k->status == XrdCryptoRSA::kComplete) {
         if (PEM_write_PrivateKey(fp, (EVP_PKEY *)(k->Opaque()),
                                  0, 0, 0, 0, 0) != 1) {
            DEBUG("error while writing proxy private key"); 
            fclose(fp);
            return -1;
         }
      }
      // Now write all other certificates
      while ((c = ch->SearchBySubject(c->Issuer())) && c->type != XrdCryptoX509::kCA) {
         // Write to file
         if (PEM_write_X509(fp, (X509 *)c->Opaque()) != 1) {
            DEBUG("error while writing proxy certificate"); 
            fclose(fp);
            return -1;
         }
      }
   } // Unlocks the file
 
   // CLose the file
   fclose(fp);
   //
   // We are done
   return 0;
}

References DEBUG, XrdCryptoX509Chain::End(), EPNAME, fclose(), fopen, XrdCryptoX509::Issuer(), XrdSutFileLocker::IsValid(), XrdCryptoX509::kCA, XrdCryptoRSA::kComplete, XrdSutFileLocker::kExcl, XrdCryptoRSA::Opaque(), XrdCryptoX509::Opaque(), XrdCryptoX509::PKI(), XrdCryptoX509Chain::Reorder(), XrdCryptoX509Chain::SearchBySubject(), XrdCryptoRSA::status, and XrdCryptoX509::type.

Referenced by XrdCryptosslFactory::X509ChainToFile().

Here is the call graph for this function:

Here is the caller graph for this function:

XrdCryptosslX509ExportChain()

XrdSutBucket * XrdCryptosslX509ExportChain	(	XrdCryptoX509Chain *	chain,
		bool	withprivatekey )

Definition at line 194 of file XrdCryptosslAux.cc.

{
   // Export non-CA content of 'chain' into a bucket for transfer.
   EPNAME("X509ExportChain");
   XrdSutBucket *bck = 0;
 
   // Make sure we got something to export
   if (!chain || chain->Size() <= 0) {
      DEBUG("chain undefined or empty: nothing to export");
      return bck;
   }
 
   // Do not export CA selfsigned certificates
   if (chain->Size() == 1 && chain->Begin()->type == XrdCryptoX509::kCA &&
       !strcmp(chain->Begin()->IssuerHash(),chain->Begin()->SubjectHash())) {
      DEBUG("chain contains only a CA certificate: nothing to export");
      return bck;
   }
 
   // Now we create a bio_mem to serialize the certificates
   BIO *bmem = BIO_new(BIO_s_mem());
   if (!bmem) {
      DEBUG("unable to create BIO for memory operations");
      return bck;
   }
 
   // Reorder the chain
   chain->Reorder();
 
   // Write the last cert first
   XrdCryptoX509 *c = chain->End();
   if (!PEM_write_bio_X509(bmem, (X509 *)c->Opaque())) {
      DEBUG("error while writing proxy certificate"); 
      BIO_free(bmem);
      return bck;
   }
   // Write its private key, if any and if asked
   if (withprivatekey) {
      XrdCryptoRSA *k = c->PKI();
      if (k->status == XrdCryptoRSA::kComplete) {
         if (!PEM_write_bio_PrivateKey(bmem, (EVP_PKEY *)(k->Opaque()),
                                  0, 0, 0, 0, 0)) {
            DEBUG("error while writing proxy private key"); 
            BIO_free(bmem);
            return bck;
         }
      }
   }
   // Now write all other certificates (except selfsigned CAs ...)
   while ((c = chain->SearchBySubject(c->Issuer()))) {
      if (c->type == XrdCryptoX509::kCA) {
         DEBUG("Encountered CA in chain; breaking.  Subject: " << c->Subject());
         break;
      }
      if (strcmp(c->IssuerHash(), c->SubjectHash())) {
         // Write to bucket
         if (!PEM_write_bio_X509(bmem, (X509 *)c->Opaque())) {
            DEBUG("error while writing proxy certificate"); 
            BIO_free(bmem);
            return bck;
         }
      } else {
         DEBUG("Encountered self-signed CA in chain; breaking.  Subject: " << c->Subject());
         break;
      }
   }
 
   // Extract pointer to BIO data and length of segment
   char *bdata = 0;  
   int blen = BIO_get_mem_data(bmem, &bdata);
   DEBUG("BIO data: "<<blen<<" bytes at 0x"<<(int *)bdata);
 
   // create the bucket now
   bck = new XrdSutBucket(0, 0, kXRS_x509);
   if (bck) {
      // Fill bucket
      bck->SetBuf(bdata, blen);
      DEBUG("result of serialization: "<<bck->size<<" bytes");
   } else {
      DEBUG("unable to create bucket for serialized format");
      BIO_free(bmem);
      return bck;
   }
   //
   // Free BIO
   BIO_free(bmem);
   //
   // We are done
   return bck;
}

References XrdCryptoX509Chain::Begin(), DEBUG, XrdCryptoX509Chain::End(), EPNAME, XrdCryptoX509::Issuer(), XrdCryptoX509::IssuerHash(), XrdCryptoX509::kCA, XrdCryptoRSA::kComplete, kXRS_x509, XrdCryptoRSA::Opaque(), XrdCryptoX509::Opaque(), XrdCryptoX509::PKI(), XrdCryptoX509Chain::Reorder(), XrdCryptoX509Chain::SearchBySubject(), XrdSutBucket::SetBuf(), XrdCryptoX509Chain::Size(), XrdSutBucket::size, XrdCryptoRSA::status, XrdCryptoX509::Subject(), XrdCryptoX509::SubjectHash(), and XrdCryptoX509::type.

Referenced by XrdCryptosslFactory::X509ExportChain().

Here is the call graph for this function:

Here is the caller graph for this function:

XrdCryptosslX509ParseBucket()

int XrdCryptosslX509ParseBucket	(	XrdSutBucket *	b,
		XrdCryptoX509Chain *	chain )

Definition at line 567 of file XrdCryptosslAux.cc.

{
   // Import certificate(s) from bucket b adding them to 'chain'
   // (which must be initialized by the caller).
   EPNAME("X509ParseBucket");
   int nci = 0;
 
   // Make sure we got something to import
   if (!b || b->size <= 0) {
      DEBUG("bucket undefined or empty: can do nothing");
      return nci;
   }
 
   // Make sure we got a chain where to add the certificates
   if (!chain) {
      DEBUG("chain undefined: can do nothing");
      return nci;
   }
   //
   // Now we create a bio_mem to store the certificates
   BIO *bmem = BIO_new(BIO_s_mem());
   if (!bmem) {
      DEBUG("unable to create BIO to import certificates");
      return nci;
   }
 
   // Write data to BIO
   if (BIO_write(bmem,(const void *)(b->buffer),b->size) != b->size) {
      DEBUG("problems writing data to BIO");
      BIO_free(bmem);
      return nci;
   }
 
   // Get certificates from BIO
   X509 *xcer = 0;
   while (PEM_read_bio_X509(bmem, &xcer, 0, 0)) {
      //
      // Create container and add to the list
      XrdCryptoX509 *c = new XrdCryptosslX509(xcer);
      if (c) {
         chain->PushBack(c);
         nci++;
         DEBUG("certificate added to the chain - ord: "<<chain->Size());
      } else {
         DEBUG("could not create certificate: memory exhausted?");
         BIO_free(bmem);
         return nci;
      }
      // reset cert otherwise the next one is not fetched
      xcer = 0;
   }
 
   // If we found something, and we are asked to extract a key,
   // refill the BIO and search again for the key (this is mandatory
   // as read operations modify the BIO contents; a read-only BIO
   // may be more efficient)
   if (nci && BIO_write(bmem,(const void *)(b->buffer),b->size) == b->size) {
      EVP_PKEY *rsa = 0;
      if (!PEM_read_bio_PrivateKey(bmem, &rsa, 0, 0)) {
         DEBUG("no RSA private key found in bucket");
      } else {
         DEBUG("found a RSA private key in bucket");
         // We need to complete the key
         // check all the public keys of the loaded certificates
         if (rsa) {
            // Loop over the chain certificates
            XrdCryptoX509 *cert = chain->Begin();
            while (cert && cert->Opaque()) {
               if (cert->type != XrdCryptoX509::kCA) {
                  // Get the public key
                  EVP_PKEY *evpp = X509_get_pubkey((X509 *)(cert->Opaque()));
                  if (evpp) {
                        // Test consistency
#if OPENSSL_VERSION_NUMBER < 0x30000000L
                        int rc = EVP_PKEY_cmp(evpp, rsa);
#else
                        int rc = EVP_PKEY_eq(evpp, rsa);
#endif
                        EVP_PKEY_free(evpp);
                        if (rc == 1) {
                           // Update PKI in certificate; also tests if the key is complete
                           cert->SetPKI((XrdCryptoX509data)rsa);
                           if (cert->PKI()->status == XrdCryptoRSA::kComplete) {
                              DEBUG("RSA key completed");
                              break;
                           }
                        }
                  }
               }
               // Get next
               cert = chain->Next();
            }
            if (!cert)
               EVP_PKEY_free(rsa);
         }
         else
            EVP_PKEY_free(rsa);
      }
   }
 
   // Cleanup
   BIO_free(bmem);
 
   // We are done
   return nci;
}

References XrdCryptoX509Chain::Begin(), XrdSutBucket::buffer, DEBUG, EPNAME, XrdCryptoX509::kCA, XrdCryptoRSA::kComplete, XrdCryptoX509Chain::Next(), XrdCryptoX509::Opaque(), XrdCryptoX509::PKI(), XrdCryptoX509Chain::PushBack(), XrdCryptoX509::SetPKI(), XrdCryptoX509Chain::Size(), XrdSutBucket::size, XrdCryptoRSA::status, and XrdCryptoX509::type.

Referenced by XrdCryptosslFactory::X509ParseBucket(), and XrdSecgsiAuthzKey().

Here is the call graph for this function:

Here is the caller graph for this function:

XrdCryptosslX509ParseFile() [1/2]

int XrdCryptosslX509ParseFile	(	const char *	fname,
		XrdCryptoX509Chain *	chain,
		const char *	fkey )

Definition at line 436 of file XrdCryptosslAux.cc.

{
   EPNAME("X509ParseFile");
 
   //
   // Open file and read the content:
   // it should contain blocks on information in PEM form
   FILE *fcer = fopen(fname, "r");
   if (!fcer) {
      DEBUG("unable to open file (errno: "<<errno<<")");
      return 0;
   }
 
   auto retval = XrdCryptosslX509ParseFile(fcer, chain, fname, fkey);
   fclose(fcer);
   return retval;
}

References DEBUG, EPNAME, fclose(), fopen, and XrdCryptosslX509ParseFile().

Referenced by XrdCryptosslFactory::X509ParseFile(), and XrdCryptosslX509ParseFile().

Here is the call graph for this function:

Here is the caller graph for this function:

XrdCryptosslX509ParseFile() [2/2]

int XrdCryptosslX509ParseFile	(	FILE *	fcer,
		XrdCryptoX509Chain *	chain,
		const char *	fname,
		const char *	fkey )

Definition at line 456 of file XrdCryptosslAux.cc.

{
   // Parse content of file 'fname' and add X509 certificates to
   // chain (which must be initialized by the caller).
   // If a private key matching the public key of one of the certificates
   // is found in the file, the certificate key is completed.
   EPNAME("X509ParseFile");
   int nci = 0;
 
   // Make sure we got a valid file
   if (!fcer) {
      DEBUG("FILE object undefined: can do nothing");
      return nci;
   }
 
   // Make sure we got a chain where to add the certificates
   if (!chain) {
      DEBUG("chain undefined: can do nothing");
      return nci;
   }
 
   // Now read out certificates and add them to the chain
   X509 *xcer = 0;
   while (PEM_read_X509(fcer, &xcer, 0, 0)) {
      // Add it to the chain
      XrdCryptoX509 *c = new XrdCryptosslX509(xcer);
      if (c) {
         chain->PushBack(c);
         nci++;
         DEBUG("certificate for '"<<c->Subject()<<"'added to the chain - ord: "<<chain->Size());
      } else {
         DEBUG("could not create certificate: memory exhausted?");
         fclose(fcer);
         return nci;
      }
      xcer = 0;
   }
 
   // If we found something, and we are asked to extract a key,
   // rewind and look for it
   if (nci) {
      FILE *fcersave = 0;
      if (!fkey) {
         // Look in the same file, after rewinding
         rewind(fcer);
      } else {
         // We can close the file now
         fcersave = fcer;
         // Open key file
         fcer = fopen(fkey, "r");
         if (!fcer) {
           DEBUG("unable to open key file (errno: "<<errno<<")");
           fcer = fcersave;
           return nci;
         }
      }
      EVP_PKEY *rsa = 0;
      if (!PEM_read_PrivateKey(fcer, &rsa, 0, 0)) {
         DEBUG("no RSA private key found in file " << fname);
      } else {
         DEBUG("found a RSA private key in file " << fname);
         // We need to complete the key
         // check all the public keys of the loaded certificates
         if (rsa) {
            // Loop over the chain certificates
            XrdCryptoX509 *cert = chain->Begin();
            while (cert && cert->Opaque()) {
               if (cert->type != XrdCryptoX509::kCA) {
                  // Get the public key
                  EVP_PKEY *evpp = X509_get_pubkey((X509 *)(cert->Opaque()));
                  if (evpp) {
                        // Test consistency
#if OPENSSL_VERSION_NUMBER < 0x30000000L
                        int rc = EVP_PKEY_cmp(evpp, rsa);
#else
                        int rc = EVP_PKEY_eq(evpp, rsa);
#endif
                        EVP_PKEY_free(evpp);
                        if (rc == 1) {
                           // Update PKI in certificate; also tests if the key is complete
                           cert->SetPKI((XrdCryptoX509data)rsa);
                           if (cert->PKI()->status == XrdCryptoRSA::kComplete) {
                              DEBUG("RSA key completed");
                              break;
                           }
                        }
                  }
               }
               // Get next
               cert = chain->Next();
            }
            if (!cert)
               EVP_PKEY_free(rsa);
         }
         else
            EVP_PKEY_free(rsa);
      }
      if (fkey) {
         // Re-establish original fcer pointer
         fclose(fcer);
         fcer = fcersave;
      }
   }
 
   // We are done
   return nci;
}

References XrdCryptoX509Chain::Begin(), DEBUG, EPNAME, fclose(), fopen, XrdCryptoX509::kCA, XrdCryptoRSA::kComplete, XrdCryptoX509Chain::Next(), XrdCryptoX509::Opaque(), XrdCryptoX509::PKI(), XrdCryptoX509Chain::PushBack(), XrdCryptoX509::SetPKI(), XrdCryptoX509Chain::Size(), XrdCryptoRSA::status, XrdCryptoX509::Subject(), and XrdCryptoX509::type.

Here is the call graph for this function:

XrdCryptosslX509ParseStack()

int XrdCryptosslX509ParseStack	(	XrdTlsPeerCerts *	pc,
		XrdCryptoX509Chain *	chain )

Definition at line 387 of file XrdCryptosslAux.cc.

{
   EPNAME("X509ParseStack");
   int nci = 0;
   // Make sure we got a chain where to add the certificates
   if (!chain) {
      DEBUG("chain undefined: can do nothing");
      return nci;
   }
 
   if (pc->hasCert()) {
     XrdCryptoX509 *c = new XrdCryptosslX509(pc->getCert());
 
     if (c) {
       chain->PushBack(c);
       nci ++;
     }
   }
 
   if (!pc->hasChain()) {
     return nci;
   }
 
   STACK_OF(X509) *pChain = pc->getChain();
 
   for (int i=0; i < sk_X509_num(pChain); i++) {
      X509 *cert = sk_X509_value(pChain, i);
      XrdCryptoX509 *c = new XrdCryptosslX509(cert);
 
      if (c) {
         // The SSL_get_peer_chain method does not increment the
         // refcount; the XrdCryptoX509 object assumes it owns
         // the X509* but also does not increment the refcount.
         // Hence, we increment manually.
         X509_up_ref(cert);
         chain->PushBack(c);
      } else {
         X509_free(cert);
         DEBUG("could not create certificate: memory exhausted?");
         chain->Reorder();
         return nci;
      }
      nci ++;
   }
   chain->Reorder();
   return nci;
}

References DEBUG, EPNAME, XrdTlsPeerCerts::getCert(), XrdTlsPeerCerts::hasCert(), XrdTlsPeerCerts::hasChain(), XrdCryptoX509Chain::PushBack(), and XrdCryptoX509Chain::Reorder().

Referenced by XrdCryptosslFactory::X509ParseStack().

Here is the call graph for this function:

Here is the caller graph for this function:

XrdCryptosslX509ToFile()

int XrdCryptosslX509ToFile	(	XrdCryptoX509 *	x509,
		FILE *	file,
		const char *	fname )

Definition at line 287 of file XrdCryptosslAux.cc.

{
   // Dump a single X509 certificate to a file in PEM format.
   EPNAME("X509ChainToFile");
 
   // Check inputs
   if (!x509 || !file) {
      DEBUG("Invalid inputs");
      return -1;
   }
 
   if (PEM_write_X509(file, (X509 *)x509->Opaque()) != 1) {
      DEBUG("error while writing certificate " << fname);
      return -1;
   }
 
   return 0;
}

References DEBUG, EPNAME, and XrdCryptoX509::Opaque().

Here is the call graph for this function:

XrdCryptosslX509VerifyCB()

int XrdCryptosslX509VerifyCB	(	int	ok,
		X509_STORE_CTX *	ctx )

Definition at line 53 of file XrdCryptosslAux.cc.

{
   // Verify callback function
 
   // Reset global error
   gErrVerifyChain = 0;
 
   if (ok != 0) {
 
      // Error analysis
      gErrVerifyChain = 1;
   }
 
   // We are done
   return ok;
}

References gErrVerifyChain.

XrdCryptosslX509VerifyCert()

bool XrdCryptosslX509VerifyCert	(	XrdCryptoX509 *	cert,
		XrdCryptoX509 *	ref )

Definition at line 114 of file XrdCryptosslAux.cc.

{
   // Verify signature of cert using public key of ref
 
   // Input must make sense
   X509 *c = cert ? (X509 *)(cert->Opaque()) : 0;
   X509 *r = ref ? (X509 *)(ref->Opaque()) : 0;
   EVP_PKEY *rk = r ? X509_get_pubkey(r) : 0;
   if (!c || !rk) return 0;
 
   // Ok: we can verify
   return (X509_verify(c, rk) > 0);
}

References XrdCryptoX509::Opaque().

Referenced by XrdCryptosslFactory::X509VerifyCert().

Here is the call graph for this function:

Here is the caller graph for this function:

XrdCryptosslX509VerifyChain()

bool XrdCryptosslX509VerifyChain	(	XrdCryptoX509Chain *	chain,
		int &	errcode )

Definition at line 129 of file XrdCryptosslAux.cc.

{
   // Verifies crossed signatures of X509 certificate 'chain'
   // In case of failure, and error code is returned in errcode.
 
   // Make sure we got a potentially meaningful chain
   if (!chain || chain->Size() <= 1)
      return 0;
 
   // Create a store
   X509_STORE *store = X509_STORE_new();
   if (!store)
      return 0;
 
   // Set the verify callback function
   X509_STORE_set_verify_cb_func(store, 0);
 
   // Add the first (the CA) certificate
   XrdCryptoX509 *cert = chain->Begin();
   if (cert->type != XrdCryptoX509::kCA && cert->Opaque())
      return 0;
   X509_STORE_add_cert(store, (X509 *)(cert->Opaque()));
 
   // Create a stack
   STACK_OF(X509) *stk = sk_X509_new_null();
   if (!stk)
      return 0;
 
   // Fill it with chain we have
   X509 *cref = 0;
   while ((cert = chain->Next()) && cert->Opaque()) {
      if (!cref)
         cref = (X509 *)(cert->Opaque());
      sk_X509_push(stk, (X509 *)(cert->Opaque()));
   }
 
   // Make sure all the certificates have been inserted
   if (sk_X509_num(stk) != chain->Size() - 1)
      return 0;
 
   // Create a store ctx ...
   X509_STORE_CTX *ctx = X509_STORE_CTX_new();
   if (!ctx)
      return 0;
 
   // ... and initialize it
   X509_STORE_CTX_init(ctx, store, cref, stk);
 
   // verify ?
   bool verify_ok = (X509_verify_cert(ctx) == 1);
 
   // Fill error code, if any
   errcode = 0;
   if (!verify_ok)
      errcode = gErrVerifyChain;
 
   // Free context, stack, and store
   X509_STORE_CTX_free(ctx);
   sk_X509_pop_free(stk, X509_free);
   X509_STORE_free(store);
 
   return verify_ok;
}

References XrdCryptoX509Chain::Begin(), gErrVerifyChain, XrdCryptoX509::kCA, XrdCryptoX509Chain::Next(), XrdCryptoX509::Opaque(), XrdCryptoX509Chain::Size(), and XrdCryptoX509::type.

Referenced by XrdCryptosslFactory::X509VerifyChain().

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

gErrVerifyChain

int gErrVerifyChain = 0

static

Definition at line 49 of file XrdCryptosslAux.cc.

Referenced by XrdCryptosslX509VerifyCB(), and XrdCryptosslX509VerifyChain().

sslTrace

XrdOucTrace* sslTrace = 0

Definition at line 50 of file XrdCryptosslAux.cc.

Referenced by XrdCryptosslFactory::SetTrace().