Changeset 46

Timestamp:

02/28/2005 12:00:55 AM (4 years ago)

Author:

jan

Message:

added ssl.ca-file and updated error-message if private and public key don't match

Location:

trunk/src

Files:

• base.h (modified) (2 diffs)
• config.c (modified) (5 diffs)
• network.c (modified) (2 diffs)
• server.c (modified) (1 diff)

trunk/src/base.h

@@ -242 +242 @@
         /* server wide */
         buffer *ssl_pemfile;
+        buffer *ssl_ca_file;
         unsigned short use_ipv6;
         unsigned short is_ssl;
@@ -425 +426 @@
         
         buffer *ssl_pemfile;
+        buffer *ssl_ca_file;
         unsigned short use_ipv6;
         unsigned short is_ssl;

trunk/src/config.c

@@ -201 +201 @@
                 { "debug.log-state-handling",    NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_SERVER },     /* 37 */
                 
+                { "ssl.ca-file",                 NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_SERVER },      /* 38 */
+                
                 
                 { "server.host",                 "use server.bind instead", T_CONFIG_DEPRECATED, T_CONFIG_SCOPE_UNSET },
@@ -248 +250 @@
                 s->server_name   = buffer_init();
                 s->ssl_pemfile   = buffer_init();
+                s->ssl_ca_file   = buffer_init();
                 s->error_handler = buffer_init();
                 s->server_tag    = buffer_init();
@@ -294 +297 @@
                 
                 cv[35].destination = &(s->allow_http11);
+                cv[38].destination = s->ssl_ca_file;
                 
                 srv->config_storage[i] = s;
@@ -445 +449 @@
                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.pemfile"))) {
                                 PATCH(ssl_pemfile);
+                        } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.ca-file"))) {
+                                PATCH(ssl_ca_file);
                         } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.engine"))) {
                                 PATCH(is_ssl);
@@ -1006 +1012 @@
 
         if (s->is_ssl) {
-                if (s->ssl_pemfile->used == 0) {
+                if (buffer_is_empty(s->ssl_pemfile)) {
                         /* PEM file is require */
                         

trunk/src/network.c

@@ -282 +282 @@
                 }
                 
-                if (0 > SSL_CTX_use_certificate_file(s->ssl_ctx, s->ssl_pemfile->ptr, SSL_FILETYPE_PEM)) {
+                if (!buffer_is_empty(s->ssl_ca_file)) {
+                        if (1 != SSL_CTX_load_verify_locations(s->ssl_ctx, s->ssl_ca_file->ptr, NULL)) {
+                                log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:", 
+                                                ERR_error_string(ERR_get_error(), NULL));
+                                return -1;
+                        }
+                }
+                
+                if (SSL_CTX_use_certificate_file(s->ssl_ctx, s->ssl_pemfile->ptr, SSL_FILETYPE_PEM) < 0) {
                         log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:", 
                                         ERR_error_string(ERR_get_error(), NULL));
                         return -1;
-                }       
-                
-                if (0 > SSL_CTX_use_PrivateKey_file (s->ssl_ctx, s->ssl_pemfile->ptr, SSL_FILETYPE_PEM)) {
+                }
+                
+                if (SSL_CTX_use_PrivateKey_file (s->ssl_ctx, s->ssl_pemfile->ptr, SSL_FILETYPE_PEM) < 0) {
                         log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:", 
                                         ERR_error_string(ERR_get_error(), NULL));
@@ -294 +302 @@
                 }
                 
-                if (!SSL_CTX_check_private_key(s->ssl_ctx)) {
-                        log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:", 
-                                        "Private key does not match the certificate public key");
+                if (SSL_CTX_check_private_key(s->ssl_ctx) != 1) {
+                        log_error_write(srv, __FILE__, __LINE__, "sssb", "SSL:", 
+                                        "Private key does not match the certificate public key, reason:",
+                                        ERR_error_string(ERR_get_error(), NULL),
+                                        s->ssl_pemfile);
                         return -1;
                 }

trunk/src/server.c

@@ -243 +243 @@
                         buffer_free(s->server_tag);
                         buffer_free(s->ssl_pemfile);
+                        buffer_free(s->ssl_ca_file);
                         buffer_free(s->error_handler);
                         array_free(s->indexfiles);