5 /* For callbacks generating output, here are their file-descriptors. */
6 static FILE *fp_cb_ssl_info
= NULL
;
7 static FILE *fp_cb_ssl_verify
= NULL
;
10 * 1 = minimal, just errors,
11 * 2 = minimal, all steps,
12 * 3 = detail, all steps */
13 static unsigned int cb_ssl_verify_level
= 1;
15 /* Other static rubbish (to mirror s_cb.c where required) */
16 static int int_verify_depth
= 10;
18 /* This function is largely borrowed from the one used in OpenSSL's "s_client"
19 * and "s_server" utilities. */
20 void cb_ssl_info(const SSL
*s
, int where
, int ret
)
22 const char *str1
, *str2
;
28 w
= where
& ~SSL_ST_MASK
;
29 str1
= (w
& SSL_ST_CONNECT
? "SSL_connect" : (w
& SSL_ST_ACCEPT
?
30 "SSL_accept" : "undefined")),
31 str2
= SSL_state_string_long(s
);
33 if (where
& SSL_CB_LOOP
)
34 fprintf(fp_cb_ssl_info
, "(%s) %s\n", str1
, str2
);
35 else if (where
& SSL_CB_EXIT
) {
37 fprintf(fp_cb_ssl_info
, "(%s) failed in %s\n", str1
, str2
);
38 /* In a non-blocking model, we get a few of these "error"s simply because we're
39 * calling "reads" and "writes" on the state-machine that are virtual NOPs
40 * simply to avoid wasting the time seeing if we *should* call them. Removing
41 * this case makes the "-out_state" output a lot easier on the eye. */
44 fprintf(fp_cb_ssl_info
, "%s:error in %s\n", str1
, str2
);
49 void cb_ssl_info_set_output(FILE *fp
)
54 static const char *int_reason_no_issuer
= "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT";
55 static const char *int_reason_not_yet
= "X509_V_ERR_CERT_NOT_YET_VALID";
56 static const char *int_reason_before
= "X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD";
57 static const char *int_reason_expired
= "X509_V_ERR_CERT_HAS_EXPIRED";
58 static const char *int_reason_after
= "X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD";
60 /* Stolen wholesale from apps/s_cb.c :-) And since then, mutilated ... */
61 int cb_ssl_verify(int ok
, X509_STORE_CTX
*ctx
)
63 char buf1
[256]; /* Used for the subject name */
64 char buf2
[256]; /* Used for the issuer name */
65 const char *reason
= NULL
; /* Error reason (if any) */
69 if(!fp_cb_ssl_verify
|| (cb_ssl_verify_level
== 0))
71 err_cert
= X509_STORE_CTX_get_current_cert(ctx
);
72 err
= X509_STORE_CTX_get_error(ctx
);
73 depth
= X509_STORE_CTX_get_error_depth(ctx
);
75 buf1
[0] = buf2
[0] = '\0';
77 X509_NAME_oneline(X509_get_subject_name(err_cert
), buf1
, 256);
79 X509_NAME_oneline(X509_get_issuer_name(ctx
->current_cert
), buf2
, 256);
81 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT
:
82 reason
= int_reason_no_issuer
;
84 case X509_V_ERR_CERT_NOT_YET_VALID
:
85 reason
= int_reason_not_yet
;
87 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD
:
88 reason
= int_reason_before
;
90 case X509_V_ERR_CERT_HAS_EXPIRED
:
91 reason
= int_reason_expired
;
93 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD
:
94 reason
= int_reason_after
;
98 if((cb_ssl_verify_level
== 1) && ok
)
100 fprintf(fp_cb_ssl_verify
, "chain-depth=%d, ", depth
);
102 fprintf(fp_cb_ssl_verify
, "error=%s\n", reason
);
104 fprintf(fp_cb_ssl_verify
, "error=%d\n", err
);
105 if(cb_ssl_verify_level
< 3)
107 fprintf(fp_cb_ssl_verify
, "--> subject = %s\n", buf1
);
108 fprintf(fp_cb_ssl_verify
, "--> issuer = %s\n", buf2
);
110 fprintf(fp_cb_ssl_verify
,"--> verify error:num=%d:%s\n",err
,
111 X509_verify_cert_error_string(err
));
112 fprintf(fp_cb_ssl_verify
, "--> verify return:%d\n",ok
);
116 void cb_ssl_verify_set_output(FILE *fp
)
118 fp_cb_ssl_verify
= fp
;
121 void cb_ssl_verify_set_depth(unsigned int verify_depth
)
123 int_verify_depth
= verify_depth
;
126 void cb_ssl_verify_set_level(unsigned int level
)
129 cb_ssl_verify_level
= level
;
132 RSA
*cb_generate_tmp_rsa(SSL
*s
, int is_export
, int keylength
)
134 /* TODO: Perhaps make it so our global key can be generated on-the-fly
135 * after certain intervals? */
136 static RSA
*rsa_tmp
= NULL
;
143 if(!BN_set_word(bn
, RSA_F4
))
145 if(!(rsa_tmp
= RSA_new()))
147 if(!RSA_generate_key_ex(rsa_tmp
, keylength
, bn
, NULL
))
161 #endif /* !defined(NO_OPENSSL) */