mariadb/vio/VioSSLFactoriesFd.cc
unknown 5dae19b394 Fixed some reported bugs
BUILD/compile-alpha-cxx:
  Building on Alpha with Compaq C and C+++
Docs/manual.texi:
  Changelogs and update of links
myisam/mi_key.c:
  Fixed multi_part keys where first part where of TEXT/BLOB type
mysys/Makefile.am:
  Makefile.am now works with Compaq make
sql-bench/Results/ATIS-mysql-Linux_2.2.13_SMP_alpha:
  New benchmark results
sql-bench/Results/RUN-mysql-Linux_2.2.13_SMP_alpha:
  New benchmark results
sql-bench/Results/alter-table-mysql-Linux_2.2.13_SMP_alpha:
  New benchmark results
sql-bench/Results/big-tables-mysql-Linux_2.2.13_SMP_alpha:
  New benchmark results
sql-bench/Results/connect-mysql-Linux_2.2.13_SMP_alpha:
  New benchmark results
sql-bench/Results/create-mysql-Linux_2.2.13_SMP_alpha:
  New benchmark results
sql-bench/Results/insert-mysql-Linux_2.2.13_SMP_alpha:
  New benchmark results
sql-bench/Results/select-mysql-Linux_2.2.13_SMP_alpha:
  New benchmark results
sql-bench/Results/wisconsin-mysql-Linux_2.2.13_SMP_alpha:
  New benchmark results
sql-bench/test-select.sh:
  Made the count_distinct_big test a bit smaller
sql/log.cc:
  Changed the slow log format to have more information by default
sql/mysqld.cc:
  false->FALSE
sql/share/german/errmsg.sys:
  Update of messages
sql/share/german/errmsg.txt:
  Update of messages
sql/sql_base.cc:
  Fixed SELECT DISTINCT *
sql/sql_insert.cc:
  Cleanup
sql/sql_table.cc:
  Added logging of DROP of temporary tables
vio/VioFd.cc:
  false -> FALSE
vio/VioSSL.cc:
  false -> FALSE
vio/VioSSLFactoriesFd.cc:
  false -> FALSE
vio/VioSocket.cc:
  false -> FALSE
2000-11-18 23:13:48 +02:00

360 lines
9.7 KiB
C++

/*
** Virtual I/O library
** Written by Andrei Errapart <andreie@no.spam.ee>
*/
#include "vio-global.h"
#ifdef VIO_HAVE_OPENSSL
#ifdef __GNUC__
#pragma implementation // gcc: Class implementation
#endif
#include <netinet/in.h>
#include <openssl/x509.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/pem.h>
#include <openssl/asn1.h>
VIO_NS_BEGIN
#define this_ssl_method my_static_cast(SSL_METHOD*)(this->ssl_method_)
#define this_ssl_context my_static_cast(SSL_CTX*)(this->ssl_context_)
typedef unsigned char* ssl_data_ptr_t;
static bool ssl_algorithms_added = FALSE;
static bool ssl_error_strings_loaded= FALSE;
static int verify_depth = 0;
static int verify_error = X509_V_OK;
static int
vio_verify_callback(int ok, X509_STORE_CTX *ctx)
{
DBUG_ENTER("vio_verify_callback");
DBUG_PRINT("enter", ("ok=%d, ctx=%p", ok, ctx));
char buf[256];
X509* err_cert;
int err,depth;
err_cert=X509_STORE_CTX_get_current_cert(ctx);
err= X509_STORE_CTX_get_error(ctx);
depth= X509_STORE_CTX_get_error_depth(ctx);
X509_NAME_oneline(X509_get_subject_name(err_cert),buf,sizeof(buff));
if (!ok)
{
DBUG_PRINT("error",("verify error:num=%d:%s\n",err,
X509_verify_cert_error_string(err)));
if (verify_depth >= depth)
{
ok=1;
verify_error=X509_V_OK;
}
else
{
ok=0;
verify_error=X509_V_ERR_CERT_CHAIN_TOO_LONG;
}
}
switch (ctx->error) {
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert),buf,256);
DBUG_PRINT("info",("issuer= %s\n",buf));
break;
case X509_V_ERR_CERT_NOT_YET_VALID:
case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
DBUG_PRINT("error", ("notBefore"));
//ASN1_TIME_print_fp(stderr,X509_get_notBefore(ctx->current_cert));
break;
case X509_V_ERR_CERT_HAS_EXPIRED:
case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
DBUG_PRINT("error", ("notAfter error"));
//ASN1_TIME_print_fp(stderr,X509_get_notAfter(ctx->current_cert));
break;
}
DBUG_PRINT("exit", ("r=%d", ok));
DBUG_RETURN(ok);
}
static int
vio_set_cert_stuff(SSL_CTX *ctx, const char *cert_file, const char *key_file)
{
DBUG_ENTER("vio_set_cert_stuff");
DBUG_PRINT("enter", ("ctx=%p, cert_file=%p, key_file=%p",
ctx, cert_file, key_file));
if (cert_file != NULL)
{
if (SSL_CTX_use_certificate_file(ctx,cert_file,SSL_FILETYPE_PEM) <= 0)
{
DBUG_PRINT("error",("unable to get certificate from '%s'\n",cert_file));
/* FIX stderr */
ERR_print_errors_fp(stderr);
DBUG_RETURN(0);
}
if (key_file == NULL)
key_file = cert_file;
if (SSL_CTX_use_PrivateKey_file(ctx,key_file,
SSL_FILETYPE_PEM) <= 0)
{
DBUG_PRINT("error", ("unable to get private key from '%s'\n",key_file));
/* FIX stderr */
ERR_print_errors_fp(stderr);
DBUG_RETURN(0);
}
/* If we are using DSA, we can copy the parameters from
* the private key */
/* Now we know that a key and cert have been set against
* the SSL context */
if (!SSL_CTX_check_private_key(ctx))
{
DBUG_PRINT("error", ("Private key does not match the certificate public key\n"));
DBUG_RETURN(0);
}
}
DBUG_RETURN(1);
}
/************************ VioSSLConnectorFd **********************************/
VioSSLConnectorFd::VioSSLConnectorFd(const char* key_file,
const char* cert_file,
const char* ca_file,
const char* ca_path)
:ssl_context_(0),ssl_method_(0)
{
DBUG_ENTER("VioSSLConnectorFd::VioSSLConnectorFd");
DBUG_PRINT("enter",
("this=%p, key_file=%s, cert_file=%s, ca_path=%s, ca_file=%s",
this, key_file, cert_file, ca_path, ca_file));
/* FIXME: constants! */
int verify = SSL_VERIFY_PEER;
if (!ssl_algorithms_added)
{
DBUG_PRINT("info", ("todo: SSLeay_add_ssl_algorithms()"));
ssl_algorithms_added = true;
SSLeay_add_ssl_algorithms();
}
if (!ssl_error_strings_loaded)
{
DBUG_PRINT("info", ("todo:SSL_load_error_strings()"));
ssl_error_strings_loaded = true;
SSL_load_error_strings();
}
ssl_method_ = SSLv3_client_method();
ssl_context_ = SSL_CTX_new(this_ssl_method);
if (ssl_context_ == 0)
{
DBUG_PRINT("error", ("SSL_CTX_new failed"));
report_errors();
goto ctor_failure;
}
/*
* SSL_CTX_set_options
* SSL_CTX_set_info_callback
* SSL_CTX_set_cipher_list
*/
SSL_CTX_set_verify(this_ssl_context, verify, vio_verify_callback);
if (vio_set_cert_stuff(this_ssl_context, cert_file, key_file) == -1)
{
DBUG_PRINT("error", ("vio_set_cert_stuff failed"));
report_errors();
goto ctor_failure;
}
if (SSL_CTX_load_verify_locations( this_ssl_context, ca_file,ca_path)==0)
{
DBUG_PRINT("warning", ("SSL_CTX_load_verify_locations failed"));
if (SSL_CTX_set_default_verify_paths(this_ssl_context)==0)
{
DBUG_PRINT("error", ("SSL_CTX_set_default_verify_paths failed"));
report_errors();
goto ctor_failure;
}
}
DBUG_VOID_RETURN;
ctor_failure:
DBUG_PRINT("exit", ("there was an error"));
DBUG_VOID_RETURN;
}
VioSSLConnectorFd::~VioSSLConnectorFd()
{
DBUG_ENTER("VioSSLConnectorFd::~VioSSLConnectorFd");
DBUG_PRINT("enter", ("this=%p", this));
if (ssl_context_!=0)
SSL_CTX_free(this_ssl_context);
DBUG_VOID_RETURN;
}
VioSSL* VioSSLConnectorFd::connect( int fd)
{
DBUG_ENTER("VioSSLConnectorFd::connect");
DBUG_PRINT("enter", ("this=%p, fd=%d", this, fd));
DBUG_RETURN(new VioSSL(fd, ssl_context_, VioSSL::state_connect));
}
VioSSL*
VioSSLConnectorFd::connect( VioSocket* sd)
{
DBUG_ENTER("VioSSLConnectorFd::connect");
DBUG_PRINT("enter", ("this=%p, sd=%s", this, sd->description()));
DBUG_RETURN(new VioSSL(sd, ssl_context_, VioSSL::state_connect));
}
void
VioSSLConnectorFd::report_errors()
{
unsigned long l;
const char* file;
const char* data;
int line,flags;
DBUG_ENTER("VioSSLConnectorFd::report_errors");
DBUG_PRINT("enter", ("this=%p", this));
while ((l=ERR_get_error_line_data(&file,&line,&data,&flags)) != 0)
{
char buf[200];
DBUG_PRINT("error", ("OpenSSL: %s:%s:%d:%s\n", ERR_error_string(l,buf),
file,line,(flags&ERR_TXT_STRING)?data:"")) ;
}
DBUG_VOID_RETURN;
}
/************************ VioSSLAcceptorFd **********************************/
VioSSLAcceptorFd::VioSSLAcceptorFd(const char* key_file,
const char* cert_file,
const char* ca_file,
const char* ca_path)
:ssl_context_(0), ssl_method_(0)
{
DBUG_ENTER("VioSSLAcceptorFd::VioSSLAcceptorFd");
DBUG_PRINT("enter",
("this=%p, key_file=%s, cert_file=%s, ca_path=%s, ca_file=%s",
this, key_file, cert_file, ca_path, ca_file));
/* FIXME: constants! */
int verify = (SSL_VERIFY_PEER |
SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
SSL_VERIFY_CLIENT_ONCE);
session_id_context_ = static_cast<vio_ptr>(this);
if (!ssl_algorithms_added)
{
DBUG_PRINT("info", ("todo: SSLeay_add_ssl_algorithms()"));
ssl_algorithms_added = true;
SSLeay_add_ssl_algorithms();
}
if (!ssl_error_strings_loaded)
{
DBUG_PRINT("info", ("todo: SSL_load_error_strings()"));
ssl_error_strings_loaded = true;
SSL_load_error_strings();
}
ssl_method_ = SSLv3_server_method();
ssl_context_ = SSL_CTX_new(this_ssl_method);
if (ssl_context_==0)
{
DBUG_PRINT("error", ("SSL_CTX_new failed"));
report_errors();
goto ctor_failure;
}
/*
* SSL_CTX_set_quiet_shutdown(ctx,1);
*
*/
SSL_CTX_sess_set_cache_size(this_ssl_context,128);
/* DH?
*/
SSL_CTX_set_verify(this_ssl_context, verify, vio_verify_callback);
/*
* Double cast needed at least for egcs-1.1.2 to
* supress warnings:
* 1) ANSI C++ blaah implicit cast from 'void*' to 'unsigned char*'
* 2) static_cast from 'void**' to 'unsigned char*'
* Wish I had a copy of standard handy...
*/
SSL_CTX_set_session_id_context(this_ssl_context,
my_static_cast(ssl_data_ptr_t)
(my_static_cast(void*)(&session_id_context_)),
sizeof(session_id_context_));
/*
* SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile));
*/
if (vio_set_cert_stuff(this_ssl_context, cert_file, key_file) == -1)
{
DBUG_PRINT("error", ("vio_set_cert_stuff failed"));
report_errors();
goto ctor_failure;
}
if (SSL_CTX_load_verify_locations( this_ssl_context, ca_file, ca_path)==0)
{
DBUG_PRINT("warning", ("SSL_CTX_load_verify_locations failed"));
if (SSL_CTX_set_default_verify_paths(this_ssl_context)==0)
{
DBUG_PRINT("error", ("SSL_CTX_set_default_verify_paths failed"));
report_errors();
goto ctor_failure;
}
}
DBUG_VOID_RETURN;
ctor_failure:
DBUG_PRINT("exit", ("there was an error"));
DBUG_VOID_RETURN;
}
VioSSLAcceptorFd::~VioSSLAcceptorFd()
{
DBUG_ENTER("VioSSLAcceptorFd::~VioSSLAcceptorFd");
DBUG_PRINT("enter", ("this=%p", this));
if (ssl_context_!=0)
SSL_CTX_free(this_ssl_context);
DBUG_VOID_RETURN;
}
VioSSL*
VioSSLAcceptorFd::accept(int fd)
{
DBUG_ENTER("VioSSLAcceptorFd::accept");
DBUG_PRINT("enter", ("this=%p, fd=%d", this, fd));
DBUG_RETURN(new VioSSL(fd, ssl_context_, VioSSL::state_accept));
}
VioSSL*
VioSSLAcceptorFd::accept(VioSocket* sd)
{
DBUG_ENTER("VioSSLAcceptorFd::accept");
DBUG_PRINT("enter", ("this=%p, sd=%s", this, sd->description()));
DBUG_RETURN(new VioSSL(sd, ssl_context_, VioSSL::state_accept));
}
void
VioSSLAcceptorFd::report_errors()
{
unsigned long l;
const char* file;
const char* data;
int line,flags;
DBUG_ENTER("VioSSLConnectorFd::report_errors");
DBUG_PRINT("enter", ("this=%p", this));
while ((l=ERR_get_error_line_data(&file,&line,&data,&flags)) != 0)
{
char buf[200];
DBUG_PRINT("error", ("OpenSSL: %s:%s:%d:%s\n", ERR_error_string(l,buf),
file,line,(flags&ERR_TXT_STRING)?data:"")) ;
}
DBUG_VOID_RETURN;
}
VIO_NS_END
#endif /* VIO_HAVE_OPENSSL */