removed some debugs

[citadel.git] / citadel / modules / crypto / serv_crypto.c

diff --git a/citadel/modules/crypto/serv_crypto.c b/citadel/modules/crypto/serv_crypto.c
index 7c3ea865177e663de0000cfe518afd4d3ba0e586..f78c0cd856de5bbb1a15904151182be50abaa5b0 100644 (file)
--- a/citadel/modules/crypto/serv_crypto.c
+++ b/citadel/modules/crypto/serv_crypto.c
@@ -42,7 +42,7 @@
 #ifdef HAVE_OPENSSL
 
 SSL_CTX *ssl_ctx = NULL;               // This SSL context is used for all sessions.
-
+char *ssl_cipher_list = CIT_CIPHERS;
 
 // If a private key does not exist, generate one now.
 void generate_key(char *keyfilename) {
@@ -54,6 +54,7 @@ void generate_key(char *keyfilename) {
        FILE *fp;
 
        if (access(keyfilename, R_OK) == 0) {   // Already have one.
+               syslog(LOG_INFO, "crypto: %s exists and is readable", keyfilename);
                return;
        }
 
@@ -107,6 +108,7 @@ void generate_certificate(char *keyfilename, char *certfilename) {
        FILE *fp;
 
        if (access(certfilename, R_OK) == 0) {                  // already have one.
+               syslog(LOG_INFO, "crypto: %s exists and is readable", certfilename);
                return;
        }
 
@@ -205,7 +207,7 @@ void generate_certificate(char *keyfilename, char *certfilename) {
 
        X509_free(certificate);
        EVP_PKEY_free(public_key);
-       // RSA_free(private_key);                               // private_key is freed by EVP_PKEY_free() above
+       // do not RSA_free(private_key); because it was freed by EVP_PKEY_free() above
 }
 
 
@@ -216,19 +218,34 @@ void bind_to_key_and_certificate(void) {
        SSL_CTX *old_ctx = NULL;
        SSL_CTX *new_ctx = NULL;
 
-       if (!(new_ctx = SSL_CTX_new(TLS_server_method()))) {
+       const SSL_METHOD *method = SSLv23_server_method();
+       if (!method) {
+               syslog(LOG_ERR, "crypto: SSLv23_server_method() failed: %s", ERR_reason_error_string(ERR_get_error()));
+               return;
+       }
+
+       new_ctx = SSL_CTX_new(method);
+       if (!new_ctx) {
                syslog(LOG_ERR, "crypto: SSL_CTX_new failed: %s", ERR_reason_error_string(ERR_get_error()));
                return;
        }
 
+       if (!(SSL_CTX_set_cipher_list(new_ctx, ssl_cipher_list))) {
+               syslog(LOG_ERR, "crypto: SSL_CTX_set_cipher_list failed: %s", ERR_reason_error_string(ERR_get_error()));
+               return;
+       }
+
        syslog(LOG_DEBUG, "crypto: using certificate chain %s", file_crpt_file_cer);
-        SSL_CTX_use_certificate_chain_file(new_ctx, file_crpt_file_cer);
+        if (!SSL_CTX_use_certificate_chain_file(new_ctx, file_crpt_file_cer)) {
+               syslog(LOG_ERR, "crypto: SSL_CTX_use_certificate_chain_file failed: %s", ERR_reason_error_string(ERR_get_error()));
+               return;
+       }
 
        syslog(LOG_DEBUG, "crypto: using private key %s", file_crpt_file_key);
-        SSL_CTX_use_PrivateKey_file(new_ctx, file_crpt_file_key, SSL_FILETYPE_PEM);
-        if ( !SSL_CTX_check_private_key(new_ctx) ) {
-               syslog(LOG_ERR, "crypto: cannot install certificate: %s", ERR_reason_error_string(ERR_get_error()));
-        }
+        if (!SSL_CTX_use_PrivateKey_file(new_ctx, file_crpt_file_key, SSL_FILETYPE_PEM)) {
+               syslog(LOG_ERR, "crypto: SSL_CTX_use_PrivateKey_file failed: %s", ERR_reason_error_string(ERR_get_error()));
+               return;
+       }
 
        old_ctx = ssl_ctx;
        ssl_ctx = new_ctx;              // All future binds will use the new certificate
@@ -268,10 +285,8 @@ void update_key_and_cert_if_needed(void) {
 void init_ssl(void) {
 
        // Initialize the OpenSSL library
-       SSL_load_error_strings();
-       ERR_load_crypto_strings();
-       OpenSSL_add_all_algorithms();
        SSL_library_init();
+       SSL_load_error_strings();
 
        // Load (or generate) a key and certificate
        mkdir(ctdl_key_dir, 0700);                                      // If the keys directory does not exist, create it
@@ -540,15 +555,7 @@ void CtdlStartTLS(char *ok_response, char *nosup_response, char *error_response)
                // Can't notify the client of an error here; they will
                // discover the problem at the SSL layer and should
                // revert to unencrypted communications.
-               long errval;
-               char error_string[128];
-
-               errval = SSL_get_error(CC->ssl, retval);
-               syslog(LOG_ERR, "crypto: SSL_accept failed: retval=%d, errval=%ld, err=%s",
-                       retval,
-                       errval,
-                       ERR_error_string(errval, error_string)
-               );
+               syslog(LOG_ERR, "crypto: SSL_accept failed: %s", ERR_reason_error_string(ERR_get_error()));
                SSL_free(CC->ssl);
                CC->ssl = NULL;
                return;