* Applied a patch sent in by Wilfried Goesgens which allows the various

[citadel.git] / citadel / serv_crypto.c

diff --git a/citadel/serv_crypto.c b/citadel/serv_crypto.c
index daffe8995aa0148f45b5bb72f47d4c2a7d3e6122..c56258f34fbe63377112b7dc5a4f647f6bdb09e1 100644 (file)
--- a/citadel/serv_crypto.c
+++ b/citadel/serv_crypto.c
@@ -49,44 +49,6 @@ static unsigned long id_callback(void)
        return (unsigned long) pthread_self();
 }
 
- /*
-  * Set up the cert things on the server side. We do need both the
-  * private key (in key_file) and the cert (in cert_file).
-  * Both files may be identical.
-  *
-  * This function is taken from OpenSSL apps/s_cb.c
-  */
-
-static int ctdl_install_certificate(SSL_CTX * ctx,
-                         const char *cert_file, const char *key_file)
-{
-       if (cert_file != NULL) {
-               if (SSL_CTX_use_certificate_file(ctx, cert_file,
-                                                SSL_FILETYPE_PEM) <= 0) {
-                       lprintf(CTDL_CRIT, "unable to get certificate from '%s'",
-                               cert_file);
-                       return (0);
-               }
-               if (key_file == NULL)
-                       key_file = cert_file;
-               if (SSL_CTX_use_PrivateKey_file(ctx, key_file,
-                                               SSL_FILETYPE_PEM) <= 0) {
-                       lprintf(CTDL_CRIT, "unable to get private key from '%s'",
-                               key_file);
-                       return (0);
-               }
-               /* Now we know that a key and cert have been set against
-                * the SSL context */
-               if (!SSL_CTX_check_private_key(ctx)) {
-                       lprintf(CTDL_CRIT,
-                               "Private key does not match the certificate public key");
-                       return (0);
-               }
-       }
-       return (1);
-}
-
-
 void init_ssl(void)
 {
        SSL_METHOD *ssl_method;
@@ -99,8 +61,8 @@ void init_ssl(void)
        X509_NAME *name = NULL;
        FILE *fp;
 
-       if (!access("/var/run/egd-pool", F_OK))
-               RAND_egd("/var/run/egd-pool");
+       if (!access(EGD_POOL, F_OK))
+               RAND_egd(EGD_POOL);
 
        if (!RAND_status()) {
                lprintf(CTDL_CRIT,
@@ -338,6 +300,7 @@ void init_ssl(void)
                        if (req) {
                                if (cer = X509_new(), cer != NULL) {
 
+                                       ASN1_INTEGER_set(X509_get_serialNumber(cer), 0);
                                        X509_set_issuer_name(cer, req->req_info->subject);
                                        X509_set_subject_name(cer, req->req_info->subject);
                                        X509_gmtime_adj(X509_get_notBefore(cer),0);
@@ -371,13 +334,12 @@ void init_ssl(void)
        /*
         * Now try to bind to the key and certificate.
         */
-       if (ctdl_install_certificate(ssl_ctx,
-                       CTDL_CER_PATH,
-                       CTDL_KEY_PATH) != 1)
-       {
+        SSL_CTX_use_certificate_chain_file(ssl_ctx, CTDL_CER_PATH);
+        SSL_CTX_use_PrivateKey_file(ssl_ctx, CTDL_KEY_PATH, SSL_FILETYPE_PEM);
+        if ( !SSL_CTX_check_private_key(ssl_ctx) ) {
                lprintf(CTDL_CRIT, "Cannot install certificate: %s\n",
                                ERR_reason_error_string(ERR_get_error()));
-       }
+        }
 
        /* Finally let the server know we're here */
        CtdlRegisterProtoHook(cmd_stls, "STLS", "Start SSL/TLS session");
@@ -498,13 +460,14 @@ void CtdlStartTLS(char *ok_response, char *nosup_response,
        int retval, bits, alg_bits;
 
        if (!ssl_ctx) {
-               cprintf("%s", nosup_response);
+               lprintf(CTDL_CRIT, "SSL failed: no ssl_ctx exists?\n");
+               if (nosup_response != NULL) cprintf("%s", nosup_response);
                return;
        }
        if (!(CC->ssl = SSL_new(ssl_ctx))) {
                lprintf(CTDL_CRIT, "SSL_new failed: %s\n",
                                ERR_reason_error_string(ERR_get_error()));
-               cprintf("%s", error_response);
+               if (error_response != NULL) cprintf("%s", error_response);
                return;
        }
        if (!(SSL_set_fd(CC->ssl, CC->client_socket))) {
@@ -512,10 +475,10 @@ void CtdlStartTLS(char *ok_response, char *nosup_response,
                        ERR_reason_error_string(ERR_get_error()));
                SSL_free(CC->ssl);
                CC->ssl = NULL;
-               cprintf("%s", error_response);
+               if (error_response != NULL) cprintf("%s", error_response);
                return;
        }
-       cprintf("%s", ok_response);
+       if (ok_response != NULL) cprintf("%s", ok_response);
        retval = SSL_accept(CC->ssl);
        if (retval < 1) {
                /*
@@ -553,6 +516,8 @@ void cmd_stls(char *params)
        char nosup_response[SIZ];
        char error_response[SIZ];
 
+       unbuffer_output();
+
        sprintf(ok_response,
                "%d Begin TLS negotiation now\n",
                CIT_OK);