* Allow the '-S' command line option, so the cipher suites can be specified without...

[citadel.git] / webcit / crypto.c

diff --git a/webcit/crypto.c b/webcit/crypto.c
index 2e630849160fb3266a5fe998cc294125050183fa..344dc6a5a83c41999b8ab840ab74cb93408638da 100644 (file)
--- a/webcit/crypto.c
+++ b/webcit/crypto.c
@@ -17,6 +17,7 @@
 
 SSL_CTX *ssl_ctx;              /* SSL context */
 pthread_mutex_t **SSLCritters; /* Things needing locking */
+char *ssl_cipher_list = DEFAULT_SSL_CIPHER_LIST;
 
 pthread_key_t ThreadSSL;       /* Per-thread SSL context */
 
@@ -52,6 +53,7 @@ void init_ssl(void)
        X509_NAME *name = NULL;
        FILE *fp;
        char buf[SIZ];
+       int rv = 0;
 
        if (!access("/var/run/egd-pool", F_OK)) {
                RAND_egd("/var/run/egd-pool");
@@ -90,8 +92,13 @@ void init_ssl(void)
        SSL_load_error_strings();
        ssl_method = SSLv23_server_method();
        if (!(ssl_ctx = SSL_CTX_new(ssl_method))) {
-               lprintf(3, "SSL_CTX_new failed: %s\n",
-                       ERR_reason_error_string(ERR_get_error()));
+               lprintf(3, "SSL_CTX_new failed: %s\n", ERR_reason_error_string(ERR_get_error()));
+               return;
+       }
+
+       lprintf(9, "Requesting cipher list: %s\n", ssl_cipher_list);
+       if (!(SSL_CTX_set_cipher_list(ssl_ctx, ssl_cipher_list))) {
+               lprintf(3, "SSL_CTX_set_cipher_list failed: %s\n", ERR_reason_error_string(ERR_get_error()));
                return;
        }
 
@@ -114,11 +121,14 @@ void init_ssl(void)
         */
        if (!strcasecmp(ctdlhost, "uds")) {
                sprintf(buf, "%s/keys/citadel.key", ctdlport);
-               symlink(buf, CTDL_KEY_PATH);
+               rv = symlink(buf, CTDL_KEY_PATH);
+               if (!rv) lprintf(1, "%s\n", strerror(errno));
                sprintf(buf, "%s/keys/citadel.csr", ctdlport);
-               symlink(buf, CTDL_CSR_PATH);
+               rv = symlink(buf, CTDL_CSR_PATH);
+               if (!rv) lprintf(1, "%s\n", strerror(errno));
                sprintf(buf, "%s/keys/citadel.cer", ctdlport);
-               symlink(buf, CTDL_CER_PATH);
+               rv = symlink(buf, CTDL_CER_PATH);
+               if (!rv) lprintf(1, "%s\n", strerror(errno));
        }
 
        /*
@@ -147,7 +157,7 @@ void init_ssl(void)
                                                        NULL    /* no callbk */
                                ) != 1) {
                                        lprintf(3, "Cannot write key: %s\n",
-                                               ERR_reason_error_string(ERR_get_error()));
+                                               ERR_reason_error_string(ERR_get_error()));
                                        unlink(CTDL_KEY_PATH);
                                }
                                fclose(fp);
@@ -187,7 +197,7 @@ void init_ssl(void)
                        if (pk=EVP_PKEY_new(), pk != NULL) {
                                EVP_PKEY_assign_RSA(pk, rsa);
                                if (req = X509_REQ_new(), req != NULL) {
-
+                                       const char *env;
                                        /* Set the public key */
                                        X509_REQ_set_pubkey(req, pk);
                                        X509_REQ_set_version(req, 0L);
@@ -211,24 +221,37 @@ void init_ssl(void)
                                                MBSTRING_ASC, "Mount Kisco", -1, -1, 0);
                                        */
 
+                                       env = getenv("O");
+                                       if (env == NULL)
+                                               env = "Organization name",
+
                                        X509_NAME_add_entry_by_txt(
                                                name, "O",
                                                MBSTRING_ASC, 
-                                               (unsigned char*)"Organization name",
+                                               (unsigned char*)env, 
                                                -1, -1, 0
                                        );
 
+                                       env = getenv("OU");
+                                       if (env == NULL)
+                                               env = "Citadel server";
+
                                        X509_NAME_add_entry_by_txt(
                                                name, "OU",
                                                MBSTRING_ASC, 
-                                               (unsigned char*)"Citadel server1",
+                                               (unsigned char*)env, 
                                                -1, -1, 0
                                        );
 
+                                       env = getenv("CN");
+                                       if (env == NULL)
+                                               env = "*";
+
                                        X509_NAME_add_entry_by_txt(
                                                name, "CN",
                                                MBSTRING_ASC, 
-                                               (unsigned char*)"*", -1, -1, 0
+                                               (unsigned char*)env,
+                                               -1, -1, 0
                                        );
                                
                                        X509_REQ_set_subject_name(req, name);