X-Git-Url: https://code.citadel.org/?a=blobdiff_plain;f=webcit%2Fcrypto.c;h=5df3e61a13111d676866ed24b6209d6d7505b839;hb=HEAD;hp=c396e2d0e47a3aaabd20e350a265843bc801acea;hpb=6085834c9009a4188ba009ec7585af0491622159;p=citadel.git diff --git a/webcit/crypto.c b/webcit/crypto.c index c396e2d0e..845113791 100644 --- a/webcit/crypto.c +++ b/webcit/crypto.c @@ -1,4 +1,4 @@ -// Copyright (c) 1996-2021 by the citadel.org team +// Copyright (c) 1996-2022 by the citadel.org team // // This program is open source software. You can redistribute it and/or // modify it under the terms of the GNU General Public License, version 3. @@ -12,74 +12,102 @@ #ifdef HAVE_OPENSSL #include "webcit.h" -#include "webserver.h" + SSL_CTX *ssl_ctx; // Global SSL context +char key_file[PATH_MAX] = ""; +char cert_file[PATH_MAX] = ""; char *ssl_cipher_list = DEFAULT_SSL_CIPHER_LIST; pthread_key_t ThreadSSL; // Per-thread SSL context -void shutdown_ssl(void) { - ERR_free_strings(); -} +// Set the private key and certificate chain for the global SSL Context. +// This is called during initialization, and can be called again later if the certificate changes. +void bind_to_key_and_certificate(void) { -// initialize ssl engine, load certs and initialize openssl internals -void init_ssl(void) { - const SSL_METHOD *ssl_method; + SSL_CTX *old_ctx, *new_ctx; -#ifndef OPENSSL_NO_EGD - if (!access("/var/run/egd-pool", F_OK)) { - RAND_egd("/var/run/egd-pool"); + if (IsEmptyStr(key_file)) { + snprintf(key_file, sizeof key_file, "%s/keys/citadel.key", ctdl_dir); } -#endif - - if (!RAND_status()) { - syslog(LOG_WARNING, "PRNG not adequately seeded, won't do SSL/TLS"); - return; + if (IsEmptyStr(cert_file)) { + snprintf(cert_file, sizeof key_file, "%s/keys/citadel.cer", ctdl_dir); } - // Initialize SSL transport layer - SSL_library_init(); - SSL_load_error_strings(); - ssl_method = SSLv23_server_method(); - if (!(ssl_ctx = SSL_CTX_new(ssl_method))) { + if (!(new_ctx = SSL_CTX_new(SSLv23_server_method()))) { syslog(LOG_WARNING, "SSL_CTX_new failed: %s", ERR_reason_error_string(ERR_get_error())); return; } syslog(LOG_INFO, "Requesting cipher list: %s", ssl_cipher_list); - if (!(SSL_CTX_set_cipher_list(ssl_ctx, ssl_cipher_list))) { + if (!(SSL_CTX_set_cipher_list(new_ctx, ssl_cipher_list))) { syslog(LOG_WARNING, "SSL_CTX_set_cipher_list failed: %s", ERR_reason_error_string(ERR_get_error())); return; } + syslog(LOG_DEBUG, "crypto: [re]installing key \"%s\" and certificate \"%s\"", key_file, cert_file); + + SSL_CTX_use_certificate_chain_file(new_ctx, cert_file); + SSL_CTX_use_PrivateKey_file(new_ctx, key_file, SSL_FILETYPE_PEM); + + if ( !SSL_CTX_check_private_key(new_ctx) ) { + syslog(LOG_WARNING, "crypto: cannot install certificate: %s", ERR_reason_error_string(ERR_get_error())); + } + + old_ctx = ssl_ctx; + ssl_ctx = new_ctx; + sleep(1); + SSL_CTX_free(old_ctx); +} + + +// initialize ssl engine, load certs and initialize openssl internals +void init_ssl(void) { + + // Initialize the OpenSSL library + SSL_load_error_strings(); + ERR_load_crypto_strings(); + OpenSSL_add_all_algorithms(); + SSL_library_init(); // Now try to bind to the key and certificate. - // Note that we use SSL_CTX_use_certificate_chain_file() which allows - // the certificate file to contain intermediate certificates. + bind_to_key_and_certificate(); +} - char *key_file[PATH_MAX]; - char *cert_file[PATH_MAX]; - snprintf(key_file, sizeof key_file, "%s/keys/citadel.key", ctdl_dir); - snprintf(cert_file, sizeof key_file, "%s/keys/citadel.cer", ctdl_dir); +// Check the modification time of the key and certificate -- reload if either one changed +void update_key_and_cert_if_needed(void) { + static time_t previous_mtime = 0; + struct stat keystat; + struct stat certstat; - SSL_CTX_use_certificate_chain_file(ssl_ctx, cert_file); - SSL_CTX_use_PrivateKey_file(ssl_ctx, key_file, SSL_FILETYPE_PEM); + if (stat(key_file, &keystat) != 0) { + syslog(LOG_ERR, "%s: %s", key_file, strerror(errno)); + return; + } + if (stat(cert_file, &certstat) != 0) { + syslog(LOG_ERR, "%s: %s", cert_file, strerror(errno)); + return; + } - if ( !SSL_CTX_check_private_key(ssl_ctx) ) { - syslog(LOG_WARNING, "crypto: cannot install certificate: %s", ERR_reason_error_string(ERR_get_error())); + if ((keystat.st_mtime + certstat.st_mtime) != previous_mtime) { + bind_to_key_and_certificate(); + previous_mtime = keystat.st_mtime + certstat.st_mtime; } } // starts SSL/TLS encryption for the current session. int starttls(int sock) { - int retval, bits, alg_bits; SSL *newssl; + int retval, bits, alg_bits; + // Check the modification time of the key and certificate -- reload if they changed + update_key_and_cert_if_needed(); + + // SSL is a thread-specific thing, I think. pthread_setspecific(ThreadSSL, NULL); if (!ssl_ctx) { @@ -110,29 +138,11 @@ int starttls(int sock) { else { syslog(LOG_WARNING, "first SSL_accept failed: %s", ssl_error_reason); } - // sleeeeeeeeeep(1); - // retval = SSL_accept(newssl); } - // if (retval < 1) { - // long errval; - // const char *ssl_error_reason = NULL; -// - // errval = SSL_get_error(newssl, retval); - // ssl_error_reason = ERR_reason_error_string(ERR_get_error()); - // if (ssl_error_reason == NULL) { - // syslog(LOG_WARNING, "second SSL_accept failed: errval=%ld, retval=%d (%s)", errval, retval, strerror(errval)); - // } - // else { - // syslog(LOG_WARNING, "second SSL_accept failed: %s", ssl_error_reason); - // } - // SSL_free(newssl); - // newssl = NULL; - // return(4); - // } else { syslog(LOG_INFO, "SSL_accept success"); } - /*r = */BIO_set_close(SSL_get_rbio(newssl), BIO_NOCLOSE); + BIO_set_close(SSL_get_rbio(newssl), BIO_NOCLOSE); bits = SSL_CIPHER_get_bits(SSL_get_current_cipher(newssl), &alg_bits); syslog(LOG_INFO, "SSL/TLS using %s on %s (%d of %d bits)", SSL_CIPHER_get_name(SSL_get_current_cipher(newssl)), @@ -191,7 +201,7 @@ int client_write_ssl(const StrBuf *Buf) { sleeeeeeeeeep(1); continue; } - syslog(LOG_WARNING, "SSL_write got error %ld, ret %d", errval, retval); + syslog(LOG_WARNING, "SSL_write: %s", ERR_reason_error_string(ERR_get_error())); if (retval == -1) { syslog(LOG_WARNING, "errno is %d\n", errno); } @@ -228,7 +238,7 @@ int client_read_sslbuffer(StrBuf *buf, int timeout) { sleeeeeeeeeep(1); continue; } - syslog(LOG_WARNING, "SSL_read got error %ld", errval); + syslog(LOG_WARNING, "SSL_read in client_read: %s", ERR_reason_error_string(ERR_get_error())); endtls(); return (-1); }