20#include <openssl/bio.h>
21#include <openssl/crypto.h>
22#include <openssl/err.h>
23#include <openssl/ssl.h>
24#include <openssl/opensslv.h>
109 DBG_CTX(
"CRL refresh ending by request!");
115 DBG_CTX(
"CRL refresh will happen in " <<sleepTime <<
" seconds.");
125 if (!ctxImpl->
owner)
break;
136 if (!newctx || !newctx->
isOK())
137 {
XrdTls::Emsg(
"CrlRefresh:",
"Refresh of context failed!!!",
false);
144 doreplace = (ctxImpl->
ctxnew != 0);
145 if (doreplace)
delete ctxImpl->
ctxnew;
151 if (doreplace) {
DBG_CTX(
"CRL refresh created replacement x509 store.");}
152 else {
DBG_CTX(
"CRL refresh created new x509 store.");}
161 if (!keepctx)
delete ctxImpl;
180 time_t tStart, tWaited;
181 int flushT, waitT, hits, miss, sesn, tmos;
191 waitT = flushT = ctxImpl->
flushT;
196 DBG_CTX(
"Cache flusher started; interval="<<flushT<<
" seconds.");
202 tWaited= time(0) - tStart;
207 if (!ctxImpl->
owner)
break;
211 if (flushT != ctxImpl->
flushT && tWaited < ctxImpl->flushT-1)
212 {waitT = ctxImpl->
flushT - tWaited;
219 waitT = flushT = ctxImpl->
flushT;
224 sesn = SSL_CTX_sess_number(ctxImpl->
ctx);
225 hits = SSL_CTX_sess_hits(ctxImpl->
ctx);
226 miss = SSL_CTX_sess_misses(ctxImpl->
ctx);
227 tmos = SSL_CTX_sess_timeouts(ctxImpl->
ctx);
232 SSL_CTX_flush_sessions(ctxImpl->
ctx, tNow);
238 snprintf(mBuff,
sizeof(mBuff),
"sess=%d hits=%d miss=%d timeouts=%d",
239 sesn, hits, miss, tmos);
240 DBG_CTX(
"Cache flushed; " <<mBuff);
249 if (!keepctx)
delete ctxImpl;
279 0,
"Cache Flusher")))
281 snprintf(eBuff,
sizeof(eBuff),
282 "Unable to start cache flusher thread; rc=%d", rc);
290 SSL_CTX_set_session_cache_mode(pImpl->
ctx, SSL_SESS_CACHE_NO_AUTO_CLEAR);
308#if OPENSSL_VERSION_NUMBER < 0x10100000L && defined(OPENSSL_THREADS)
311#define XRDTLS_SET_CALLBACKS 1
320struct tlsmix<false> {
321 static unsigned long mixer(
unsigned long x) {
324 x *= 0xbf58476d1ce4e5b9UL;
326 x *= 0x94d049bb133111ebUL;
334 static unsigned long mixer(
unsigned long x) {
345unsigned long sslTLS_id_callback(
void)
354 return tlsmix<
sizeof(
unsigned long)==4>::mixer(x);
359void sslTLS_lock(
int mode,
int n,
const char *file,
int line)
364 if (mode & CRYPTO_LOCK) MutexVector[n].
Lock();
365 else MutexVector[n].
UnLock();
372#undef XRDTLS_SET_CALLBACKS
386#if OPENSSL_VERSION_NUMBER >= 0x10002000L
387const char *sslCiphers =
"ECDHE-ECDSA-AES128-GCM-SHA256:"
388 "ECDHE-RSA-AES128-GCM-SHA256:"
389 "ECDHE-ECDSA-AES256-GCM-SHA384:"
390 "ECDHE-RSA-AES256-GCM-SHA384:"
391 "ECDHE-ECDSA-CHACHA20-POLY1305:"
392 "ECDHE-RSA-CHACHA20-POLY1305:"
393 "DHE-RSA-AES128-GCM-SHA256:"
394 "DHE-RSA-AES256-GCM-SHA384";
396const char *sslCiphers =
"ALL:!LOW:!EXP:!MD5:!MD2";
401bool initTlsDone{
false };
414 if (initTlsDone)
return;
420 OpenSSL_add_all_algorithms();
421 SSL_load_error_strings();
422 OpenSSL_add_all_ciphers();
423#if OPENSSL_VERSION_NUMBER < 0x30000000L
424 ERR_load_BIO_strings();
426 ERR_load_crypto_strings();
430#ifdef XRDTLS_SET_CALLBACKS
432 int n = CRYPTO_num_locks();
435 CRYPTO_set_locking_callback(sslTLS_lock);
437 CRYPTO_set_id_callback(sslTLS_id_callback);
446void Fatal(std::string *
eMsg,
const char *msg,
bool sslmsg=
false)
462const char *GetTlsMethod(
const SSL_METHOD *&meth)
464#if OPENSSL_VERSION_NUMBER > 0x1010000fL
467 meth = SSLv23_method();
469 if (meth == 0)
return "No negotiable TLS method available.";
477bool VerPaths(
const char *cert,
const char *pkey,
478 const char *cadr,
const char *cafl, std::string &
eMsg)
480 static const mode_t cert_mode = S_IRUSR | S_IWUSR | S_IRWXG | S_IROTH;
481 static const mode_t pkey_mode = S_IRUSR | S_IWUSR;
482 static const mode_t cadr_mode = S_IRWXU | S_IRGRP | S_IXGRP
484 static const mode_t cafl_mode = S_IRUSR | S_IWUSR | S_IRWXG | S_IROTH;
491 {
eMsg =
"Unable to use CA cert directory ";
500 {
eMsg =
"Unable to use CA cert file ";
509 {
eMsg =
"Unable to use key file ";
519 {mode_t cmode = (pkey ? cert_mode : pkey_mode);
521 {
if (pkey)
eMsg =
"Unable to use cert file ";
522 else eMsg =
"Unable to use cert+key file ";
539int VerCB(
int aOK, X509_STORE_CTX *x509P)
542 {X509 *cert = X509_STORE_CTX_get_current_cert(x509P);
543 int depth = X509_STORE_CTX_get_error_depth(x509P);
544 int err = X509_STORE_CTX_get_error(x509P);
545 char name[512], info[1024];
547 X509_NAME_oneline(X509_get_subject_name(cert), name,
sizeof(name));
548 snprintf(info,
sizeof(info),
"Cert verification failed for DN=%s",name);
551 X509_NAME_oneline(X509_get_issuer_name(cert), name,
sizeof(name));
552 snprintf(info,
sizeof(info),
"Failing cert issuer=%s", name);
555 snprintf(info,
sizeof(info),
"Error %d at depth %d [%s]", err, depth,
556 X509_verify_cert_error_string(err));
570#define KILL_CTX(x) if (x) {SSL_CTX_free(x); x = 0;}
572#define FATAL(msg) {Fatal(eMsg, msg); KILL_CTX(pImpl->ctx); return;}
574#define FATAL_SSL(msg) {Fatal(eMsg, msg, true); KILL_CTX(pImpl->ctx); return;}
577 const char *caDir,
const char *caFile,
584 void Keep() {ctxLoc = 0;}
586 ctx_helper(SSL_CTX **ctxP) : ctxLoc(ctxP) {}
587 ~ctx_helper() {
if (ctxLoc && *ctxLoc)
588 {SSL_CTX_free(*ctxLoc); *ctxLoc = 0;}
592 } ctx_tracker(&pImpl->
ctx);
594 static const int sslOpts = SSL_OP_ALL
597 | SSL_OP_NO_COMPRESSION
598#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
599 | SSL_OP_IGNORE_UNEXPECTED_EOF
601#if OPENSSL_VERSION_NUMBER >= 0x10101000L
602 | SSL_OP_NO_RENEGOTIATION
606 std::string certFN, eText;
620 if (!(
opts &
servr) && (dbg = getenv(
"XRDTLS_DEBUG")))
639 {
if (!caDir && !caFile)
640 {caDir = getenv(
"X509_CERT_DIR");
641 caFile = getenv(
"X509_CERT_FILE");
642 if (!caDir && !caFile)
643 FATAL(
"No CA cert specified; host identity cannot be verified.");
645 if (!key) key = getenv(
"X509_USER_KEY");
646 if (!cert) cert = getenv(
"X509_USER_PROXY");
649 long long int uid =
static_cast<long long int>(getuid());
650 certFN = std::string(
"/tmp/x509up_u") + std::to_string(uid);
651 if (!
stat(certFN.c_str(), &
Stat)) cert = certFN.c_str();
658 if (!VerPaths(cert, key, caDir, caFile, eText))
FATAL( eText.c_str());
679 const SSL_METHOD *meth;
680 emsg = GetTlsMethod(meth);
683 pImpl->
ctx = SSL_CTX_new(meth);
687 if (pImpl->
ctx == 0)
FATAL_SSL(
"Unable to allocate TLS context!");
691 SSL_CTX_set_options(pImpl->
ctx, sslOpts);
699 SSL_CTX_set_session_cache_mode(pImpl->
ctx, SSL_SESS_CACHE_OFF);
706 {
if (!SSL_CTX_load_verify_locations(pImpl->
ctx, caFile, caDir))
707 FATAL_SSL(
"Unable to load the CA cert file or directory.");
710 SSL_CTX_set_verify_depth(pImpl->
ctx, (vDepth ? vDepth : 9));
713 SSL_CTX_set_verify(pImpl->
ctx, SSL_VERIFY_PEER, (LogVF ? VerCB : 0));
715 unsigned long xFlags = (
opts &
nopxy ? 0 : X509_V_FLAG_ALLOW_PROXY_CERTS);
717 {xFlags |= X509_V_FLAG_CRL_CHECK;
718 if (
opts &
crlFC) xFlags |= X509_V_FLAG_CRL_CHECK_ALL;
720 if (
opts) X509_STORE_set_flags(SSL_CTX_get_cert_store(pImpl->
ctx),xFlags);
722 SSL_CTX_set_verify(pImpl->
ctx, SSL_VERIFY_NONE, 0);
727 if (!SSL_CTX_set_cipher_list(pImpl->
ctx, sslCiphers))
728 FATAL_SSL(
"Unable to set SSL cipher list; no supported ciphers.");
733#if SSL_CTRL_SET_ECDH_AUTO
734 SSL_CTX_set_ecdh_auto(pImpl->
ctx, 1);
741 if (
opts &
artON) SSL_CTX_set_mode(pImpl->
ctx, SSL_MODE_AUTO_RETRY);
753 if (!key) key = cert;
757 if (SSL_CTX_use_certificate_chain_file(pImpl->
ctx, cert) != 1)
758 FATAL_SSL(
"Unable to create TLS context; invalid certificate.");
762 if (SSL_CTX_use_PrivateKey_file(pImpl->
ctx, key, SSL_FILETYPE_PEM) != 1 )
763 FATAL_SSL(
"Unable to create TLS context; invalid private key.");
767 if (SSL_CTX_check_private_key(pImpl->
ctx) != 1 )
768 FATAL_SSL(
"Unable to create TLS context; cert-key mismatch.");
801 const char *cert = (my.
cert.size() ? my.
cert.c_str() : 0);
802 const char *pkey = (my.
pkey.size() ? my.
pkey.c_str() : 0);
803 const char *caD = (my.
cadir.size() ? my.
cadir.c_str() : 0);
804 const char *caF = (my.
cafile.size() ? my.
cafile.c_str() : 0);
808 if (!full) caD = caF = 0;
863#ifndef OPENSSL_THREADS
864 return "Installed OpenSSL lacks the required thread support!";
879 return pImpl->
ctx != 0;
894#if OPENSSL_VERSION_NUMBER >= 0x10002000L
904 {ssl = SSL_new(pImpl->
ctx);
918 {ssl = SSL_new(pImpl->
ctx);
925 DBG_CTX(
"Replacing x509 store with new contents.");
942 SSL_CTX_free(pImpl->
ctx);
943 pImpl->
ctx = ctxnew->pImpl->
ctx;
948 ctxnew->pImpl->
ctx = 0;
957 ssl = SSL_new(pImpl->
ctx);
970 return SSL_new(pImpl->
ctx);
989 if (pImpl->
ctx == 0)
return 0;
994 {
if (
opts &
scOff) sslopt = SSL_SESS_CACHE_OFF;
995 else {
if (
opts &
scSrvr) sslopt = SSL_SESS_CACHE_SERVER;
996 if (
opts &
scClnt) sslopt |= SSL_SESS_CACHE_CLIENT;
1002 if (!(
opts & doSet)) sslopt = SSL_CTX_get_session_cache_mode(pImpl->
ctx);
1003 else {sslopt = SSL_CTX_set_session_cache_mode(pImpl->
ctx, sslopt);
1004 if (
opts &
scOff) SSL_CTX_set_options(pImpl->
ctx, SSL_OP_NO_TICKET);
1010 if (sslopt & SSL_SESS_CACHE_SERVER)
opts |=
scSrvr;
1011 if (sslopt & SSL_SESS_CACHE_CLIENT)
opts |=
scClnt;
1013 if (sslopt & SSL_SESS_CACHE_NO_AUTO_CLEAR)
opts |=
scKeep;
1018 if (
id && idlen > 0)
1019 {
if (!SSL_CTX_set_session_id_context(pImpl->
ctx,
1020 (
unsigned const char *)
id,
1027 if (flushT && flushT != pImpl->
flushT)
1041 if (pImpl->
ctx && SSL_CTX_set_cipher_list(pImpl->
ctx, ciphers))
return true;
1044 snprintf(eBuff,
sizeof(eBuff),
"Unable to set context ciphers '%s'",ciphers);
1045 Fatal(0, eBuff,
true);
1055 sslCiphers = ciphers;
1064#if OPENSSL_VERSION_NUMBER >= 0x10002000L
1090 snprintf(eBuff,
sizeof(eBuff),
1091 "Unable to start CRL refresh thread; rc=%d", rc);
1093 pImpl->crlMutex.UnLock();
1095 }
else pImpl->crlRunning =
true;
1096 pImpl->crlMutex.UnLock();
1108 XrdTls::Emsg(
"CrlRefresh:",
"Refreshing CRLs only supported in "
1109 "OpenSSL version >= 1.02; CRL refresh disabled!",
false);
1124 const std::string certPath = pImpl->
Parm.
cert;
1125 if(certPath.empty()) {
1129 time_t modificationTime;
void Fatal(const char *op, const char *target)
int emsg(int rc, char *msg)
static int getModificationTime(const char *path, time_t &modificationTime)
static const char * ValPath(const char *path, mode_t allow, bool isdir)
static int Run(pthread_t *, void *(*proc)(void *), void *arg, int opts=0, const char *desc=0)
static pthread_t ID(void)
static void Snooze(int seconds)
static const int scIdErr
Info: Id not set, is too long.
XrdTlsContext * Clone(bool full=true, bool startCRLRefresh=false)
~XrdTlsContext()
Destructor.
static const uint64_t vdept
Mask to isolate vdept.
static const int crlRS
Bits to shift vdept.
int SessionCache(int opts=scNone, const char *id=0, int idlen=0)
static void SetDefaultCiphers(const char *ciphers)
XrdTlsContext(const char *cert=0, const char *key=0, const char *cadir=0, const char *cafile=0, uint64_t opts=0, std::string *eMsg=0)
static const int scClnt
Turn on cache client mode.
static const int DEFAULT_CRL_REF_INT_SEC
Default CRL refresh interval in seconds.
static const uint64_t servr
This is a server context.
static const uint64_t rfCRL
Turn on the CRL refresh thread.
static const int scKeep
Info: TLS-controlled flush disabled.
static const uint64_t nopxy
Do not allow proxy certs.
static const int scNone
Do not change any option settings.
static const uint64_t logVF
Log verify failures.
static const uint64_t crlFC
Full crl chain checking.
static const uint64_t crlON
Enables crl checking.
static const uint64_t artON
Auto retry Handshake.
static const int vdepS
Bits to shift vdept.
const CTX_Params * GetParams()
static const int scOff
Turn off cache.
static const char * Init()
bool newHostCertificateDetected()
bool SetContextCiphers(const char *ciphers)
bool SetCrlRefresh(int refsec=-1)
static const int scSrvr
Turn on cache server mode (default)
static const uint64_t crlRF
Mask to isolate crl refresh in min.
static const int dbgSIO
Turn debugging in for socket I/O.
static const int dbgSOK
Turn debugging in for socket operations.
static const int dbgOUT
Force msgs to stderr for easier client debug.
static void Emsg(const char *tid, const char *msg=0, bool flush=true)
static const int dbgALL
Turn debugging for everything.
static const int dbgCTX
Turn debugging in for context operations.
static void SetDebug(int opts, XrdSysLogger *logP=0)
void * Refresh(void *parg)
bool Setup_Flusher(XrdTlsContextImpl *pImpl, int flushT)
void * Flusher(void *parg)
XrdSysTrace SysTrace("TLS", 0)
XrdTlsContextImpl(XrdTlsContext *p)
std::string sessionCacheId
XrdTlsContext::CTX_Params Parm
std::string cafile
-> ca cert file.
uint64_t opts
Options as passed to the constructor.
std::string cadir
-> ca cert directory.
int crlRT
crl refresh interval time in seconds
std::string pkey
-> private key path.
std::string cert
-> certificate path.