5 /* For callbacks generating output, here are their file-descriptors. */
6 static FILE *fp_cb_ssl_info
= NULL
;
7 static FILE *fp_cb_ssl_verify
= NULL
;
11 * 1 = minimal, just errors,
12 * 2 = minimal, all steps,
13 * 3 = detail, all steps */
14 static unsigned int cb_ssl_verify_level
= 1;
16 /* Other static rubbish (to mirror s_cb.c where required) */
17 static int int_verify_depth
= 10;
20 * This function is largely borrowed from the one used in OpenSSL's
21 * "s_client" and "s_server" utilities.
23 void cb_ssl_info(const SSL
*s
, int where
, int ret
)
25 const char *str1
, *str2
;
31 w
= where
& ~SSL_ST_MASK
;
32 str1
= (w
& SSL_ST_CONNECT
? "SSL_connect" : (w
& SSL_ST_ACCEPT
?
35 SSL_state_string_long(s
);
37 if (where
& SSL_CB_LOOP
)
38 fprintf(fp_cb_ssl_info
, "(%s) %s\n", str1
, str2
);
39 else if (where
& SSL_CB_EXIT
) {
41 fprintf(fp_cb_ssl_info
, "(%s) failed in %s\n", str1
, str2
);
43 * In a non-blocking model, we get a few of these "error"s simply
44 * because we're calling "reads" and "writes" on the state-machine
45 * that are virtual NOPs simply to avoid wasting the time seeing if
46 * we *should* call them. Removing this case makes the "-out_state"
47 * output a lot easier on the eye.
51 fprintf(fp_cb_ssl_info
, "%s:error in %s\n", str1
, str2
);
56 void cb_ssl_info_set_output(FILE *fp
)
61 static const char *int_reason_no_issuer
=
62 "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT";
63 static const char *int_reason_not_yet
= "X509_V_ERR_CERT_NOT_YET_VALID";
64 static const char *int_reason_before
=
65 "X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD";
66 static const char *int_reason_expired
= "X509_V_ERR_CERT_HAS_EXPIRED";
67 static const char *int_reason_after
=
68 "X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD";
70 /* Stolen wholesale from apps/s_cb.c :-) And since then, mutilated ... */
71 int cb_ssl_verify(int ok
, X509_STORE_CTX
*ctx
)
73 char buf1
[256]; /* Used for the subject name */
74 char buf2
[256]; /* Used for the issuer name */
75 const char *reason
= NULL
; /* Error reason (if any) */
79 if (!fp_cb_ssl_verify
|| (cb_ssl_verify_level
== 0))
81 err_cert
= X509_STORE_CTX_get_current_cert(ctx
);
82 err
= X509_STORE_CTX_get_error(ctx
);
83 depth
= X509_STORE_CTX_get_error_depth(ctx
);
85 buf1
[0] = buf2
[0] = '\0';
87 X509_NAME_oneline(X509_get_subject_name(err_cert
), buf1
, 256);
89 X509_NAME_oneline(X509_get_issuer_name(ctx
->current_cert
), buf2
, 256);
91 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT
:
92 reason
= int_reason_no_issuer
;
94 case X509_V_ERR_CERT_NOT_YET_VALID
:
95 reason
= int_reason_not_yet
;
97 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD
:
98 reason
= int_reason_before
;
100 case X509_V_ERR_CERT_HAS_EXPIRED
:
101 reason
= int_reason_expired
;
103 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD
:
104 reason
= int_reason_after
;
108 if ((cb_ssl_verify_level
== 1) && ok
)
110 fprintf(fp_cb_ssl_verify
, "chain-depth=%d, ", depth
);
112 fprintf(fp_cb_ssl_verify
, "error=%s\n", reason
);
114 fprintf(fp_cb_ssl_verify
, "error=%d\n", err
);
115 if (cb_ssl_verify_level
< 3)
117 fprintf(fp_cb_ssl_verify
, "--> subject = %s\n", buf1
);
118 fprintf(fp_cb_ssl_verify
, "--> issuer = %s\n", buf2
);
120 fprintf(fp_cb_ssl_verify
, "--> verify error:num=%d:%s\n", err
,
121 X509_verify_cert_error_string(err
));
122 fprintf(fp_cb_ssl_verify
, "--> verify return:%d\n", ok
);
126 void cb_ssl_verify_set_output(FILE *fp
)
128 fp_cb_ssl_verify
= fp
;
131 void cb_ssl_verify_set_depth(unsigned int verify_depth
)
133 int_verify_depth
= verify_depth
;
136 void cb_ssl_verify_set_level(unsigned int level
)
139 cb_ssl_verify_level
= level
;
142 RSA
*cb_generate_tmp_rsa(SSL
*s
, int is_export
, int keylength
)
145 * TODO: Perhaps make it so our global key can be generated on-the-fly
146 * after certain intervals?
148 static RSA
*rsa_tmp
= NULL
;
150 rsa_tmp
= RSA_generate_key(keylength
, RSA_F4
, NULL
, NULL
);
154 #endif /* !defined(NO_OPENSSL) */