home *** CD-ROM | disk | FTP | other *** search
/ Computer Shopper 217 / DPCS0306DVD.ISO / Toolkit / Internet / FileZilla / Server / FileZilla_Server-0.9.11.exe / source / AsyncSslSocketLayer.cpp < prev    next >
Encoding:
C/C++ Source or Header  |  2005-11-12  |  54.8 KB  |  2,025 lines
  1. /*           CAsyncSslSocketLayer by Tim Kosse 
  2.           mailto: tim.kosse@filezilla-project.org)
  3.                  Version 2.0 (2005-02-27)
  4. -------------------------------------------------------------
  5.  
  6. Introduction
  7. ------------
  8.  
  9. CAsyncSslSocketLayer is a layer class for CAsyncSocketEx which allows you to establish SSL secured
  10. connections. Support for both client and server side is provided.
  11.  
  12. How to use
  13. ----------
  14.  
  15. Using this class is really simple. In the easiest case, just add an instance of
  16. CAsyncSslSocketLayer to your socket and call InitClientSsl after creation of the socket.
  17.  
  18. This class only has a couple of public functions:
  19. - InitSSLConnection(bool clientMode);
  20.   This functions establishes an SSL connection. The clientMode parameter specifies wether the SSL connection 
  21.   is in server or in client mode.
  22.   Most likely you want to call this function right after calling Create for the socket.
  23.   But sometimes, you'll need to call this function later. One example is for an FTP connection
  24.   with explicit SSL: In this case you would have to call InitSSLConnection after receiving the reply
  25.   to an 'AUTH SSL' command.
  26. - Is UsingSSL();
  27.   Returns true if you've previously called InitClientSsl()
  28. - SetNotifyReply(SetNotifyReply(int nID, int nCode, int result);
  29.   You can call this function only after receiving a layerspecific callback with the SSL_VERIFY_CERT 
  30.   id. Set result to 1 if you trust the certificate and 0 if you don't trust it.
  31.   nID has to be the priv_data element of the t_SslCertData structure and nCode has to be SSL_VERIFY_CERT.
  32. - CreateSslCertificate(LPCTSTR filename, int bits, unsigned char* country, unsigned char* state,
  33.             unsigned char* locality, unsigned char* organization, unsigned char* unit, unsigned char* cname,
  34.             unsigned char *email, CString& err);
  35.   Creates a new self-signed SSL certificate and stores it in the given file
  36. - SendRaw(const void* lpBuf, int nBufLen, int nFlags = 0)
  37.   Sends a raw, unencrypted message. This may be useful after successful initialization to tell the other
  38.   side that can use SSL.
  39.  
  40. This layer sends some layerspecific notifications to your socket instance, you can handle them in
  41. OnLayerCallback of your socket class.
  42. Valid notification IDs are:
  43. - SSL_INFO 0
  44.   There are two possible values for param2:
  45.     SSL_INFO_ESTABLISHED 0 - You'll get this notification if the SSL negotiation was successful
  46.     SSL_INFO_SHUTDOWNCOMPLETE 1 - You'll get this notification if the SSL connection has been shut 
  47.                                   down sucessfully. See below for details.
  48. - SSL_FAILURE 1
  49.   This notification is sent if the SSL connection could not be established or if an existing 
  50.   connection failed. Valid values for param2 are:
  51.   - SSL_FAILURE_UNKNOWN 0 - Details may have been sent with a SSL_VERBOSE_* notification.
  52.   - SSL_FAILURE_ESTABLISH 1 - Problem during SSL negotiation
  53.   - SSL_FAILURE_LOADDLLS 2
  54.   - SSL_FAILURE_INITSSL 4
  55.   - SSL_FAILURE_VERIFYCERT 8 - The remote SSL certificate was invalid
  56.   - SSL_FAILURE_CERTREJECTED 16 - The remote SSL certificate was rejected by user
  57. - SSL_VERBOSE_WARNING 3
  58.   SSL_VERBOSE_INFO 4
  59.   This two notifications contain some additional information. The value given by param2 is a 
  60.   pointer to a null-terminated char string (char *) with some useful information.
  61. - SSL_VERIFY_CERT 2
  62.   This notification is sent each time a remote certificate has to be verified.
  63.   param2 is a pointer to a t_SslCertData structure which contains some information
  64.   about the remote certificate.
  65.   You have to set the reply to this message using the SetNotifyReply function.
  66.   
  67. Be careful with closing the connection after sending data, not all data may have been sent already.
  68. Before closing the connection, you should call Shutdown() and wait for the SSL_INFO_SHUTDOWNCOMPLETE
  69. notification. This assures that all encrypted data really has been sent.
  70.  
  71. License
  72. -------
  73.  
  74. Feel free to use this class, as long as you don't claim that you wrote it
  75. and this copyright notice stays intact in the source files.
  76. If you want to use this class in a commercial application, a short message
  77. to tim.kosse@filezilla-project.org would be appreciated but is not required.
  78.  
  79. This product includes software developed by the OpenSSL Project
  80. for use in the OpenSSL Toolkit. (http://www.openssl.org/)
  81.  
  82. Version history
  83. ---------------
  84.  
  85. Version 2.0:
  86. - Add server support
  87. - a lot of bug fixes
  88.  
  89. */
  90.  
  91. #include "stdafx.h"
  92. #include "AsyncSslSocketLayer.h"
  93.  
  94. #if defined _DEBUG && defined _AFX
  95. #define new DEBUG_NEW
  96. #undef THIS_FILE
  97. static char THIS_FILE[] = __FILE__;
  98. #endif
  99.  
  100. // Simple macro to declare function type and function pointer based on the
  101. // three given parametrs:
  102. // r - return type,
  103. // n - function name
  104. // a - argument list
  105. //
  106. // Example:
  107. // def(int, foo, (int x)) becomes the following:
  108. // typedef int (*tfoo)(int x);
  109. // static tfoo pfoo;
  110.  
  111. #define def(r, n, a) \
  112.     typedef r (*t##n) a; \
  113.     static t##n p##n;
  114.  
  115. // Macro to load the given macro from a dll:
  116. #define load(dll, n) \
  117.     p##n = (t##n) GetProcAddress(dll, #n); \
  118.     if (!p##n) \
  119.         bError = true;
  120.  
  121. //The following functions from the SSL libraries are used:
  122. def(int, SSL_state, (SSL *s));
  123. def(char*, SSL_state_string_long, (SSL *s));
  124. def(void, SSL_set_info_callback, (SSL *ssl, void(*cb)()));
  125. def(void, SSL_set_bio, (SSL *s, BIO *rbio, BIO *wbio));
  126. def(void, SSL_set_connect_state, (SSL *s));
  127. def(int, SSL_set_session, (SSL *to, SSL_SESSION *session));
  128. def(BIO_METHOD*, BIO_f_ssl, (void));
  129. def(SSL*, SSL_new, (SSL_CTX *ctx));
  130. def(SSL_CTX*, SSL_CTX_new, (SSL_METHOD *meth));
  131. def(SSL_METHOD*, SSLv23_method, (void));
  132. def(void, SSL_load_error_strings, (void));
  133. def(int, SSL_library_init, (void));
  134. def(void, SSL_CTX_free, (SSL_CTX *));
  135. def(void, SSL_free, (SSL *ssl));
  136. def(int, SSL_get_error, (SSL *s, int retcode));
  137. def(int, SSL_shutdown, (SSL *s));
  138. def(char*, SSL_alert_type_string_long, (int VALUE));
  139. def(char*, SSL_alert_desc_string_long, (int value));
  140. def(void, SSL_CTX_set_verify, (SSL_CTX *ctx, int mode, int (*callback)(int, X509_STORE_CTX *)));
  141. def(X509_STORE*, SSL_CTX_get_cert_store, (SSL_CTX *));
  142. def(long, SSL_get_verify_result, (SSL *ssl));
  143. def(X509*, SSL_get_peer_certificate, (SSL *s));
  144. def(const char*, SSL_get_version, (SSL *ssl));
  145. def(SSL_CIPHER*, SSL_get_current_cipher, (SSL *ssl));
  146. def(const char*, SSL_CIPHER_get_name, (SSL_CIPHER *cipher));
  147. def(char*, SSL_CIPHER_get_version, (SSL_CIPHER *cipher));
  148. def(int, SSL_get_ex_data_X509_STORE_CTX_idx, (void));
  149. def(int, SSL_CTX_load_verify_locations, (SSL_CTX *ctx, const char *CAfile, const char *CApath));
  150. def(long, SSL_ctrl, (SSL *ssl, int cmd, long larg, void *parg));
  151. def(void, SSL_set_accept_state, (SSL *ssl));
  152. def(int, SSL_CTX_use_PrivateKey_file, (SSL_CTX *ctx, const char *file, int type));
  153. def(int, SSL_CTX_use_certificate_file, (SSL_CTX *ctx, const char *file, int type));
  154. def(int, SSL_CTX_check_private_key, (SSL_CTX *ctx));
  155. def(void, SSL_CTX_set_default_passwd_cb, (SSL_CTX *ctx, pem_password_cb *cb));
  156. def(void, SSL_CTX_set_default_passwd_cb_userdata, (SSL_CTX *ctx, void *u));
  157. def(int, SSL_CTX_use_certificate_chain_file, (SSL_CTX *ctx, const char *file));
  158.  
  159. def(size_t, BIO_ctrl_pending, (BIO *b));
  160. def(int, BIO_read, (BIO *b, void *data, int len));
  161. def(long, BIO_ctrl, (BIO *bp, int cmd, long larg, void *parg));
  162. def(int, BIO_write, (BIO *b, const void *data, int len));
  163. def(size_t, BIO_ctrl_get_write_guarantee, (BIO *b));
  164. def(int, BIO_new_bio_pair, (BIO **bio1, size_t writebuf1, BIO **bio2, size_t writebuf2));
  165. def(BIO*, BIO_new, (BIO_METHOD *type));
  166. def(int, BIO_free, (BIO *a));
  167. def(int, i2t_ASN1_OBJECT, (char *buf, int buf_len, ASN1_OBJECT *a));
  168. def(int, OBJ_obj2nid, (ASN1_OBJECT *o));
  169. def(ASN1_OBJECT*, X509_NAME_ENTRY_get_object, (X509_NAME_ENTRY *ne));
  170. def(X509_NAME_ENTRY*, X509_NAME_get_entry, (X509_NAME *name, int loc));
  171. def(int, X509_NAME_entry_count, (X509_NAME *name));
  172. def(X509_NAME*, X509_get_subject_name, (X509 *a));
  173. def(X509_NAME*, X509_get_issuer_name, (X509 *a));
  174. def(const char*, OBJ_nid2sn, (int n));
  175. def(ASN1_STRING*, X509_NAME_ENTRY_get_data, (X509_NAME_ENTRY *ne));
  176. def(void, X509_STORE_CTX_set_error, (X509_STORE_CTX *ctx, int s));
  177. def(int, X509_digest, (const X509 *data, const EVP_MD *type, unsigned char *md, unsigned int *len));
  178. def(EVP_MD*, EVP_sha1, (void));
  179. def(X509*, X509_STORE_CTX_get_current_cert, (X509_STORE_CTX *ctx));
  180. def(int, X509_STORE_CTX_get_error, (X509_STORE_CTX *ctx));
  181. def(void, X509_free, (X509 *a));
  182. def(EVP_PKEY*, X509_get_pubkey, (X509 *x));
  183. def(int, BN_num_bits, (const BIGNUM *a));
  184. def(void, EVP_PKEY_free, (EVP_PKEY *pkey));
  185. def(SSL*, X509_STORE_CTX_get_ex_data, (X509_STORE_CTX *ctx, int idx));
  186. def(char*, X509_NAME_oneline, (X509_NAME *a, char *buf, int size));
  187. def(char*, X509_verify_cert_error_string, (int err));
  188. def(int, X509_STORE_CTX_get_error_depth, (X509_STORE_CTX *ctx));
  189. def(unsigned long, ERR_get_error, (void));
  190. def(char, ERR_error_string, (unsigned long e, char *buf));
  191. def(int, ASN1_STRING_to_UTF8, (unsigned char **out, ASN1_STRING *in));
  192. def(void, CRYPTO_free, (void *p));
  193. def(RSA*, RSA_generate_key, (int num, unsigned long e, void (*callback)(int,int,void *), void *cb_arg));
  194. def(int, X509_set_version, (X509 *x,long version));
  195. def(ASN1_TIME*, X509_gmtime_adj, (ASN1_TIME *s, long adj));
  196. def(int, X509_set_pubkey, (X509 *x, EVP_PKEY *pkey));
  197. def(int, X509_NAME_add_entry_by_txt, (X509_NAME *name, char *field, int type, unsigned char *bytes, int len, int loc, int set));
  198. def(int, X509_NAME_add_entry_by_NID, (X509_NAME *name, int nid, int type, unsigned char *bytes, int len, int loc, int set));
  199. def(int, X509_set_issuer_name, (X509 *x, X509_NAME *name));
  200. def(int, X509_sign, (X509 *x, EVP_PKEY *pkey, const EVP_MD *md));
  201. def(EVP_PKEY*, EVP_PKEY_new, (void));
  202. def(int, EVP_PKEY_assign, (EVP_PKEY *pkey,int type,char *key));
  203. def(X509*, X509_new, (void));
  204. def(int, ASN1_INTEGER_set, (ASN1_INTEGER *a, long v));
  205. def(ASN1_INTEGER*, X509_get_serialNumber, (X509 *x));
  206. def(int, PEM_write_PrivateKey, (FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc, unsigned char *kstr, int klen, pem_password_cb *cb, void *u));
  207. def(int, PEM_ASN1_write_bio, (int (*i2d)(),const char *name,BIO *bp,char *x, const EVP_CIPHER *enc,unsigned char *kstr,int klen, pem_password_cb *callback, void *u));
  208. def(int, i2d_X509, (X509 *x, unsigned char **out));
  209. def(BIO_METHOD *, BIO_s_mem, (void));
  210. def(int, i2d_PrivateKey, (EVP_PKEY *a, unsigned char **pp));
  211.  
  212. // Critical section wrapper class
  213. #ifndef CCRITICALSECTIONWRAPPERINCLUDED
  214. class CCriticalSectionWrapper
  215. {
  216. public:
  217.     CCriticalSectionWrapper()
  218.     {
  219.         m_bInitialized = TRUE;
  220.         InitializeCriticalSection(&m_criticalSection);
  221.     }
  222.  
  223.     ~CCriticalSectionWrapper()
  224.     {
  225.         if (m_bInitialized)
  226.             DeleteCriticalSection(&m_criticalSection);
  227.         m_bInitialized = FALSE;
  228.     }
  229.  
  230.     void Lock()
  231.     {
  232.         if (m_bInitialized)
  233.             EnterCriticalSection(&m_criticalSection);
  234.     }
  235.     void Unlock()
  236.     {
  237.         if (m_bInitialized)
  238.             LeaveCriticalSection(&m_criticalSection);
  239.     }
  240. protected:
  241.     CRITICAL_SECTION m_criticalSection;
  242.     BOOL m_bInitialized;
  243. };
  244. #define CCRITICALSECTIONWRAPPERINCLUDED
  245. #endif
  246.  
  247. /////////////////////////////////////////////////////////////////////////////
  248. // CAsyncSslSocketLayer
  249. CCriticalSectionWrapper CAsyncSslSocketLayer::m_sCriticalSection;
  250.  
  251. CAsyncSslSocketLayer::t_SslLayerList* CAsyncSslSocketLayer::m_pSslLayerList = 0;
  252. int CAsyncSslSocketLayer::m_nSslRefCount = 0;
  253. HMODULE CAsyncSslSocketLayer::m_hSslDll1 = 0;
  254. HMODULE CAsyncSslSocketLayer::m_hSslDll2 = 0;
  255. std::map<SSL_CTX *, int> CAsyncSslSocketLayer::m_contextRefCount;
  256.  
  257. CAsyncSslSocketLayer::CAsyncSslSocketLayer()
  258. {
  259.     m_ssl = 0;
  260.     m_sslbio = 0;
  261.     m_ibio = 0;
  262.     m_nbio = 0;
  263.     m_ssl_ctx = 0;
  264.  
  265.     m_bUseSSL = false;
  266.     m_bSslInitialized = FALSE;
  267.     m_bSslEstablished = FALSE;
  268.     m_nNetworkSendBufferLen = 0;
  269.     m_nNetworkSendBufferMaxLen = 0;
  270.     m_pNetworkSendBuffer = NULL;
  271.     m_nNetworkError = 0;
  272.     m_nShutDown = 0;
  273.  
  274.     m_bBlocking = FALSE;
  275.     m_nSslAsyncNotifyId = 0;
  276.     m_bFailureSent = FALSE;
  277.     m_nVerificationResult = 0;
  278.     m_nVerificationDepth = 0;
  279.     m_mayTriggerRead = true;
  280.     m_mayTriggerWrite = true;
  281.     m_mayTriggerReadUp = true;
  282.     m_mayTriggerWriteUp = true;
  283.  
  284.     m_onCloseCalled = false;
  285.     m_pKeyPassword = 0;
  286. }
  287.  
  288. CAsyncSslSocketLayer::~CAsyncSslSocketLayer()
  289. {
  290.     UnloadSSL();
  291.     delete [] m_pNetworkSendBuffer;
  292.     delete [] m_pKeyPassword;
  293. }
  294.  
  295. int CAsyncSslSocketLayer::InitSSL()
  296. {
  297.     if (m_bSslInitialized)
  298.         return 0;
  299.  
  300.     m_sCriticalSection.Lock();
  301.  
  302.     if (!m_nSslRefCount)
  303.     {
  304.         m_hSslDll2=
  305.             LoadLibrary(_T("libeay32.dll"));
  306.         if (!m_hSslDll2)
  307.         {
  308.             if (m_hSslDll1)
  309.                 FreeLibrary(m_hSslDll1);
  310.             m_hSslDll1=0;
  311.  
  312.             m_sCriticalSection.Unlock();
  313.             return SSL_FAILURE_LOADDLLS;
  314.         }
  315.  
  316.         bool bError = false;
  317.         load(m_hSslDll2, BIO_ctrl_pending);
  318.         load(m_hSslDll2, BIO_ctrl_pending);
  319.         load(m_hSslDll2, BIO_read);
  320.         load(m_hSslDll2, BIO_ctrl);
  321.         load(m_hSslDll2, BIO_write);
  322.         load(m_hSslDll2, BIO_ctrl_get_write_guarantee);
  323.         load(m_hSslDll2, BIO_new_bio_pair);
  324.         load(m_hSslDll2, BIO_new);
  325.         load(m_hSslDll2, BIO_free);
  326.         load(m_hSslDll2, i2t_ASN1_OBJECT);
  327.         load(m_hSslDll2, OBJ_obj2nid);
  328.         load(m_hSslDll2, X509_NAME_ENTRY_get_object);
  329.         load(m_hSslDll2, X509_NAME_get_entry);
  330.         load(m_hSslDll2, X509_NAME_entry_count);
  331.         load(m_hSslDll2, X509_get_subject_name);
  332.         load(m_hSslDll2, X509_get_issuer_name);
  333.         load(m_hSslDll2, OBJ_nid2sn);
  334.         load(m_hSslDll2, X509_NAME_ENTRY_get_data);
  335.         load(m_hSslDll2, X509_STORE_CTX_set_error);
  336.         load(m_hSslDll2, X509_digest);
  337.         load(m_hSslDll2, EVP_sha1);
  338.         load(m_hSslDll2, X509_STORE_CTX_get_current_cert);
  339.         load(m_hSslDll2, X509_STORE_CTX_get_error);
  340.         load(m_hSslDll2, X509_free);
  341.         load(m_hSslDll2, X509_get_pubkey);
  342.         load(m_hSslDll2, BN_num_bits);
  343.         load(m_hSslDll2, EVP_PKEY_free);
  344.         load(m_hSslDll2, X509_STORE_CTX_get_ex_data);
  345.         load(m_hSslDll2, X509_NAME_oneline);
  346.         load(m_hSslDll2, X509_verify_cert_error_string);
  347.         load(m_hSslDll2, X509_STORE_CTX_get_error_depth);
  348.         load(m_hSslDll2, ERR_get_error);
  349.         load(m_hSslDll2, ERR_error_string);
  350.         load(m_hSslDll2, ASN1_STRING_to_UTF8);
  351.         load(m_hSslDll2, CRYPTO_free);
  352.         load(m_hSslDll2, RSA_generate_key);
  353.         load(m_hSslDll2, X509_set_version);
  354.         load(m_hSslDll2, X509_gmtime_adj);
  355.         load(m_hSslDll2, X509_set_pubkey);
  356.         load(m_hSslDll2, X509_NAME_add_entry_by_txt);
  357.         load(m_hSslDll2, X509_NAME_add_entry_by_NID);
  358.         load(m_hSslDll2, X509_set_issuer_name);
  359.         load(m_hSslDll2, X509_sign);
  360.         load(m_hSslDll2, EVP_PKEY_new);
  361.         load(m_hSslDll2, EVP_PKEY_assign);
  362.         load(m_hSslDll2, X509_new);
  363.         load(m_hSslDll2, ASN1_INTEGER_set);
  364.         load(m_hSslDll2, X509_get_serialNumber);
  365.         load(m_hSslDll2, PEM_write_PrivateKey);
  366.         load(m_hSslDll2, PEM_ASN1_write_bio);
  367.         load(m_hSslDll2, i2d_X509);
  368.         load(m_hSslDll2, BIO_s_mem);
  369.         load(m_hSslDll2, i2d_PrivateKey);
  370.  
  371.         if (bError)
  372.         {
  373.             FreeLibrary(m_hSslDll1);
  374.             m_hSslDll1 = 0;
  375.             FreeLibrary(m_hSslDll2);
  376.             m_hSslDll2 = 0;
  377.  
  378.             m_sCriticalSection.Unlock();
  379.             return SSL_FAILURE_LOADDLLS;
  380.         }
  381.  
  382.         m_hSslDll1 = LoadLibrary(_T("ssleay32.dll"));
  383.         if (!m_hSslDll1)
  384.         {
  385.             if (m_hSslDll2)
  386.                 FreeLibrary(m_hSslDll2);
  387.             m_hSslDll2 = NULL;
  388.             
  389.             m_sCriticalSection.Unlock();
  390.             return SSL_FAILURE_LOADDLLS;
  391.         }
  392.         load(m_hSslDll1, SSL_state_string_long);
  393.         load(m_hSslDll1, SSL_state);
  394.         load(m_hSslDll1, SSL_set_info_callback);
  395.         load(m_hSslDll1, SSL_set_bio);
  396.         load(m_hSslDll1, SSL_set_connect_state);
  397.         load(m_hSslDll1, SSL_set_session);
  398.         load(m_hSslDll1, BIO_f_ssl);
  399.         load(m_hSslDll1, SSL_new);
  400.         load(m_hSslDll1, SSL_CTX_new);
  401.         load(m_hSslDll1, SSLv23_method);
  402.         load(m_hSslDll1, SSL_load_error_strings);
  403.         load(m_hSslDll1, SSL_library_init);
  404.         load(m_hSslDll1, SSL_CTX_free);
  405.         load(m_hSslDll1, SSL_free);
  406.         load(m_hSslDll1, SSL_get_error);
  407.         load(m_hSslDll1, SSL_shutdown);
  408.         load(m_hSslDll1, SSL_alert_type_string_long);
  409.         load(m_hSslDll1, SSL_alert_desc_string_long);
  410.         load(m_hSslDll1, SSL_CTX_set_verify);
  411.         load(m_hSslDll1, SSL_CTX_get_cert_store);
  412.         load(m_hSslDll1, SSL_get_verify_result);
  413.         load(m_hSslDll1, SSL_get_peer_certificate);
  414.         load(m_hSslDll1, SSL_get_version);
  415.         load(m_hSslDll1, SSL_get_current_cipher);
  416.         load(m_hSslDll1, SSL_CIPHER_get_name);
  417.         load(m_hSslDll1, SSL_CIPHER_get_version);
  418.         load(m_hSslDll1, SSL_get_ex_data_X509_STORE_CTX_idx);
  419.         load(m_hSslDll1, SSL_CTX_load_verify_locations);
  420.         load(m_hSslDll1, SSL_ctrl);
  421.         load(m_hSslDll1, SSL_set_accept_state);
  422.         load(m_hSslDll1, SSL_CTX_use_PrivateKey_file);
  423.         load(m_hSslDll1, SSL_CTX_use_certificate_file);
  424.         load(m_hSslDll1, SSL_CTX_check_private_key);
  425.         load(m_hSslDll1, SSL_CTX_set_default_passwd_cb_userdata);
  426.         load(m_hSslDll1, SSL_CTX_set_default_passwd_cb);
  427.         load(m_hSslDll1, SSL_CTX_use_certificate_chain_file);
  428.  
  429.         if (bError)
  430.         {
  431.             FreeLibrary(m_hSslDll1);
  432.             m_hSslDll1=0;
  433.             if (m_hSslDll2)
  434.                 FreeLibrary(m_hSslDll2);
  435.             m_hSslDll2=0;
  436.  
  437.             m_sCriticalSection.Unlock();
  438.             return SSL_FAILURE_LOADDLLS;
  439.         }
  440.  
  441.         pSSL_load_error_strings();
  442.         if (!pSSL_library_init())
  443.         {
  444.             FreeLibrary(m_hSslDll1);
  445.             m_hSslDll1=0;
  446.             FreeLibrary(m_hSslDll2);
  447.             m_hSslDll2=0;
  448.  
  449.             m_sCriticalSection.Unlock();
  450.             return SSL_FAILURE_INITSSL;
  451.         }
  452.     }
  453.  
  454.     m_nSslRefCount++;
  455.     m_sCriticalSection.Unlock();
  456.  
  457.     m_bSslInitialized = true;
  458.  
  459.     return 0;
  460. }
  461.  
  462. void CAsyncSslSocketLayer::OnReceive(int nErrorCode)
  463. {
  464.     if (m_bUseSSL)
  465.     {
  466.         if (m_bBlocking)
  467.         {
  468.             m_mayTriggerRead = true;
  469.             return;
  470.         }
  471.         if (m_nNetworkError)
  472.             return;
  473.  
  474.         char buffer[16384];
  475.  
  476.         m_mayTriggerRead = false;
  477.         
  478.         //Get number of bytes we can receive and store in the network input bio
  479.         int len = pBIO_ctrl_get_write_guarantee(m_nbio);
  480.         if (len > 16384)
  481.             len = 16384;
  482.         else if (!len)
  483.         {
  484.             m_mayTriggerRead = true;
  485.             TriggerEvents();
  486.             return;
  487.         }
  488.         
  489.         int numread = 0;
  490.         
  491.         // Receive data
  492.         numread = ReceiveNext(buffer, len);
  493.         if (numread > 0)
  494.         {
  495.             //Store it in the network input bio and process data
  496.             int numwritten = pBIO_write(m_nbio, buffer, numread);
  497.             pBIO_ctrl(m_nbio, BIO_CTRL_FLUSH, 0, NULL);
  498.  
  499.             //Look if input data was valid
  500.             int res = pBIO_read(m_sslbio, (void *)1, 0);
  501.             if (res < 0)
  502.             {
  503.                 if (!m_sslbio || !BIO_should_retry(m_sslbio))
  504.                 {
  505.                     PrintLastErrorMsg();
  506.                     m_nNetworkError = WSAECONNABORTED;
  507.                     WSASetLastError(WSAECONNABORTED);
  508.                     if (!m_bFailureSent)
  509.                     {
  510.                         m_bFailureSent = TRUE;
  511.                         DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_FAILURE, m_bSslEstablished ? SSL_FAILURE_UNKNOWN : SSL_FAILURE_ESTABLISH);
  512.                     }
  513.                     TriggerEvent(FD_CLOSE, 0, TRUE);
  514.                     return;
  515.                 }
  516.             }
  517.         }
  518.         if (!numread)
  519.         {
  520.             if (GetLayerState() == connected)
  521.                 TriggerEvent(FD_CLOSE, nErrorCode, TRUE);
  522.         }
  523.         else if (numread == SOCKET_ERROR)
  524.         {
  525.             int nError = GetLastError();
  526.             if (nError != WSAEWOULDBLOCK && nError != WSAENOTCONN)
  527.             {
  528.                 m_nNetworkError = GetLastError();
  529.                 TriggerEvent(FD_CLOSE, 0, TRUE);
  530.                 return;
  531.             }
  532.         }
  533.  
  534.         if (ShutDownComplete() && m_nShutDown == 1)
  535.         {
  536.             //Send shutdown notification if all pending data has been sent
  537.             DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_INFO, SSL_INFO_SHUTDOWNCOMPLETE);
  538.             m_nShutDown++;
  539.         }
  540.  
  541.         TriggerEvents();
  542.     }
  543.     else
  544.         TriggerEvent(FD_READ, nErrorCode, TRUE);
  545. }
  546.  
  547. void CAsyncSslSocketLayer::OnSend(int nErrorCode)
  548. {
  549.     if (m_bUseSSL)
  550.     {
  551.         if (m_nNetworkError)
  552.             return;
  553.  
  554.         m_mayTriggerWrite = false;
  555.  
  556.         //Send data in the send buffer
  557.         while (m_nNetworkSendBufferLen)
  558.         {
  559.             int numsent = SendNext(m_pNetworkSendBuffer, m_nNetworkSendBufferLen);
  560.             if (numsent == SOCKET_ERROR)
  561.             {
  562.                 int nError = GetLastError();
  563.                 if (nError != WSAEWOULDBLOCK && nError != WSAENOTCONN)
  564.                 {
  565.                     m_nNetworkError = nError;
  566.                     TriggerEvent(FD_CLOSE, 0, TRUE);
  567.                 }
  568.                 return;
  569.             }
  570.             else if (!numsent)
  571.             {
  572.                 if (GetLayerState() == connected)
  573.                     TriggerEvent(FD_CLOSE, nErrorCode, TRUE);
  574.             }
  575.             if (numsent == m_nNetworkSendBufferLen)
  576.                 m_nNetworkSendBufferLen = 0;
  577.             else
  578.             {
  579.                 memmove(m_pNetworkSendBuffer, m_pNetworkSendBuffer + numsent, m_nNetworkSendBufferLen - numsent);
  580.                 m_nNetworkSendBufferLen -= numsent;
  581.             }
  582.         }
  583.  
  584.         //Send the data waiting in the network bio
  585.         char buffer[16384];
  586.         int len = pBIO_ctrl_pending(m_nbio);
  587.         int numread = pBIO_read(m_nbio, buffer, len);
  588.         if (numread <= 0)
  589.             m_mayTriggerWrite = true;
  590.         while (numread > 0)
  591.         {
  592.             int numsent = SendNext(buffer, numread);
  593.             if (!numsent)
  594.             {
  595.                 if (GetLayerState() == connected)
  596.                     TriggerEvent(FD_CLOSE, nErrorCode, TRUE);
  597.             }
  598.             if (numsent == SOCKET_ERROR || numsent < numread)
  599.             {
  600.                 if (numsent == SOCKET_ERROR)
  601.                     if (GetLastError() != WSAEWOULDBLOCK && GetLastError() != WSAENOTCONN)
  602.                     {
  603.                         m_nNetworkError = GetLastError();
  604.                         TriggerEvent(FD_CLOSE, 0, TRUE);
  605.                         return;
  606.                     }
  607.                     else
  608.                         numsent = 0;
  609.  
  610.                 // Add all data that was retrieved from the network bio but could not be sent to the send buffer.
  611.                 if (m_nNetworkSendBufferMaxLen < (m_nNetworkSendBufferLen + numread - numsent))
  612.                 {
  613.                     char * tmp = m_pNetworkSendBuffer;
  614.                     m_nNetworkSendBufferMaxLen = static_cast<int>((m_nNetworkSendBufferLen + numread - numsent) * 1.5);
  615.                     m_pNetworkSendBuffer = new char[m_nNetworkSendBufferMaxLen];                    
  616.                     if (tmp)
  617.                     {
  618.                         memcpy(m_pNetworkSendBuffer, tmp, m_nNetworkSendBufferLen);
  619.                         delete [] tmp;
  620.                     }
  621.                 }
  622.                 ASSERT(m_pNetworkSendBuffer);
  623.                 memcpy(m_pNetworkSendBuffer + m_nNetworkSendBufferLen, buffer, numread-numsent);
  624.                 m_nNetworkSendBufferLen += numread - numsent;
  625.             }
  626.             if (!numsent)
  627.                 break;
  628.             len = pBIO_ctrl_pending(m_nbio);
  629.             if (!len)
  630.             {
  631.                 m_mayTriggerWrite = true;
  632.                 break;
  633.             }
  634.             numread = pBIO_read(m_nbio, buffer, len);
  635.             if (numread <= 0)
  636.                 m_mayTriggerWrite = true;
  637.         }
  638.         // No more data available, ask for more.
  639.         TriggerEvents();
  640.         if (m_nShutDown == 1 && ShutDownComplete())
  641.         {
  642.             //Send shutdown notification if all pending data has been sent
  643.             DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_INFO, SSL_INFO_SHUTDOWNCOMPLETE);
  644.             m_nShutDown++;
  645.         }
  646.     }
  647.     else
  648.         TriggerEvent(FD_WRITE, nErrorCode, TRUE);
  649. }
  650.  
  651. int CAsyncSslSocketLayer::Send(const void* lpBuf, int nBufLen, int nFlags)
  652. {
  653.     if (m_bUseSSL)
  654.     {
  655.         if (!lpBuf)
  656.             return 0;
  657.         if (m_bBlocking)
  658.         {
  659.             m_mayTriggerWriteUp = true;
  660.             SetLastError(WSAEWOULDBLOCK);
  661.             return SOCKET_ERROR;
  662.         }
  663.         if (m_nNetworkError)
  664.         {
  665.             SetLastError(m_nNetworkError);
  666.             return SOCKET_ERROR;
  667.         }
  668.         if (m_nShutDown)
  669.         {
  670.             SetLastError(WSAESHUTDOWN);
  671.             return SOCKET_ERROR;
  672.         }
  673.         if (!m_bSslEstablished)
  674.         {
  675.             m_mayTriggerWriteUp = true;
  676.             SetLastError(WSAEWOULDBLOCK);
  677.             return SOCKET_ERROR;
  678.         }
  679.         if (!nBufLen)
  680.             return 0;
  681.  
  682.         if (m_onCloseCalled)
  683.         {
  684.             TriggerEvent(FD_CLOSE, 0, TRUE);
  685.             return 0;
  686.         }
  687.  
  688.         int numwrite = pBIO_write(m_sslbio, lpBuf, nBufLen);
  689.         if (numwrite >= 0)
  690.             pBIO_ctrl(m_sslbio, BIO_CTRL_FLUSH, 0, NULL);
  691.         else if (numwrite == -1)
  692.         {
  693.             if (BIO_should_retry(m_sslbio))
  694.             {
  695.                 if (GetLayerState() == closed)
  696.                     return 0;
  697.                 else if (GetLayerState() != connected)
  698.                 {
  699.                     SetLastError(m_nNetworkError);
  700.                     return SOCKET_ERROR;
  701.                 }
  702.                 m_mayTriggerWriteUp = true;
  703.                 TriggerEvents();
  704.                 SetLastError(WSAEWOULDBLOCK);
  705.             }
  706.             else
  707.                 SetLastError(WSAECONNABORTED);
  708.             return SOCKET_ERROR;
  709.         }
  710.  
  711.         m_mayTriggerWriteUp = true;
  712.         TriggerEvents();
  713.  
  714.         return numwrite;
  715.     }
  716.     else
  717.     {
  718.         return SendNext(lpBuf, nBufLen, nFlags);
  719.     }
  720. }
  721.  
  722. int CAsyncSslSocketLayer::Receive(void* lpBuf, int nBufLen, int nFlags)
  723. {
  724.     if (m_bUseSSL)
  725.     {
  726.         if (m_bBlocking)
  727.         {
  728.             SetLastError(WSAEWOULDBLOCK);
  729.             return SOCKET_ERROR;
  730.         }
  731.         if (m_nNetworkError)
  732.         {
  733.             if (pBIO_ctrl(m_sslbio, BIO_CTRL_PENDING, 0, NULL) && !m_nShutDown)
  734.             {
  735.                 return pBIO_read(m_sslbio, lpBuf,nBufLen);
  736.             }
  737.             WSASetLastError(m_nNetworkError);
  738.             return SOCKET_ERROR;
  739.         }
  740.         if (m_nShutDown)
  741.         {
  742.             SetLastError(WSAESHUTDOWN);
  743.             return SOCKET_ERROR;
  744.         }
  745.         if (!nBufLen)
  746.             return 0;
  747.         if (!pBIO_ctrl(m_sslbio, BIO_CTRL_PENDING, 0, NULL))
  748.         {
  749.             if (GetLayerState() == closed)
  750.                 return 0;
  751.             if (m_onCloseCalled)
  752.             {
  753.                 TriggerEvent(FD_CLOSE, 0, TRUE);
  754.                 return 0;
  755.             }
  756.             else if (GetLayerState() != connected)
  757.             {
  758.                 SetLastError(m_nNetworkError);
  759.                 return SOCKET_ERROR;
  760.             }
  761.             m_mayTriggerReadUp = true;
  762.             TriggerEvents();
  763.             SetLastError(WSAEWOULDBLOCK);
  764.             return SOCKET_ERROR;
  765.         }
  766.         int numread = pBIO_read(m_sslbio, lpBuf, nBufLen);
  767.         if (!numread)
  768.         {
  769.             m_mayTriggerReadUp = true;
  770.             TriggerEvents();
  771.             SetLastError(WSAEWOULDBLOCK);
  772.             return SOCKET_ERROR;
  773.         }
  774.         if (numread < 0)
  775.             if (!BIO_should_retry(m_sslbio))
  776.             {
  777.                 PrintLastErrorMsg();
  778.                 m_nNetworkError = WSAECONNABORTED;
  779.                 WSASetLastError(WSAECONNABORTED);
  780.                 TriggerEvent(FD_CLOSE, 0, TRUE);
  781.                 return SOCKET_ERROR;
  782.             }
  783.             else
  784.             {
  785.                 m_mayTriggerReadUp = true;
  786.                 TriggerEvents();
  787.                 SetLastError(WSAEWOULDBLOCK);
  788.                 return SOCKET_ERROR;
  789.             }
  790.  
  791.         m_mayTriggerReadUp = true;
  792.         TriggerEvents();
  793.         return numread;
  794.     }
  795.     else
  796.         return ReceiveNext(lpBuf, nBufLen, nFlags);
  797. }
  798.  
  799. void CAsyncSslSocketLayer::Close()
  800. {
  801.     m_nShutDown = 0;
  802.     m_onCloseCalled = false;
  803.     ResetSslSession();
  804.     CloseNext();
  805. }
  806.  
  807. BOOL CAsyncSslSocketLayer::Connect(const SOCKADDR *lpSockAddr, int nSockAddrLen)
  808. {
  809.     BOOL res = ConnectNext(lpSockAddr, nSockAddrLen);
  810.     if (!res)
  811.         if (GetLastError() != WSAEWOULDBLOCK)
  812.             ResetSslSession();
  813.     return res;
  814. }
  815.  
  816. BOOL CAsyncSslSocketLayer::Connect(LPCTSTR lpszHostAddress, UINT nHostPort)
  817. {
  818.     BOOL res = ConnectNext(lpszHostAddress, nHostPort);
  819.     if (!res)
  820.         if (GetLastError()!=WSAEWOULDBLOCK)
  821.             ResetSslSession();
  822.     return res;
  823. }
  824.  
  825. int CAsyncSslSocketLayer::InitSSLConnection(bool clientMode, void* pSslContext /*=0*/)
  826. {
  827.     if (m_bUseSSL)
  828.         return 0;
  829.     int res = InitSSL();
  830.     if (res)
  831.         return res;
  832.  
  833.     m_sCriticalSection.Lock();
  834.     if ((SSL_CTX*)pSslContext)
  835.     {
  836.         if (m_ssl_ctx)
  837.         {
  838.             m_sCriticalSection.Unlock();
  839.             ResetSslSession();
  840.             return SSL_FAILURE_INITSSL;
  841.         }
  842.  
  843.         std::map<SSL_CTX *, int>::iterator& iter = m_contextRefCount.find((SSL_CTX*)pSslContext);
  844.         if (iter == m_contextRefCount.end() || iter->second < 1)
  845.         {
  846.             m_sCriticalSection.Unlock();
  847.             ResetSslSession();
  848.             return SSL_FAILURE_INITSSL;
  849.         }
  850.         m_ssl_ctx = (SSL_CTX*)pSslContext;
  851.         iter->second++;
  852.     }
  853.     else if (!m_ssl_ctx)
  854.     {
  855.         // Create new context if none given
  856.         if (!(m_ssl_ctx = pSSL_CTX_new( pSSLv23_method())))
  857.         {
  858.             m_sCriticalSection.Unlock();
  859.             ResetSslSession();
  860.             return SSL_FAILURE_INITSSL;
  861.         }
  862.         m_contextRefCount[m_ssl_ctx] = 1;
  863.  
  864.         if (clientMode)
  865.         {
  866.             USES_CONVERSION;
  867.             pSSL_CTX_set_verify(m_ssl_ctx, SSL_VERIFY_PEER, verify_callback);
  868.             pSSL_CTX_load_verify_locations(m_ssl_ctx, T2CA(m_CertStorage), 0);
  869.         }
  870.     }
  871.  
  872.     //Create new SSL session
  873.     if (!(m_ssl = pSSL_new(m_ssl_ctx)))
  874.     {
  875.         m_sCriticalSection.Unlock();
  876.         ResetSslSession();
  877.         return SSL_FAILURE_INITSSL;
  878.     }
  879.  
  880.     //Add current instance to list of active instances
  881.     t_SslLayerList *tmp = m_pSslLayerList;
  882.     m_pSslLayerList = new t_SslLayerList;
  883.     m_pSslLayerList->pNext = tmp;
  884.     m_pSslLayerList->pLayer = this;
  885.     m_sCriticalSection.Unlock();
  886.  
  887.     pSSL_set_info_callback(m_ssl, (void(*)())apps_ssl_info_callback);
  888.  
  889.     //Create bios
  890.     m_sslbio = pBIO_new(pBIO_f_ssl());
  891.     pBIO_new_bio_pair(&m_ibio, 4096, &m_nbio, 4096);
  892.  
  893.     if (!m_sslbio || !m_nbio || !m_ibio)
  894.     {
  895.         ResetSslSession();
  896.         return SSL_FAILURE_INITSSL;
  897.     }
  898.  
  899.     long options = pSSL_ctrl(m_ssl, SSL_CTRL_OPTIONS, 0, NULL);
  900.     options |= SSL_OP_ALL;
  901.     pSSL_ctrl(m_ssl, SSL_CTRL_OPTIONS, options, NULL);
  902.  
  903.     //Init SSL connection
  904.     pSSL_set_session(m_ssl, NULL);
  905.     if (clientMode)
  906.         pSSL_set_connect_state(m_ssl);
  907.     else
  908.         pSSL_set_accept_state(m_ssl);
  909.     pSSL_set_bio(m_ssl, m_ibio, m_ibio);
  910.     pBIO_ctrl(m_sslbio, BIO_C_SET_SSL, BIO_NOCLOSE, m_ssl);
  911.     pBIO_read(m_sslbio, (void *)1, 0);
  912.  
  913.     // Trigger FD_WRITE so that we can initialize SSL negotiation
  914.     if (GetLayerState() == connected || GetLayerState() == attached)
  915.     {
  916.         TriggerEvent(FD_READ, 0);
  917.         TriggerEvent(FD_WRITE, 0);
  918.         TriggerEvent(FD_READ, 0, TRUE);
  919.         TriggerEvent(FD_WRITE, 0, TRUE);
  920.     }
  921.  
  922.     m_bUseSSL = true;
  923.  
  924.     return 0;
  925. }
  926.  
  927. void CAsyncSslSocketLayer::ResetSslSession()
  928. {
  929.     m_bFailureSent = FALSE;
  930.     m_bBlocking = FALSE;
  931.     m_nSslAsyncNotifyId++;
  932.     m_nNetworkError = 0;
  933.     m_bUseSSL = FALSE;
  934.     m_nVerificationResult = 0;
  935.     m_nVerificationDepth = 0;
  936.  
  937.     m_bSslEstablished = FALSE;
  938.     if (m_sslbio)
  939.         pBIO_free(m_sslbio);
  940.     if (m_ssl)
  941.         pSSL_set_session(m_ssl,NULL);
  942.     if (m_nbio)
  943.         pBIO_free(m_nbio);
  944.     if (m_ibio)
  945.         pBIO_free(m_ibio);
  946.  
  947.     m_nNetworkSendBufferLen = 0;
  948.  
  949.     m_nbio = 0;
  950.     m_ibio = 0;
  951.     m_sslbio = 0;
  952.  
  953.     if (m_ssl)
  954.         pSSL_free(m_ssl);
  955.  
  956.     m_sCriticalSection.Lock();
  957.  
  958.     if (m_ssl_ctx)
  959.     {
  960.         std::map<SSL_CTX *, int>::iterator& iter = m_contextRefCount.find(m_ssl_ctx);
  961.         if (iter != m_contextRefCount.end())
  962.         {
  963.             if (iter->second <= 1)
  964.             {
  965.                 pSSL_CTX_free(m_ssl_ctx);
  966.                 m_contextRefCount.erase(iter);
  967.             }
  968.             else
  969.                 iter->second--;
  970.         }
  971.         m_ssl_ctx = 0;
  972.     }
  973.  
  974.     delete [] m_pKeyPassword;
  975.     m_pKeyPassword = 0;
  976.  
  977.     m_ssl = 0;
  978.     t_SslLayerList *cur = m_pSslLayerList;
  979.     if (!cur)
  980.     {
  981.         m_sCriticalSection.Unlock();
  982.         return;
  983.     }
  984.  
  985.     if (cur->pLayer == this)
  986.     {
  987.         m_pSslLayerList = cur->pNext;
  988.         delete cur;
  989.     }
  990.     else
  991.         while (cur->pNext)
  992.         {
  993.             if (cur->pNext->pLayer == this)
  994.             {
  995.                 t_SslLayerList *tmp = cur->pNext;
  996.                 cur->pNext = cur->pNext->pNext;
  997.                 delete tmp;
  998.  
  999.                 m_sCriticalSection.Unlock();
  1000.                 return;
  1001.             }
  1002.             cur = cur->pNext;
  1003.         }
  1004.     m_sCriticalSection.Unlock();
  1005. }
  1006.  
  1007. bool CAsyncSslSocketLayer::IsUsingSSL()
  1008. {
  1009.     return m_bUseSSL;
  1010. }
  1011.  
  1012. BOOL CAsyncSslSocketLayer::ShutDown(int nHow /*=sends*/)
  1013. {
  1014.     if (m_bUseSSL)
  1015.     {
  1016.         if (!m_nShutDown)
  1017.             m_nShutDown = 1;
  1018.         else
  1019.         {
  1020.             if (ShutDownComplete())
  1021.                 return ShutDownNext();
  1022.             else
  1023.             {
  1024.                 TriggerEvents();
  1025.                 WSASetLastError(WSAEWOULDBLOCK);
  1026.                 return false;
  1027.             }
  1028.         }
  1029.         
  1030.         int res = pSSL_shutdown(m_ssl);
  1031.         if (res != -1)
  1032.         {
  1033.             if (!res)
  1034.                 pSSL_shutdown(m_ssl);
  1035.             if (ShutDownComplete())
  1036.                 return ShutDownNext();
  1037.             else
  1038.             {
  1039.                 TriggerEvents();
  1040.                 WSASetLastError(WSAEWOULDBLOCK);
  1041.                 return FALSE;
  1042.             }
  1043.         }
  1044.         else
  1045.         {
  1046.             int error = pSSL_get_error(m_ssl, -1);
  1047.             if (error == SSL_ERROR_WANT_READ || error == SSL_ERROR_WANT_WRITE)
  1048.             {
  1049.                 TriggerEvents();
  1050.                 WSASetLastError(WSAEWOULDBLOCK);
  1051.                 return FALSE;
  1052.             }
  1053.             else if (ShutDownComplete())
  1054.                 return ShutDownNext();
  1055.             else
  1056.             {
  1057.                 TriggerEvents();
  1058.                 WSASetLastError(WSAEWOULDBLOCK);
  1059.                 return FALSE;
  1060.             }
  1061.         }
  1062.     }
  1063.     else
  1064.     {
  1065.         if (!m_nShutDown)
  1066.             m_nShutDown = 1;
  1067.         return ShutDownNext(nHow);
  1068.     }
  1069. }
  1070.  
  1071. BOOL CAsyncSslSocketLayer::ShutDownComplete()
  1072. {
  1073.     //If a ShutDown was issued, has the connection already been shut down?
  1074.     if (!m_nShutDown)
  1075.         return FALSE;
  1076.     else if (!m_bUseSSL)
  1077.         return FALSE;
  1078.     else if (m_nNetworkSendBufferLen)
  1079.         return FALSE;
  1080.     
  1081.     // Empty read buffer
  1082.     char buffer[1000];
  1083.     int numread;
  1084.     do
  1085.     {
  1086.         numread = pBIO_read(m_sslbio, buffer, 1000);
  1087.     } while (numread > 0);
  1088.  
  1089.     if (pBIO_ctrl_pending(m_nbio))
  1090.         return FALSE;
  1091.     else
  1092.         return TRUE;
  1093. }
  1094.  
  1095. void CAsyncSslSocketLayer::apps_ssl_info_callback(SSL *s, int where, int ret)
  1096. {
  1097.     CAsyncSslSocketLayer *pLayer = 0;
  1098.     m_sCriticalSection.Lock();
  1099.     t_SslLayerList *cur = m_pSslLayerList;
  1100.     while (cur)
  1101.     {
  1102.         if (cur->pLayer->m_ssl == s)
  1103.             break;
  1104.         cur = cur->pNext;
  1105.     }
  1106.     if (!cur)
  1107.     {
  1108.         m_sCriticalSection.Unlock();
  1109.         MessageBox(0, _T("Can't lookup SSL session!"), _T("Critical error"), MB_ICONEXCLAMATION);
  1110.         return;
  1111.     }
  1112.     else
  1113.         pLayer = cur->pLayer;
  1114.     m_sCriticalSection.Unlock();
  1115.  
  1116.     // Called while unloading?
  1117.     if (!pLayer->m_bUseSSL)
  1118.         return;
  1119.  
  1120.     char * str;
  1121.     int w;
  1122.  
  1123.     w = where& ~SSL_ST_MASK;
  1124.  
  1125.     if (w & SSL_ST_CONNECT)
  1126.         str = "SSL_connect";
  1127.     else if (w & SSL_ST_ACCEPT)
  1128.         str = "SSL_accept";
  1129.     else
  1130.         str = "undefined";
  1131.  
  1132.     if (where & SSL_CB_LOOP)
  1133.     {
  1134.         char *buffer = new char[4096];
  1135.         sprintf(buffer, "%s: %s",
  1136.                 str,
  1137.                 pSSL_state_string_long(s));
  1138.         pLayer->DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_VERBOSE_INFO, 0, buffer);
  1139.     }
  1140.     else if (where & SSL_CB_ALERT)
  1141.     {
  1142.         str=(where & SSL_CB_READ)? "read" : "write";
  1143.         char* desc = pSSL_alert_desc_string_long(ret);
  1144.  
  1145.         // Don't send close notify warning
  1146.         if (desc && strcmp(desc, "close notify"))
  1147.         {
  1148.             char *buffer = new char[4096];
  1149.             sprintf(buffer, "SSL3 alert %s: %s: %s",
  1150.                     str,
  1151.                     pSSL_alert_type_string_long(ret),
  1152.                     desc);
  1153.             pLayer->DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_VERBOSE_WARNING, 0, buffer);
  1154.         }
  1155.     }
  1156.  
  1157.     else if (where & SSL_CB_EXIT)
  1158.     {
  1159.         if (ret == 0)
  1160.         {
  1161.             char *buffer = new char[4096];
  1162.             sprintf(buffer, "%s: failed in %s",
  1163.                     str,
  1164.                     pSSL_state_string_long(s));
  1165.             pLayer->DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_VERBOSE_WARNING, 0, buffer);
  1166.             if (!pLayer->m_bFailureSent)
  1167.             {
  1168.                 pLayer->m_bFailureSent=TRUE;
  1169.                 pLayer->DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_FAILURE, pLayer->m_bSslEstablished ? SSL_FAILURE_UNKNOWN : SSL_FAILURE_ESTABLISH);
  1170.             }
  1171.         }
  1172.         else if (ret < 0)
  1173.         {
  1174.             int error = pSSL_get_error(s,ret);
  1175.             if (error != SSL_ERROR_WANT_READ && error != SSL_ERROR_WANT_WRITE)
  1176.             {
  1177.                 char *buffer = new char[4096];
  1178.                 sprintf(buffer, "%s: error in %s",
  1179.                         str,
  1180.                         pSSL_state_string_long(s));
  1181.                 pLayer->DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_VERBOSE_WARNING, 0, buffer);
  1182.                 if (!pLayer->m_bFailureSent)
  1183.                 {
  1184.                     pLayer->m_bFailureSent=TRUE;
  1185.                     pLayer->DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_FAILURE, pLayer->m_bSslEstablished ? SSL_FAILURE_UNKNOWN : SSL_FAILURE_ESTABLISH);
  1186.                 }
  1187.             }
  1188.         }
  1189.     }
  1190.     if (where & SSL_CB_HANDSHAKE_DONE)
  1191.     {
  1192.         int error = pSSL_get_verify_result(pLayer->m_ssl);
  1193.         if (error)
  1194.         {
  1195.             pLayer->DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_VERIFY_CERT, error);
  1196.             pLayer->m_bBlocking = TRUE;
  1197.             return;
  1198.         }
  1199.         pLayer->m_bSslEstablished = TRUE;
  1200.         pLayer->PrintSessionInfo();
  1201.         pLayer->DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_INFO, SSL_INFO_ESTABLISHED);
  1202.         pLayer->TriggerEvents();
  1203.     }
  1204. }
  1205.  
  1206.  
  1207. void CAsyncSslSocketLayer::UnloadSSL()
  1208. {
  1209.     if (!m_bSslInitialized)
  1210.         return;
  1211.     ResetSslSession();
  1212.  
  1213.     m_bSslInitialized = false;
  1214.  
  1215.     m_sCriticalSection.Lock();
  1216.     m_nSslRefCount--;
  1217.     if (m_nSslRefCount)
  1218.     {
  1219.         m_sCriticalSection.Unlock();
  1220.         return;
  1221.     }
  1222.  
  1223.     if (m_hSslDll1)
  1224.         FreeLibrary(m_hSslDll1);
  1225.     if (m_hSslDll2)
  1226.     {
  1227.         FreeLibrary(m_hSslDll2);
  1228.         FreeLibrary(m_hSslDll2);
  1229.     }
  1230.     m_hSslDll1 = NULL;
  1231.     m_hSslDll2 = NULL;
  1232.     m_sCriticalSection.Unlock();
  1233. }
  1234.  
  1235. BOOL CAsyncSslSocketLayer::GetPeerCertificateData(t_SslCertData &SslCertData)
  1236. {
  1237.     X509 *pX509=pSSL_get_peer_certificate(m_ssl);
  1238.     if (!pX509)
  1239.         return FALSE;
  1240.  
  1241.     //Reset the contents of SslCertData
  1242.     memset(&SslCertData, 0, sizeof(t_SslCertData));
  1243.  
  1244.     //Set subject data fields
  1245.     X509_NAME *pX509Name=pX509_get_subject_name(pX509);
  1246.  
  1247.     if (pX509Name)
  1248.     {
  1249.         int count=pX509_NAME_entry_count(pX509Name);
  1250.         for (int i=0;i<count;i++)
  1251.         {
  1252.             X509_NAME_ENTRY *pX509NameEntry=pX509_NAME_get_entry(pX509Name,i);
  1253.             if (!pX509NameEntry)
  1254.                 continue;
  1255.             ASN1_OBJECT *pObject = pX509_NAME_ENTRY_get_object(pX509NameEntry);
  1256.             ASN1_STRING *pString = pX509_NAME_ENTRY_get_data(pX509NameEntry);
  1257.             CString str;
  1258.  
  1259.             unsigned char *out;
  1260.             int len = pASN1_STRING_to_UTF8(&out, pString);
  1261.             if (len > 0)
  1262.             {
  1263.                 // Keep it huge
  1264.                 LPWSTR unicode = new WCHAR[len * 10];
  1265.                 memset(unicode, 0, sizeof(WCHAR) * len * 10);
  1266.                 int unicodeLen = MultiByteToWideChar(CP_UTF8, 0, (const char *)out, len, unicode, len * 10);
  1267.                 if (unicodeLen > 0)
  1268.                 {
  1269. #ifdef _UNICODE
  1270.                     str = unicode;
  1271. #else
  1272.                     LPSTR ansi = new CHAR[len * 10];
  1273.                     memset(ansi, 0, sizeof(CHAR) * len * 10);
  1274.                     int ansiLen = WideCharToMultiByte(CP_ACP, 0, unicode, unicodeLen, ansi, len * 10, 0, 0);
  1275.                     if (ansiLen > 0)
  1276.                         str = ansi;
  1277.  
  1278.                     delete [] ansi;
  1279. #endif
  1280.                 }
  1281.                 delete [] unicode;
  1282.                 pCRYPTO_free(out);
  1283.             }
  1284.  
  1285.             switch(pOBJ_obj2nid(pObject))
  1286.             {
  1287.             case NID_organizationName:
  1288.                 _tcsncpy(SslCertData.subject.Organization, str, 255);
  1289.                 SslCertData.subject.Organization[255] = 0;
  1290.                 break;
  1291.             case NID_organizationalUnitName:
  1292.                 _tcsncpy(SslCertData.subject.Unit, str, 255);
  1293.                 SslCertData.subject.Unit[255] = 0;
  1294.                 break;
  1295.             case NID_commonName:
  1296.                 _tcsncpy(SslCertData.subject.CommonName, str, 255);
  1297.                 SslCertData.subject.CommonName[255] = 0;
  1298.                 break;
  1299.             case NID_pkcs9_emailAddress:
  1300.                 _tcsncpy(SslCertData.subject.Mail, str, 255);
  1301.                 SslCertData.subject.Mail[255] = 0;
  1302.                 break;
  1303.             case NID_countryName:
  1304.                 _tcsncpy(SslCertData.subject.Country, str, 255);
  1305.                 SslCertData.subject.Country[255] = 0;
  1306.                 break;
  1307.             case NID_stateOrProvinceName:
  1308.                 _tcsncpy(SslCertData.subject.StateProvince, str, 255);
  1309.                 SslCertData.subject.StateProvince[255] = 0;
  1310.                 break;
  1311.             case NID_localityName:
  1312.                 _tcsncpy(SslCertData.subject.Town, str, 255);
  1313.                 SslCertData.subject.Town[255] = 0;
  1314.                 break;
  1315.             default:
  1316.                 if ( !pOBJ_nid2sn(pOBJ_obj2nid(pObject)) )
  1317.                 {
  1318.                     TCHAR tmp[20];
  1319.                     _stprintf(tmp, _T("%d"), pOBJ_obj2nid(pObject));
  1320.                     int maxlen = 1024 - _tcslen(SslCertData.subject.Other)-1;
  1321.                     _tcsncpy(SslCertData.subject.Other+_tcslen(SslCertData.subject.Other), tmp, maxlen);
  1322.  
  1323.                     maxlen = 1024 - _tcslen(SslCertData.subject.Other)-1;
  1324.                     _tcsncpy(SslCertData.subject.Other+_tcslen(SslCertData.subject.Other), _T("="), maxlen);
  1325.  
  1326.                     maxlen = 1024 - _tcslen(SslCertData.subject.Other)-1;
  1327.                     _tcsncpy(SslCertData.subject.Other+_tcslen(SslCertData.subject.Other), str, maxlen);
  1328.  
  1329.                     maxlen = 1024 - _tcslen(SslCertData.subject.Other)-1;
  1330.                     _tcsncpy(SslCertData.subject.Other+_tcslen(SslCertData.subject.Other), _T(";"), maxlen);
  1331.                 }
  1332.                 else
  1333.                 {
  1334.                     int maxlen = 1024 - _tcslen(SslCertData.subject.Other)-1;
  1335.  
  1336.                     USES_CONVERSION;
  1337.                     _tcsncpy(SslCertData.subject.Other+_tcslen(SslCertData.subject.Other), A2CT(pOBJ_nid2sn(pOBJ_obj2nid(pObject))), maxlen);
  1338.  
  1339.                     maxlen = 1024 - _tcslen(SslCertData.subject.Other)-1;
  1340.                     _tcsncpy(SslCertData.subject.Other+_tcslen(SslCertData.subject.Other), _T("="), maxlen);
  1341.  
  1342.                     maxlen = 1024 - _tcslen(SslCertData.subject.Other)-1;
  1343.                     _tcsncpy(SslCertData.subject.Other+_tcslen(SslCertData.subject.Other), str, maxlen);
  1344.  
  1345.                     maxlen = 1024 - _tcslen(SslCertData.subject.Other)-1;
  1346.                     _tcsncpy(SslCertData.subject.Other+_tcslen(SslCertData.subject.Other), _T(";"), maxlen);
  1347.                 }
  1348.                 break;
  1349.             }
  1350.         }
  1351.     }
  1352.  
  1353.     //Set issuer data fields
  1354.     pX509Name=pX509_get_issuer_name(pX509);
  1355.     if (pX509Name)
  1356.     {
  1357.         int count=pX509_NAME_entry_count(pX509Name);
  1358.         for (int i=0;i<count;i++)
  1359.         {
  1360.             X509_NAME_ENTRY *pX509NameEntry=pX509_NAME_get_entry(pX509Name,i);
  1361.             if (!pX509NameEntry)
  1362.                 continue;
  1363.             ASN1_STRING *pString=pX509_NAME_ENTRY_get_data(pX509NameEntry);
  1364.             ASN1_OBJECT *pObject=pX509_NAME_ENTRY_get_object(pX509NameEntry);
  1365.  
  1366.             CString str;
  1367.  
  1368.             unsigned char *out;
  1369.             int len = pASN1_STRING_to_UTF8(&out, pString);
  1370.             if (len > 0)
  1371.             {
  1372.                 // Keep it huge
  1373.                 LPWSTR unicode = new WCHAR[len * 10];
  1374.                 memset(unicode, 0, sizeof(WCHAR) * len * 10);
  1375.                 int unicodeLen = MultiByteToWideChar(CP_UTF8, 0, (const char *)out, len, unicode, len * 10);
  1376.                 if (unicodeLen > 0)
  1377.                 {
  1378. #ifdef _UNICODE
  1379.                     str = unicode;
  1380. #else
  1381.                     LPSTR ansi = new CHAR[len * 10];
  1382.                     memset(ansi, 0, sizeof(CHAR) * len * 10);
  1383.                     int ansiLen = WideCharToMultiByte(CP_ACP, 0, unicode, unicodeLen, ansi, len * 10, 0, 0);
  1384.                     if (ansiLen > 0)
  1385.                         str = ansi;
  1386.  
  1387.                     delete [] ansi;
  1388. #endif
  1389.                 }
  1390.                 delete [] unicode;
  1391.                 pCRYPTO_free(out);
  1392.             }
  1393.  
  1394.             switch(pOBJ_obj2nid(pObject))
  1395.             {
  1396.             case NID_organizationName:
  1397.                 _tcsncpy(SslCertData.issuer.Organization, str, 255);
  1398.                 SslCertData.issuer.Organization[255] = 0;
  1399.                 break;
  1400.             case NID_organizationalUnitName:
  1401.                 _tcsncpy(SslCertData.issuer.Unit, str, 255);
  1402.                 SslCertData.issuer.Unit[255] = 0;
  1403.                 break;
  1404.             case NID_commonName:
  1405.                 _tcsncpy(SslCertData.issuer.CommonName, str, 255);
  1406.                 SslCertData.issuer.CommonName[255] = 0;
  1407.                 break;
  1408.             case NID_pkcs9_emailAddress:
  1409.                 _tcsncpy(SslCertData.issuer.Mail, str, 255);
  1410.                 SslCertData.issuer.Mail[255] = 0;
  1411.                 break;
  1412.             case NID_countryName:
  1413.                 _tcsncpy(SslCertData.issuer.Country, str, 255);
  1414.                 SslCertData.issuer.Country[255] = 0;
  1415.                 break;
  1416.             case NID_stateOrProvinceName:
  1417.                 _tcsncpy(SslCertData.issuer.StateProvince, str, 255);
  1418.                 SslCertData.issuer.StateProvince[255] = 0;
  1419.                 break;
  1420.             case NID_localityName:
  1421.                 _tcsncpy(SslCertData.issuer.Town, str, 255);
  1422.                 SslCertData.issuer.Town[255] = 0;
  1423.                 break;
  1424.             default:
  1425.                 if ( !pOBJ_nid2sn(pOBJ_obj2nid(pObject)) )
  1426.                 {
  1427.                     TCHAR tmp[20];
  1428.                     _stprintf(tmp, _T("%d"), pOBJ_obj2nid(pObject));
  1429.                     int maxlen = 1024 - _tcslen(SslCertData.issuer.Other)-1;
  1430.                     _tcsncpy(SslCertData.issuer.Other+_tcslen(SslCertData.issuer.Other), tmp, maxlen);
  1431.  
  1432.                     maxlen = 1024 - _tcslen(SslCertData.issuer.Other)-1;
  1433.                     _tcsncpy(SslCertData.issuer.Other+_tcslen(SslCertData.issuer.Other), _T("="), maxlen);
  1434.  
  1435.                     maxlen = 1024 - _tcslen(SslCertData.issuer.Other)-1;
  1436.                     _tcsncpy(SslCertData.issuer.Other+_tcslen(SslCertData.issuer.Other), str, maxlen);
  1437.  
  1438.                     maxlen = 1024 - _tcslen(SslCertData.issuer.Other)-1;
  1439.                     _tcsncpy(SslCertData.issuer.Other+_tcslen(SslCertData.issuer.Other), _T(";"), maxlen);
  1440.                 }
  1441.                 else
  1442.                 {
  1443.                     int maxlen = 1024 - _tcslen(SslCertData.issuer.Other)-1;
  1444.  
  1445.                     USES_CONVERSION;
  1446.                     _tcsncpy(SslCertData.issuer.Other+_tcslen(SslCertData.issuer.Other), A2CT(pOBJ_nid2sn(pOBJ_obj2nid(pObject))), maxlen);
  1447.  
  1448.                     maxlen = 1024 - _tcslen(SslCertData.issuer.Other)-1;
  1449.                     _tcsncpy(SslCertData.issuer.Other+_tcslen(SslCertData.issuer.Other), _T("="), maxlen);
  1450.  
  1451.                     maxlen = 1024 - _tcslen(SslCertData.issuer.Other)-1;
  1452.                     _tcsncpy(SslCertData.issuer.Other+_tcslen(SslCertData.issuer.Other), str, maxlen);
  1453.  
  1454.                     maxlen = 1024 - _tcslen(SslCertData.issuer.Other)-1;
  1455.                     _tcsncpy(SslCertData.issuer.Other+_tcslen(SslCertData.issuer.Other), _T(";"), maxlen);
  1456.                 }
  1457.                 break;
  1458.             }
  1459.         }
  1460.     }
  1461.  
  1462.     //Set date fields
  1463.  
  1464.     static const char *mon[12]=
  1465.     {
  1466.     "Jan","Feb","Mar","Apr","May","Jun",
  1467.     "Jul","Aug","Sep","Oct","Nov","Dec"
  1468.     };
  1469.  
  1470.     //Valid from
  1471.     ASN1_UTCTIME *pTime=X509_get_notBefore(pX509);
  1472.     if (!pTime)
  1473.     {
  1474.         pX509_free(pX509);
  1475.         return FALSE;
  1476.     }
  1477.  
  1478.     char *v;
  1479.     int gmt = 0;
  1480.     int i;
  1481.     int y=0, M=0, d=0, h=0, m=0, s=0;
  1482.  
  1483.     i = pTime->length;
  1484.     v = (char *)pTime->data;
  1485.  
  1486.     if (i < 10)
  1487.     {
  1488.         pX509_free(pX509);
  1489.         return FALSE;
  1490.     }
  1491.     if (v[i-1] == 'Z') gmt=1;
  1492.     for (i=0; i<10; i++)
  1493.         if ((v[i] > '9') || (v[i] < '0'))
  1494.         {
  1495.             pX509_free(pX509);
  1496.             return FALSE;
  1497.         }
  1498.     y= (v[0]-'0')*10+(v[1]-'0');
  1499.     if (y < 50) y+=100;
  1500.     M= (v[2]-'0')*10+(v[3]-'0');
  1501.     if ((M > 12) || (M < 1))
  1502.     {
  1503.         pX509_free(pX509);
  1504.         return FALSE;
  1505.     }
  1506.     d= (v[4]-'0')*10+(v[5]-'0');
  1507.     h= (v[6]-'0')*10+(v[7]-'0');
  1508.     m=  (v[8]-'0')*10+(v[9]-'0');
  1509.     if (    (v[10] >= '0') && (v[10] <= '9') &&
  1510.         (v[11] >= '0') && (v[11] <= '9'))
  1511.         s=  (v[10]-'0')*10+(v[11]-'0');
  1512.  
  1513.     SslCertData.validFrom.y = y+1900;
  1514.     SslCertData.validFrom.M = M;
  1515.     SslCertData.validFrom.d = d;
  1516.     SslCertData.validFrom.h = h;
  1517.     SslCertData.validFrom.m = m;
  1518.     SslCertData.validFrom.s = s;
  1519.  
  1520.     //Valid until
  1521.     pTime = X509_get_notAfter(pX509);
  1522.     if (!pTime)
  1523.     {
  1524.         pX509_free(pX509);
  1525.         return FALSE;
  1526.     }
  1527.  
  1528.     gmt = 0;
  1529.     i;
  1530.     y=0,M=0,d=0,h=0,m=0,s=0;
  1531.  
  1532.     i=pTime->length;
  1533.     v=(char *)pTime->data;
  1534.  
  1535.     if (i < 10)
  1536.     {
  1537.         pX509_free(pX509);
  1538.         return FALSE;
  1539.     }
  1540.     if (v[i-1] == 'Z') gmt=1;
  1541.     for (i=0; i<10; i++)
  1542.         if ((v[i] > '9') || (v[i] < '0'))
  1543.         {
  1544.             pX509_free(pX509);
  1545.             return FALSE;
  1546.         }
  1547.     y= (v[0]-'0')*10+(v[1]-'0');
  1548.     if (y < 50) y+=100;
  1549.     M= (v[2]-'0')*10+(v[3]-'0');
  1550.     if ((M > 12) || (M < 1))
  1551.     {
  1552.         pX509_free(pX509);
  1553.         return FALSE;
  1554.     }
  1555.     d= (v[4]-'0')*10+(v[5]-'0');
  1556.     h= (v[6]-'0')*10+(v[7]-'0');
  1557.     m=  (v[8]-'0')*10+(v[9]-'0');
  1558.     if (    (v[10] >= '0') && (v[10] <= '9') &&
  1559.         (v[11] >= '0') && (v[11] <= '9'))
  1560.         s=  (v[10]-'0')*10+(v[11]-'0');
  1561.  
  1562.     SslCertData.validUntil.y = y+1900;
  1563.     SslCertData.validUntil.M = M;
  1564.     SslCertData.validUntil.d = d;
  1565.     SslCertData.validUntil.h = h;
  1566.     SslCertData.validUntil.m = m;
  1567.     SslCertData.validUntil.s = s;
  1568.  
  1569.     unsigned int length = 20;
  1570.     pX509_digest(pX509, pEVP_sha1(), SslCertData.hash, &length);
  1571.  
  1572.     SslCertData.priv_data = m_nSslAsyncNotifyId;
  1573.  
  1574.     pX509_free(pX509);
  1575.  
  1576.     SslCertData.verificationResult = m_nVerificationResult;
  1577.     SslCertData.verificationDepth = m_nVerificationDepth;
  1578.  
  1579.     return TRUE;
  1580. }
  1581.  
  1582. void CAsyncSslSocketLayer::SetNotifyReply(int nID, int nCode, int result)
  1583. {
  1584.     if (!m_bBlocking)
  1585.         return;
  1586.     if (nID != m_nSslAsyncNotifyId)
  1587.         return;
  1588.     if (nCode != SSL_VERIFY_CERT)
  1589.         return;
  1590.  
  1591.     m_bBlocking = FALSE;
  1592.  
  1593.     if (!result)
  1594.     {
  1595.         m_nNetworkError = WSAECONNABORTED;
  1596.         WSASetLastError(WSAECONNABORTED);
  1597.         if (!m_bFailureSent)
  1598.         {
  1599.             m_bFailureSent = TRUE;
  1600.             DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_FAILURE, SSL_FAILURE_CERTREJECTED);
  1601.         }
  1602.         TriggerEvent(FD_CLOSE, 0, TRUE);
  1603.         return;
  1604.     }
  1605.     m_bSslEstablished = TRUE;
  1606.     PrintSessionInfo();
  1607.     DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_INFO, SSL_INFO_ESTABLISHED);
  1608.  
  1609.     TriggerEvents();
  1610. }
  1611.  
  1612. void CAsyncSslSocketLayer::PrintSessionInfo()
  1613. {
  1614.     SSL_CIPHER *ciph;
  1615.     X509 *cert;
  1616.  
  1617.     ciph = pSSL_get_current_cipher(m_ssl);
  1618.     char enc[4096] = {0};
  1619.     cert=pSSL_get_peer_certificate(m_ssl);
  1620.  
  1621.     if (cert != NULL)
  1622.     {
  1623.         EVP_PKEY *pkey = pX509_get_pubkey(cert);
  1624.         if (pkey != NULL)
  1625.         {
  1626.             if (0)
  1627.                 ;
  1628. #ifndef NO_RSA
  1629.             else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
  1630.                 && pkey->pkey.rsa->n != NULL)
  1631.                 sprintf(enc,    "%d bit RSA", pBN_num_bits(pkey->pkey.rsa->n));
  1632. #endif
  1633. #ifndef NO_DSA
  1634.             else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
  1635.                     && pkey->pkey.dsa->p != NULL)
  1636.                 sprintf(enc,    "%d bit DSA", pBN_num_bits(pkey->pkey.dsa->p));
  1637. #endif
  1638.             pEVP_PKEY_free(pkey);
  1639.         }
  1640.         pX509_free(cert);
  1641.         /* The SSL API does not allow us to look at temporary RSA/DH keys,
  1642.          * otherwise we should print their lengths too */
  1643.     }
  1644.  
  1645.     char *buffer = new char[4096];
  1646.     sprintf(buffer, "Using %s, cipher %s: %s, %s",
  1647.             pSSL_get_version(m_ssl),
  1648.             pSSL_CIPHER_get_version(ciph),
  1649.             pSSL_CIPHER_get_name(ciph),
  1650.             enc);
  1651.     DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_VERBOSE_INFO, 0, buffer);
  1652. }
  1653.  
  1654. void CAsyncSslSocketLayer::OnConnect(int nErrorCode)
  1655. {
  1656.     if (m_bUseSSL && nErrorCode)
  1657.         TriggerEvent(FD_WRITE, 0);
  1658.     TriggerEvent(FD_CONNECT, nErrorCode, TRUE);
  1659. }
  1660.  
  1661. int CAsyncSslSocketLayer::verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
  1662. {
  1663.     X509   *err_cert;
  1664.     int     err, depth;
  1665.     SSL    *ssl;
  1666.  
  1667.     err_cert = pX509_STORE_CTX_get_current_cert(ctx);
  1668.     err = pX509_STORE_CTX_get_error(ctx);
  1669.     depth = pX509_STORE_CTX_get_error_depth(ctx);
  1670.  
  1671.     /*
  1672.      * Retrieve the pointer to the SSL of the connection currently treated
  1673.      * and the application specific data stored into the SSL object.
  1674.      */
  1675.     ssl = pX509_STORE_CTX_get_ex_data(ctx, pSSL_get_ex_data_X509_STORE_CTX_idx());
  1676.  
  1677.     // Lookup CAsyncSslSocketLayer instance
  1678.     CAsyncSslSocketLayer *pLayer = 0;
  1679.     m_sCriticalSection.Lock();
  1680.     t_SslLayerList *cur = m_pSslLayerList;
  1681.     while (cur)
  1682.     {
  1683.         if (cur->pLayer->m_ssl == ssl)
  1684.             break;
  1685.         cur = cur->pNext;
  1686.     }
  1687.     if (!cur)
  1688.     {
  1689.         m_sCriticalSection.Unlock();
  1690.         MessageBox(0, _T("Can't lookup SSL session!"), _T("Critical error"), MB_ICONEXCLAMATION);
  1691.         return 1;
  1692.     }
  1693.     else
  1694.         pLayer = cur->pLayer;
  1695.     m_sCriticalSection.Unlock();
  1696.  
  1697.     /*
  1698.      * Catch a too long certificate chain. The depth limit set using
  1699.      * SSL_CTX_set_verify_depth() is by purpose set to "limit+1" so
  1700.      * that whenever the "depth>verify_depth" condition is met, we
  1701.      * have violated the limit and want to log this error condition.
  1702.      * We must do it here, because the CHAIN_TOO_LONG error would not
  1703.      * be found explicitly; only errors introduced by cutting off the
  1704.      * additional certificates would be logged.
  1705.      */
  1706.     if (depth > 10) {//mydata->verify_depth) {
  1707.         preverify_ok = 0;
  1708.         err = X509_V_ERR_CERT_CHAIN_TOO_LONG;
  1709.         pX509_STORE_CTX_set_error(ctx, err);
  1710.     }
  1711.  
  1712.     if (!preverify_ok)
  1713.     {
  1714.         if (!pLayer->m_nVerificationResult)
  1715.         {
  1716.             pLayer->m_nVerificationDepth = depth;
  1717.             pLayer->m_nVerificationResult = err;
  1718.         }
  1719.     }
  1720.     return 1;
  1721. }
  1722.  
  1723. BOOL CAsyncSslSocketLayer::SetCertStorage(CString file)
  1724. {
  1725.     m_CertStorage = file;
  1726.     return TRUE;
  1727. }
  1728.  
  1729. void CAsyncSslSocketLayer::OnClose(int nErrorCode)
  1730. {
  1731.     m_onCloseCalled = true;
  1732.     if (m_bUseSSL && pBIO_ctrl && pBIO_ctrl(m_sslbio, BIO_CTRL_PENDING, 0, NULL) > 0)
  1733.     {
  1734.         TriggerEvents();
  1735.     }
  1736.     else
  1737.         TriggerEvent(FD_CLOSE, nErrorCode, TRUE);
  1738. }
  1739.  
  1740. void CAsyncSslSocketLayer::PrintLastErrorMsg()
  1741. {
  1742.     int err = pERR_get_error();
  1743.     while (err)
  1744.     {
  1745.         char *buffer = new char[512];
  1746.         pERR_error_string(err, buffer);
  1747.         err = pERR_get_error();
  1748.         DoLayerCallback(LAYERCALLBACK_LAYERSPECIFIC, SSL_VERBOSE_WARNING, 0, buffer);
  1749.     }
  1750. }
  1751.  
  1752. bool CAsyncSslSocketLayer::CreateSslCertificate(LPCTSTR filename, int bits, unsigned char* country, unsigned char* state,
  1753.             unsigned char* locality, unsigned char* organization, unsigned char* unit, unsigned char* cname,
  1754.             unsigned char *email, CString& err)
  1755. {
  1756.     // Certificate valid for a year
  1757.     int days = 365;
  1758.  
  1759.     CAsyncSslSocketLayer layer;
  1760.     if (layer.InitSSL())
  1761.     {
  1762.         err = _T("Failed to initialize SSL library");
  1763.         return false;
  1764.     }
  1765.  
  1766.     X509 *x;
  1767.     EVP_PKEY *pk;
  1768.     RSA *rsa;
  1769.     X509_NAME *name = NULL;
  1770.     
  1771.     if ((pk = pEVP_PKEY_new()) == NULL)
  1772.     {
  1773.         err = _T("Could not create key object");
  1774.         return false;
  1775.     }
  1776.  
  1777.     if ((x = pX509_new()) == NULL)
  1778.     {
  1779.         err = _T("Could not create certificate object");
  1780.         return false;
  1781.     }
  1782.  
  1783.     rsa = pRSA_generate_key(bits, RSA_F4, 0/*callback*/, NULL);
  1784.     
  1785.     if (!pEVP_PKEY_assign(pk, EVP_PKEY_RSA, (char *)(rsa)))
  1786.     {
  1787.         err = _T("Failed to assign rsa key to key object");
  1788.         return false;
  1789.     }
  1790.  
  1791.     rsa = NULL;
  1792.  
  1793.     pX509_set_version(x,2);
  1794.     pASN1_INTEGER_set(pX509_get_serialNumber(x), 0/*serial*/);
  1795.     pX509_gmtime_adj(X509_get_notBefore(x),0);
  1796.     pX509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days);
  1797.     pX509_set_pubkey(x,pk);
  1798.  
  1799.     name = pX509_get_subject_name(x);
  1800.  
  1801.     /* This function creates and adds the entry, working out the
  1802.      * correct string type and performing checks on its length.
  1803.      * Normally we'd check the return value for errors...
  1804.      */
  1805.     pX509_NAME_add_entry_by_txt(name, "CN",
  1806.                 MBSTRING_ASC, cname, -1, -1, 0);
  1807.     pX509_NAME_add_entry_by_txt(name, "C",
  1808.                 MBSTRING_ASC, country, -1, -1, 0);
  1809.     pX509_NAME_add_entry_by_txt(name, "ST",
  1810.                 MBSTRING_ASC, state, -1, -1, 0);
  1811.     pX509_NAME_add_entry_by_txt(name, "L",
  1812.                 MBSTRING_ASC, locality, -1, -1, 0);
  1813.     pX509_NAME_add_entry_by_txt(name, "O",
  1814.                 MBSTRING_ASC, organization, -1, -1, 0);
  1815.     pX509_NAME_add_entry_by_txt(name, "OU",
  1816.                 MBSTRING_ASC, unit, -1, -1, 0);
  1817.     pX509_NAME_add_entry_by_NID(name, NID_pkcs9_emailAddress,
  1818.                 MBSTRING_ASC, email, -1, -1, 0);
  1819.  
  1820.     /* Its self signed so set the issuer name to be the same as the
  1821.       * subject.
  1822.      */
  1823.     pX509_set_issuer_name(x,name);
  1824.  
  1825.     if (!pX509_sign(x, pk, pEVP_sha1()))
  1826.     {
  1827.         err = _T("Failed to sign certificate");
  1828.         return false;
  1829.     }
  1830.  
  1831.     // Write key and certificate to file
  1832.     // We use a memory bio, since the OpenSSL functions accepting a filepointer 
  1833.     // do crash for no obvious reason.
  1834.  
  1835. #ifndef _UNICODE
  1836.     FILE* file = fopen(filename, "w+");
  1837. #else
  1838.     FILE* file = _wfopen(filename, _T("w+"));
  1839. #endif
  1840.  
  1841.     if (!file)
  1842.     {
  1843.         err = _T("Failed to open output file");
  1844.         return false;
  1845.     }
  1846.  
  1847.     BIO* bio = pBIO_new(pBIO_s_mem());
  1848.     pPEM_ASN1_write_bio((int (*)())pi2d_PrivateKey, (((pk)->type == EVP_PKEY_DSA)?PEM_STRING_DSA:PEM_STRING_RSA), bio, (char *)pk, NULL, NULL, 0, NULL, NULL);
  1849.     pPEM_ASN1_write_bio((int (*)())pi2d_X509, PEM_STRING_X509, bio, (char *)x, NULL, NULL, 0, NULL, NULL);
  1850.     
  1851.     char buffer[1001];
  1852.     int len;
  1853.     while ((len = pBIO_read(bio, buffer, 1000)) > 0)
  1854.     {
  1855.         buffer[len] = 0;
  1856.         fprintf(file, buffer);
  1857.     }
  1858.  
  1859.     fclose(file);
  1860.  
  1861.     pX509_free(x);
  1862.     pEVP_PKEY_free(pk);
  1863.  
  1864.     pBIO_free(bio);
  1865.  
  1866.     layer.UnloadSSL();
  1867.  
  1868.     return true;
  1869. }
  1870.  
  1871. int CAsyncSslSocketLayer::SetCertKeyFile(const char* cert, const char* key, const char* pass, CString* error /*=0*/)
  1872. {
  1873.     int res = InitSSL();
  1874.     if (res)
  1875.         return res;
  1876.  
  1877.     m_sCriticalSection.Lock();
  1878.     
  1879.     if (!m_ssl_ctx)
  1880.     {
  1881.         // Create new context
  1882.         if (!(m_ssl_ctx = pSSL_CTX_new( pSSLv23_method())))
  1883.         {
  1884.             m_sCriticalSection.Unlock();
  1885.             return SSL_FAILURE_INITSSL;
  1886.         }
  1887.         m_contextRefCount[m_ssl_ctx] = 1;
  1888.     }
  1889.  
  1890.     pSSL_CTX_set_default_passwd_cb(m_ssl_ctx, pem_passwd_cb);
  1891.     pSSL_CTX_set_default_passwd_cb_userdata(m_ssl_ctx, this);
  1892.  
  1893.     if (pass)
  1894.     {
  1895.         size_t len = strlen(pass);
  1896.         m_pKeyPassword = new char[len + 1];
  1897.         strcpy(m_pKeyPassword, pass);
  1898.     }
  1899.     else
  1900.     {
  1901.         delete [] m_pKeyPassword;
  1902.         m_pKeyPassword = 0;
  1903.     }
  1904.  
  1905.     if (pSSL_CTX_use_certificate_chain_file(m_ssl_ctx, cert) <= 0)
  1906.     //if (pSSL_CTX_use_certificate_file(m_ssl_ctx, cert, SSL_FILETYPE_PEM) <= 0)
  1907.     {
  1908.         if (error)
  1909.             *error = _T("Could not load certificate file.");
  1910.         m_sCriticalSection.Unlock();
  1911.         return SSL_FAILURE_VERIFYCERT;
  1912.     }
  1913.  
  1914.     if (pSSL_CTX_use_PrivateKey_file(m_ssl_ctx, key, SSL_FILETYPE_PEM) <= 0)
  1915.     {
  1916.         if (error)
  1917.             *error = _T("Could not load key file.");
  1918.         m_sCriticalSection.Unlock();
  1919.         return SSL_FAILURE_VERIFYCERT;
  1920.     }
  1921.  
  1922.     if (!pSSL_CTX_check_private_key(m_ssl_ctx))
  1923.     {
  1924.         if (error)
  1925.             *error = _T("Private key does not match the certificate public key.");
  1926.         m_sCriticalSection.Unlock();
  1927.         return SSL_FAILURE_VERIFYCERT;
  1928.     }
  1929.  
  1930.     m_sCriticalSection.Unlock();
  1931.  
  1932.     return 0;
  1933. }
  1934.  
  1935. int CAsyncSslSocketLayer::SendRaw(const void* lpBuf, int nBufLen, int nFlags)
  1936. {
  1937.     if (!m_bUseSSL)
  1938.     {
  1939.         SetLastError(WSANOTINITIALISED);
  1940.         return SOCKET_ERROR;
  1941.     }
  1942.  
  1943.     if (!lpBuf)
  1944.         return 0;
  1945.     
  1946.     if (m_nNetworkError)
  1947.     {
  1948.         SetLastError(m_nNetworkError);
  1949.         return SOCKET_ERROR;
  1950.     }
  1951.     if (m_nShutDown)
  1952.     {
  1953.         SetLastError(WSAESHUTDOWN);
  1954.         return SOCKET_ERROR;
  1955.     }
  1956.     if (m_nNetworkSendBufferLen)
  1957.     {
  1958.         SetLastError(WSAEINPROGRESS);
  1959.         return SOCKET_ERROR;
  1960.     }
  1961.     if (!nBufLen)
  1962.         return 0;
  1963.  
  1964.     if (m_nNetworkSendBufferMaxLen < nBufLen)
  1965.         m_nNetworkSendBufferMaxLen = nBufLen;
  1966.     delete [] m_pNetworkSendBuffer;
  1967.     m_pNetworkSendBuffer = new char[m_nNetworkSendBufferMaxLen];
  1968.     memcpy(m_pNetworkSendBuffer, lpBuf, nBufLen);
  1969.     m_nNetworkSendBufferLen = nBufLen;
  1970.     TriggerEvent(FD_WRITE, 0);
  1971.  
  1972.     return nBufLen;
  1973. }
  1974.  
  1975. void CAsyncSslSocketLayer::TriggerEvents()
  1976. {
  1977.     if (pBIO_ctrl_pending(m_nbio) > 0)
  1978.     {
  1979.         if (m_mayTriggerWrite)
  1980.         {
  1981.             m_mayTriggerWrite = false;
  1982.             TriggerEvent(FD_WRITE, 0);
  1983.         }
  1984.     }
  1985.     else if (!m_nNetworkSendBufferLen && m_bSslEstablished && pBIO_ctrl_get_write_guarantee(m_sslbio) > 0 && m_mayTriggerWriteUp)
  1986.     {
  1987.         m_mayTriggerWriteUp = false;
  1988.         TriggerEvent(FD_WRITE, 0, TRUE);
  1989.     }
  1990.  
  1991.     if (m_bSslEstablished && pBIO_ctrl_pending(m_sslbio) > 0)
  1992.     {
  1993.         if (m_mayTriggerReadUp)
  1994.         {
  1995.             m_mayTriggerReadUp = false;
  1996.             TriggerEvent(FD_READ, 0, TRUE);
  1997.         }
  1998.     }
  1999.     else if (pBIO_ctrl_get_write_guarantee(m_nbio) > 0 && m_mayTriggerRead)
  2000.     {
  2001.         m_mayTriggerRead = false;
  2002.         TriggerEvent(FD_READ, 0);
  2003.     }
  2004.  
  2005.     if (m_onCloseCalled && m_bSslEstablished && pBIO_ctrl_pending(m_sslbio) <= 0)
  2006.         TriggerEvent(FD_CLOSE, 0, TRUE);
  2007. }
  2008.  
  2009. int CAsyncSslSocketLayer::pem_passwd_cb(char *buf, int size, int rwflag, void *userdata)
  2010. {
  2011.     CAsyncSslSocketLayer* pThis = (CAsyncSslSocketLayer*)userdata;
  2012.  
  2013.     if (!pThis || !pThis->m_pKeyPassword)
  2014.         return 0;
  2015.  
  2016.     int len = strlen(pThis->m_pKeyPassword);
  2017.     if (len >= size)
  2018.         len = size - 1;
  2019.  
  2020.     memcpy(buf, pThis->m_pKeyPassword, len);
  2021.     buf[len] = 0;
  2022.  
  2023.     return len;
  2024. }
  2025.