home *** CD-ROM | disk | FTP | other *** search
/ Columbia Kermit / kermit.zip / k95source / ck_ssl.c < prev    next >
C/C++ Source or Header  |  2020-01-01  |  145KB  |  4,258 lines
  1. char *cksslv = "SSL/TLS support, 8.0.224, 21 Feb 2007";
  2. /*
  3.   C K _ S S L . C --  OpenSSL Interface for C-Kermit
  4.  
  5.   Copyright (C) 1985, 2005,
  6.     Trustees of Columbia University in the City of New York.
  7.     All rights reserved.  See the C-Kermit COPYING.TXT file or the
  8.     copyright text in the ckcmai.c module for disclaimer and permissions.
  9.  
  10.   Copyright 2006, 2007  Secure Endpoints Inc.
  11.  
  12.     Author:  Jeffrey E Altman (jaltman@secure-endpoints.com)
  13.                Secure Endpoints Inc., New York City
  14.  
  15.   Provides:
  16.  
  17.   . Telnet Auth SSL option compatible with Tim Hudson's hack.
  18.   . Telnet START_TLS option
  19.   . Configuration of certificate and key files
  20.   . Certificate verification and revocation list checks
  21.   . Client certificate to user id routine
  22.  
  23.   Note: This code is written to be compatible with OpenSSL 0.9.6[abcdefgh]
  24.   and 0.9.7 beta 5.
  25.   It will also compile with version 0.9.5 although that is discouraged
  26.   due to security weaknesses in that release.
  27. */
  28.  
  29. #include "ckcsym.h"
  30. #include "ckcdeb.h"
  31.  
  32. #ifdef CK_SSL
  33. #include "ckcnet.h"
  34. #include "ckuath.h"
  35.  
  36. #include <stdlib.h>
  37. #include <string.h>
  38. #ifdef UNIX
  39. #include <netinet/in.h>
  40. #ifndef FREEBSD4
  41. #include <arpa/inet.h>
  42. #endif /* FREEBSD4 */
  43. #endif /* UNIX */
  44.  
  45. #ifdef DEC_TCPIP
  46. #include <time.h>
  47. #include <inet.h>
  48. #endif /* DEC_TCPIP */
  49.  
  50. #ifdef OS2
  51. extern char exedir[];
  52. #ifdef NT
  53. char * GetAppData(int);
  54. #endif
  55. #endif /* OS2 */
  56.  
  57. extern int quiet;            /* fdc - Mon Nov 28 11:44:15 2005 */
  58.  
  59. static int ssl_installed = 1;
  60. #endif /* CK_SSL */
  61. int
  62. ck_ssh_is_installed()
  63. {
  64. #ifdef SSHBUILTIN
  65. #ifdef SSLDLL
  66. #ifdef NT
  67.     extern HINSTANCE hCRYPTO;
  68. #else /* NT */
  69.     extern HMODULE hCRYPTO;
  70. #endif /* NT */
  71.     debug(F111,"ck_ssh_is_installed","hCRYPTO",hCRYPTO);
  72.     return(ssl_installed && (hCRYPTO != NULL));
  73. #else /* SSLDLL */
  74.     return(ssl_installed);
  75. #endif /* SSLDLL */
  76. #else
  77.     return 0;
  78. #endif
  79. }
  80.  
  81. int
  82. #ifdef CK_ANSIC
  83. ck_ssleay_is_installed(void)
  84. #else
  85. ck_ssleay_is_installed()
  86. #endif
  87. {
  88. #ifdef CK_SSL
  89. #ifdef SSLDLL
  90. #ifdef NT
  91.     extern HINSTANCE hSSL, hCRYPTO;
  92. #else /* NT */
  93.     extern HMODULE hSSL, hCRYPTO;
  94. #endif /* NT */
  95.     debug(F111,"ck_ssleay_is_installed","hSSL",hSSL);
  96.     debug(F111,"ck_ssleay_is_installed","hCRYPTO",hCRYPTO);
  97.     return(ssl_installed && (hSSL != NULL) && (hCRYPTO != NULL));
  98. #else /* SSLDLL */
  99.     return(ssl_installed);
  100. #endif /* SSLDLL */
  101. #else /* CK_SSL */
  102.     return(0);
  103. #endif /* CK_SSL */
  104. }
  105.  
  106. #ifdef CK_SSL
  107. #include "ckcker.h"
  108. #include "ckucmd.h"                             /* For struct keytab */
  109. #include "ckctel.h"
  110. #include "ck_ssl.h"
  111. #ifdef UNIX
  112. #include <pwd.h>                    /* Password file for home directory */
  113. #endif /* UNIX */
  114. #ifdef OS2
  115. #include <process.h>
  116. #endif /* OS2 */
  117. #ifdef OS2ONLY
  118. #include "ckotcp.h"
  119. #endif /* OS2ONLY */
  120.  
  121. #ifdef SSLDLL
  122. int ssl_finished_messages = 0;
  123. #else /* SSLDLL */
  124. #ifdef OPENSSL_VERSION_NUMBER
  125. int ssl_finished_messages = (OPENSSL_VERSION_NUMBER >= 0x0090581fL);
  126. #else
  127. !ERROR This module requires OpenSSL 0.9.5a or higher
  128. #endif /* OPENSSL_VERSION_NUMBER */
  129. #endif /* SSLDLL */
  130.  
  131. static int auth_ssl_valid = 0;
  132. static char *auth_ssl_name = 0;    /* this holds the oneline name */
  133. char ssl_err[SSL_ERR_BFSZ]="";
  134.  
  135. BIO *bio_err=NULL;
  136. X509_STORE *crl_store = NULL;
  137.  
  138. #ifndef NOFTP
  139. #ifndef SYSFTP
  140. SSL *ssl_ftp_con             = NULL;
  141. SSL_CTX *ssl_ftp_ctx         = NULL;
  142. SSL *ssl_ftp_data_con        = NULL;
  143. int ssl_ftp_active_flag      = 0;
  144. int ssl_ftp_data_active_flag = 0;
  145. #endif /* SYSFTP */
  146. #endif /* NOFTP */
  147.  
  148. #ifndef NOHTTP
  149. SSL *tls_http_con            = NULL;
  150. SSL_CTX *tls_http_ctx        = NULL;
  151. int tls_http_active_flag     = 0;
  152. int ssl_http_initialized = 0;
  153. #endif /* NOHTTP */
  154.  
  155. SSL_CTX *ssl_ctx = NULL;
  156. SSL *ssl_con = NULL;
  157. int ssl_debug_flag = 0;
  158. int ssl_verbose_flag = 0;
  159. int ssl_only_flag = 0;
  160. int ssl_raw_flag = 0;
  161. int ssl_active_flag = 0;
  162. int ssl_verify_flag = SSL_VERIFY_PEER;
  163. int ssl_certsok_flag = 0;
  164. char *ssl_rsa_cert_file = NULL;
  165. char *ssl_rsa_cert_chain_file = NULL;
  166. char *ssl_rsa_key_file = NULL;
  167. char *ssl_dsa_cert_file = NULL;
  168. char *ssl_dsa_cert_chain_file = NULL;
  169. char *ssl_dh_key_file = NULL;
  170. char *ssl_crl_file = NULL;
  171. char *ssl_crl_dir = NULL;
  172. char *ssl_verify_file = NULL;
  173. char *ssl_verify_dir = NULL;
  174. char *ssl_dh_param_file = NULL;
  175. char *ssl_cipher_list = NULL;
  176. char *ssl_rnd_file = NULL;
  177.  
  178. SSL_CTX *tls_ctx = NULL;
  179. SSL *tls_con = NULL;
  180. int tls_only_flag = 0;
  181. int tls_raw_flag = 0;
  182. int tls_active_flag = 0;
  183.  
  184. int ssl_initialized = 0;
  185. int ssl_verify_depth = -1; /* used to track depth in verify routines */
  186.  
  187. /* compile this set to 1 to negotiate SSL/TLS but not actually start it */
  188. int ssl_dummy_flag=0;
  189.  
  190. extern int inserver;
  191. extern int debses;
  192. extern int accept_complete;
  193. extern char szHostName[], szUserNameRequested[], szUserNameAuthenticated[];
  194.  
  195. _PROTOTYP(int X509_to_user,(X509 *, char *, int));
  196.  
  197. int
  198. #ifdef CK_ANSIC
  199. ssl_server_verify_callback(int ok, X509_STORE_CTX * ctx)
  200. #else /* CK_ANSIC */
  201. ssl_server_verify_callback(ok, ctx)
  202. int ok;
  203. X509_STORE_CTX *ctx;
  204. #endif /* CK_ANSIC */
  205. {
  206.     static char *saved_subject=NULL;
  207.     char *subject=NULL, *issuer=NULL;
  208.     int depth,error;
  209.     X509 *xs = NULL;
  210.  
  211.     if ( ssl_certsok_flag )
  212.         return(1);
  213.  
  214.     error=X509_STORE_CTX_get_error(ctx);
  215.     depth=X509_STORE_CTX_get_error_depth(ctx);
  216.     xs=X509_STORE_CTX_get_current_cert(ctx);
  217.  
  218.     if (depth==0) {
  219.         /* clear things */
  220.         if (saved_subject!=NULL) {
  221.             free(saved_subject);
  222.             saved_subject=NULL;
  223.         }
  224.         if (auth_ssl_name!=NULL) {
  225.             free(auth_ssl_name);
  226.             auth_ssl_name=NULL;
  227.         }
  228.     }
  229.  
  230.  
  231.     if (ssl_debug_flag && !inserver) {
  232.         printf("ssl:server_verify_callback:depth=%d ok=%d err=%d-%s\r\n",
  233.             depth,ok,error,X509_verify_cert_error_string(error));
  234.     }
  235.  
  236.     /* first thing is to have a meaningful name for the current
  237.      * certificate that is being verified ... and if we cannot
  238.      * determine that then something is seriously wrong!
  239.      */
  240.     makestr(&subject,
  241.             (char *)X509_NAME_oneline(X509_get_subject_name(xs),NULL,0));
  242.     makestr(&issuer,
  243.             (char *)X509_NAME_oneline(X509_get_issuer_name(xs),NULL,0));
  244.     if (!subject || !subject[0] || !issuer || !issuer[0]) {
  245.         ok = 0;
  246.         goto return_time;
  247.     }
  248.  
  249.     if (ssl_verbose_flag && !inserver && depth != ssl_verify_depth) {
  250.         printf("[%d] Certificate Subject:\r\n%s\r\n",depth,subject);
  251.         printf("[%d] Certificate Issuer:\r\n%s\r\n",depth,issuer);
  252.         ssl_verify_depth = depth;
  253.     }
  254.  
  255.     /* make sure that the certificate that has been presented */
  256.     /* has not been revoked (if we have been given a CRL.     */
  257.     ok =  ssl_verify_crl(ok, ctx);
  258.  
  259.     /* if we have any form of error in secure mode we reject the connection */
  260.     if (error!=X509_V_OK) {
  261.         if (inserver) {
  262. #ifdef CKSYSLOG
  263.             if (ckxsyslog >= SYSLG_LI && ckxlogging) {
  264.                 cksyslog(SYSLG_LI, 0,
  265.                           "X.509 Certificate verify failure",
  266.                           (char *) subject,
  267.                           (char *)X509_verify_cert_error_string(error)
  268.                           );
  269.             }
  270. #endif /* CKSYSLOG */
  271.  
  272.         } else {
  273.             if ( ssl_verify_flag &
  274.                  (SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
  275.                 printf("Error: ");
  276.             else
  277.                 printf("Warning: ");
  278.             switch (error) {
  279.             case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
  280.                 printf("Certificate is self signed.\r\n");
  281.                 break;
  282.             case X509_V_ERR_CERT_HAS_EXPIRED:
  283.                 printf("Certificate has expired.\r\n");
  284.                 break;
  285.             case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
  286.                 printf(
  287.   "Certificate issuer's certificate isn't available locally.\r\n");
  288.                 break;
  289.             case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
  290.                 printf("Unable to verify leaf signature.\r\n");
  291.                 break;
  292.             case X509_V_ERR_CERT_REVOKED:
  293.                 printf("Certificate revoked.\r\n");
  294.                 break;
  295.             default:
  296.                 printf("Error %d while verifying certificate.\r\n",
  297.                        ctx->error);
  298.                 break;
  299.             }
  300.         }
  301.         ok = !(ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT);
  302.     } else {
  303.         /* if we got all the way to the top of the tree then
  304.          * we *can* use this certificate for a username to
  305.          * match ... in all other cases we must not!
  306.          */
  307.         auth_ssl_name = saved_subject;
  308.         saved_subject = NULL;
  309.     }
  310.  
  311.   return_time:
  312.  
  313.     /* save the name if at least the first level is okay */
  314.     if (depth == 0 && ok)
  315.         makestr(&saved_subject,subject);
  316.  
  317.     /* clean up things */
  318.     if (subject!=NULL)
  319.         free(subject);
  320.     if (issuer!=NULL)
  321.         free(issuer);
  322.  
  323.     return ok;
  324. }
  325.  
  326. int
  327. #ifdef CK_ANSIC
  328. ssl_client_verify_callback(int ok, X509_STORE_CTX * ctx)
  329. #else
  330. ssl_client_verify_callback(ok, ctx)
  331. int ok;
  332. X509_STORE_CTX *ctx;
  333. #endif
  334. {
  335.     char subject[256]="", issuer[256]="";
  336.     int depth, error, len;
  337.     X509 *xs;
  338.  
  339.     xs=X509_STORE_CTX_get_current_cert(ctx);
  340.     error=X509_STORE_CTX_get_error(ctx);
  341.     depth=X509_STORE_CTX_get_error_depth(ctx);
  342.  
  343.     if ( ssl_debug_flag )
  344.         printf("ssl:client_verify_callback:depth=%d ok=%d err=%d-%s\r\n",
  345.                 depth,ok,error,X509_verify_cert_error_string(error));
  346.  
  347.     if ( ssl_certsok_flag ) {
  348.         ok = 1;
  349.     }
  350.  
  351.     /* first thing is to have a meaningful name for the current
  352.      * certificate that is being verified ... and if we cannot
  353.      * determine that then something is seriously wrong!
  354.      */
  355. #ifdef XN_FLAG_SEP_MULTILINE
  356.     X509_NAME_print_ex(bio_err,X509_get_subject_name(xs),4,
  357.                         XN_FLAG_SEP_MULTILINE);
  358.     len = BIO_read(bio_err,subject,256);
  359.     subject[len < 256 ? len : 255] = '\0';
  360.     if (!subject[0]) {
  361.         ERR_print_errors(bio_err);
  362.         len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  363.         ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  364.         uq_ok("X.509 Subject Name unavailable", ssl_err, 1, NULL, 0);
  365.         ok=0;
  366.         goto return_time;
  367.     }
  368.  
  369.     X509_NAME_print_ex(bio_err,X509_get_issuer_name(xs),4,
  370.                         XN_FLAG_SEP_MULTILINE);
  371.     len = BIO_read(bio_err,issuer,256);
  372.     issuer[len < 256 ? len : 255] = '\0';
  373.     if (!issuer[0]) {
  374.         ERR_print_errors(bio_err);
  375.         len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  376.         ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  377.         uq_ok("X.509 Issuer Name unavailable", ssl_err, 1, NULL, 0);
  378.         ok=0;
  379.         goto return_time;
  380.     }
  381. #else /* XN_FLAG_SEP_MULTILINE */
  382.     X509_NAME_oneline(X509_get_subject_name(xs),subject,256);
  383.     if (!subject[0]) {
  384.         int len;
  385.         ERR_print_errors(bio_err);
  386.         len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  387.         ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  388.         uq_ok("X.509 Subject Name unavailable", ssl_err, 1, NULL, 0);
  389.         ok=0;
  390.         goto return_time;
  391.     }
  392.  
  393.     X509_NAME_oneline(X509_get_issuer_name(xs),issuer,256);
  394.     if (!issuer[0]) {
  395.         int len;
  396.         ERR_print_errors(bio_err);
  397.         len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  398.         ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  399.         uq_ok("X.509 Issuer Name unavailable", ssl_err, 1, NULL, 0);
  400.         ok=0;
  401.         goto return_time;
  402.     }
  403. #endif /* XN_FLAG_SEP_MULTILINE */
  404.  
  405.     if (ssl_verbose_flag && depth != ssl_verify_depth) {
  406.         printf("[%d] Certificate Subject:\r\n%s\r\n",depth,subject);
  407.         printf("[%d] Certificate Issuer:\r\n%s\r\n",depth,issuer);
  408.         ssl_verify_depth = depth;
  409.     }
  410.  
  411.     ok = ssl_verify_crl(ok, ctx);
  412.  
  413.     if ( !ok ) {
  414.         char prefix[1024];
  415.         /* if the server is using a self signed certificate then
  416.          * we need to decide if that is good enough for us to
  417.          * accept ...
  418.          */
  419.  
  420.         switch ( error ) {
  421.         case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: {
  422.             if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
  423.                 /* make 100% sure that in secure more we drop the
  424.                  * connection if the server does not have a
  425.                  * real certificate!
  426.                  */
  427.                 ckmakxmsg(prefix,1024,
  428.                            "Error: Server has a self-signed certificate\n",
  429.                            "[",ckitoa(depth),"] Certificate Subject=\n",subject,
  430.                            "\n[",ckitoa(depth),"] Certificate Issuer=\n",issuer,
  431.                            NULL,NULL,NULL);
  432.  
  433.                 uq_ok(prefix, "Rejecting Connection", 1, NULL, 0);
  434.  
  435.                 /* sometimes it is really handy to be able to debug things
  436.                 * and still get a connection!
  437.                 */
  438.                 if (ssl_debug_flag) {
  439.                     printf("SSL: debug -> ignoring cert required!\r\n");
  440.                     ok=1;
  441.                 } else {
  442.                     ok=0;
  443.                 }
  444.                 goto return_time;
  445.             } else if (ssl_verify_flag != SSL_VERIFY_NONE) {
  446.                 ckmakxmsg(prefix,1024,
  447.                            "Warning: Server has a self-signed certificate\n",
  448.                            "[",ckitoa(depth),"] Certificate Subject=\n",subject,
  449.                            "\n[",ckitoa(depth),"] Certificate Issuer=\n",issuer,
  450.                            NULL,NULL,NULL);
  451.  
  452.                 ok = uq_ok(prefix,
  453.                            "Continue? (Y/N) ",
  454.                            3, NULL, 0);
  455.                 if ( ok < 0 )
  456.                     ok = 0;
  457.                 goto return_time;
  458.             }
  459.         }
  460.         case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
  461.             if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
  462.                 /* make 100% sure that in secure more we drop the
  463.                  * connection if the server does not have a
  464.                  * real certificate!
  465.                  */
  466.                 ckmakxmsg(prefix,1024,
  467.                            "Error: ",
  468.                            (char *)X509_verify_cert_error_string(error),
  469.                            "\nCertificate Issuer=\n",issuer,
  470.                            NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL);
  471.                 uq_ok(prefix, "Rejecting Connection", 1, NULL, 0);
  472.  
  473.                 /* sometimes it is really handy to be able to debug things
  474.                 * and still get a connection!
  475.                 */
  476.                 if (ssl_debug_flag) {
  477.                     printf("SSL: debug -> ignoring cert required!\r\n");
  478.                     ok=1;
  479.                 } else {
  480.                     ok=0;
  481.                 }
  482.                 goto return_time;
  483.             } else if (ssl_verify_flag != SSL_VERIFY_NONE) {
  484.                 ckmakxmsg(prefix,1024,
  485.                            "Warning: ",
  486.                            (char *)X509_verify_cert_error_string(error),
  487.                            "\nCertificate Issuer=\n",issuer,
  488.                            NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL);
  489.                 ok = uq_ok(prefix, "Continue (Y/N)", 3, NULL, 0);
  490.                 goto return_time;
  491.             }
  492.             break;
  493.         case X509_V_ERR_CERT_NOT_YET_VALID:
  494.         case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
  495.             if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
  496.                 int len;
  497.                 /* make 100% sure that in secure more we drop the
  498.                  * connection if the server does not have a
  499.                  * real certificate!
  500.                  */
  501.                 ASN1_TIME_print(bio_err,X509_get_notBefore(xs));
  502.                 len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  503.                 ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  504.                 ckmakxmsg(prefix,1024,
  505.                            "Error: ",
  506.                            (char *)X509_verify_cert_error_string(error),
  507.                            "\nCertificate Subject=\n",subject,
  508.                            "\nnotBefore=",ssl_err,
  509.                            NULL,NULL,NULL,NULL,NULL,NULL);
  510.                 uq_ok(prefix, "Rejecting Connection", 1, NULL, 0);
  511.                 /* sometimes it is really handy to be able to debug things
  512.                 * and still get a connection!
  513.                 */
  514.                 if (ssl_debug_flag) {
  515.                     printf("SSL: debug -> ignoring cert required!\r\n");
  516.                     ok=1;
  517.                 } else {
  518.                     ok=0;
  519.                 }
  520.                 goto return_time;
  521.             } else if (ssl_verify_flag != SSL_VERIFY_NONE) {
  522.                 int len;
  523.                 ASN1_TIME_print(bio_err,X509_get_notBefore(xs));
  524.                 len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  525.                 ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  526.                 ckmakxmsg(prefix,1024,
  527.                            "Warning: ",
  528.                            (char *)X509_verify_cert_error_string(error),
  529.                            "\nCertificate Subject=\n",subject,
  530.                            "\n    notBefore=",ssl_err,
  531.                            NULL,NULL,NULL,NULL,NULL,NULL);
  532.                 ok = uq_ok(prefix, "Continue (Y/N)", 3, NULL, 0);
  533.             }
  534.             break;
  535.         case X509_V_ERR_CERT_HAS_EXPIRED:
  536.         case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
  537.             if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
  538.                 int len;
  539.                 /* make 100% sure that in secure more we drop the
  540.                  * connection if the server does not have a
  541.                  * real certificate!
  542.                  */
  543.                 ASN1_TIME_print(bio_err,X509_get_notAfter(xs));
  544.                 len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  545.                 ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  546.  
  547.                 ckmakxmsg(prefix,1024,
  548.                            "Error: ",
  549.                            (char *)X509_verify_cert_error_string(error),
  550.                            "\nCertificate Subject=\n",subject,
  551.                            "\n    notAfter=",ssl_err,
  552.                            NULL,NULL,NULL,NULL,NULL,NULL);
  553.                 uq_ok(prefix, "Rejecting Connection", 1, NULL, 0);
  554.    
  555.                 /* sometimes it is really handy to be able to debug things
  556.                 * and still get a connection!
  557.                 */
  558.                 if (ssl_debug_flag) {
  559.                     printf("SSL: debug -> ignoring cert required!\r\n");
  560.                     ok=1;
  561.                 } else {
  562.                     ok=0;
  563.                 }
  564.                 goto return_time;
  565.             } else if (ssl_verify_flag != SSL_VERIFY_NONE) {
  566.                 int len;
  567.                 ASN1_TIME_print(bio_err,X509_get_notAfter(xs));
  568.                 len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  569.                 ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  570.                 ckmakxmsg(prefix,1024,
  571.                            "Warning: ",
  572.                            (char *)X509_verify_cert_error_string(error),
  573.                            "\nCertificate Subject=\n",subject,
  574.                            "\n    notAfter=",ssl_err,
  575.                            NULL,NULL,NULL,NULL,NULL,NULL);
  576.                 ok = uq_ok(prefix, "Continue (Y/N)", 3, NULL, 0);
  577.             }
  578.             break;
  579.         case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
  580.         case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
  581.             /*
  582.              * When an SSL server sends its certificates to the client there
  583.              * are two" conventions": one is to send the complete certificate
  584.              * chain and the other is to send the whole chain apart from the
  585.              * root.
  586.              *
  587.              * You don't usually need the root because the root is normally
  588.              * stored and trusted locally.
  589.              *
  590.              * So if you get the whole chain it will complain about the self
  591.              * signed certificate whereas if the root is missing it says it
  592.              * can't find the issuer certificate.
  593.              */
  594.             if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
  595.                 /* make 100% sure that in secure more we drop the
  596.                  * connection if the server does not have a
  597.                  * real certificate!
  598.                  */
  599.                 ckmakxmsg(prefix,1024,
  600.                            "Error: ",
  601.                            (char *)X509_verify_cert_error_string(error),
  602.                            "\nCertificate Issuer=\n",issuer,
  603.                            NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL);
  604.                 uq_ok(prefix, "Rejecting Connection", 1, NULL, 0);
  605.                 /* sometimes it is really handy to be able to debug things
  606.                 * and still get a connection!
  607.                 */
  608.                 if (ssl_debug_flag) {
  609.                     printf("SSL: debug -> ignoring cert required!\r\n");
  610.                     ok=1;
  611.                 } else {
  612.                     ok=0;
  613.                 }
  614.                 goto return_time;
  615.             } else if (ssl_verify_flag != SSL_VERIFY_NONE) {
  616.                 ckmakxmsg(prefix,1024,
  617.                            "Warning: ",
  618.                            (char *)X509_verify_cert_error_string(error),
  619.                            "\nCertificate Issuer=\n",issuer,
  620.                            NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL);
  621.                 ok = uq_ok(prefix, "Continue (Y/N)", 3, NULL, 0);
  622. #ifdef NT
  623.                 if (ok) {
  624.                     /* if the user decides to accept the certificate
  625.                      * offer to store it for future connections in 
  626.                      * the user's private store
  627.                      */
  628.                     ok = uq_ok(
  629.   "Do you wish to store the certificate to verify future connections?",
  630.                                "Continue (Y/N)", 3, NULL, 0);
  631.                     if (ok)
  632.                         ck_X509_save_cert_to_user_store(xs);
  633.                 }
  634. #endif /* NT */
  635.             }
  636.             break;
  637.         case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
  638.         case X509_V_ERR_UNABLE_TO_GET_CRL:
  639.         case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
  640.         case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
  641.         case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
  642.         case X509_V_ERR_CERT_SIGNATURE_FAILURE:
  643.         case X509_V_ERR_CRL_SIGNATURE_FAILURE:
  644.         case X509_V_ERR_CRL_NOT_YET_VALID:
  645.         case X509_V_ERR_CRL_HAS_EXPIRED:
  646.         case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
  647.         case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
  648.         case X509_V_ERR_OUT_OF_MEM:
  649.         case X509_V_ERR_CERT_CHAIN_TOO_LONG:
  650.         case X509_V_ERR_CERT_REVOKED:
  651.         case X509_V_ERR_APPLICATION_VERIFICATION:
  652.         default:
  653.             if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
  654.                 /* make 100% sure that in secure mode we drop the
  655.                  * connection if the server does not have a
  656.                  * real certificate!
  657.                  */
  658.                 ckmakxmsg(prefix,1024,
  659.                            "Error: ",
  660.                            (char *)X509_verify_cert_error_string(error),
  661.                            "\nCertificate Subject=\n",subject,
  662.                            NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL);
  663.                 uq_ok(prefix, "Rejecting Connection", 1, NULL, 0);
  664.  
  665.                 /* sometimes it is really handy to be able to debug things
  666.                 * and still get a connection!
  667.                 */
  668.                 if (ssl_debug_flag) {
  669.                     printf("SSL: debug -> ignoring cert required!\r\n");
  670.                     ok=1;
  671.                 } else {
  672.                     ok=0;
  673.                 }
  674.                 goto return_time;
  675.             } else if (ssl_verify_flag != SSL_VERIFY_NONE) {
  676.                 ckmakxmsg(prefix,1024,
  677.                            "Warning: ",
  678.                            (char *)X509_verify_cert_error_string(error),
  679.                            "\nCertificate Subject=\n",subject,
  680.                            NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL);
  681.                 ok = uq_ok(prefix, "Continue (Y/N)", 3, NULL, 0);
  682.             }
  683.             break;
  684.         }
  685.     }
  686.  
  687.   return_time:
  688.     if ( ssl_debug_flag )
  689.         printf("ssl:client_verify_callback => ok: %d\r\n",ok);
  690.     return ok;
  691. }
  692.  
  693. VOID
  694. #ifdef CK_ANSIC
  695. ssl_client_info_callback(const SSL *s, int where, int ret)
  696. #else
  697. ssl_client_info_callback(s,where,ret)
  698. const SSL *s;
  699. int where;
  700. int ret;
  701. #endif /* CK_ANSIC */
  702. {
  703.     if (inserver || !ssl_debug_flag)
  704.         return;
  705.  
  706.     switch ( where ) {
  707.     case SSL_CB_CONNECT_LOOP:
  708.         printf("SSL_connect:%s %s\r\n",
  709.                 SSL_state_string((SSL *)s),SSL_state_string_long((SSL *)s));
  710.         break;
  711.     case SSL_CB_CONNECT_EXIT:
  712.         if (ret == 0) {
  713.             printf("SSL_connect:failed in %s %s\r\n",
  714.                     SSL_state_string((SSL *)s),SSL_state_string_long((SSL *)s));
  715.         } else if (ret < 0) {
  716.             printf("SSL_connect:error in %s %s\r\n",
  717.                     SSL_state_string((SSL *)s),SSL_state_string_long((SSL *)s));
  718.         }
  719.         break;
  720.     case SSL_CB_ACCEPT_LOOP:
  721.         printf("SSL_accept:%s %s\r\n",
  722.                 SSL_state_string((SSL *)s),SSL_state_string_long((SSL *)s));
  723.         break;
  724.     case SSL_CB_ACCEPT_EXIT:
  725.         if (ret == 0) {
  726.             printf("SSL_accept:failed in %s %s\r\n",
  727.                     SSL_state_string((SSL *)s),SSL_state_string_long((SSL *)s));
  728.         } else if (ret < 0) {
  729.             printf("SSL_accept:error in %s %s\r\n",
  730.                     SSL_state_string((SSL *)s),SSL_state_string_long((SSL *)s));
  731.         }
  732.         break;
  733.     case SSL_CB_READ_ALERT:
  734.         printf("SSL_read_alert\r\n");
  735.         break;
  736.     case SSL_CB_WRITE_ALERT:
  737.         printf("SSL_write_alert\r\n");
  738.         break;
  739.     case SSL_CB_HANDSHAKE_START:
  740.         printf("SSL_handshake:%s %s\r\n",
  741.                 SSL_state_string((SSL *)s),SSL_state_string_long((SSL *)s));
  742.         break;
  743.     case SSL_CB_HANDSHAKE_DONE:
  744.         printf("SSL_handshake:%s %s\r\n",
  745.                 SSL_state_string((SSL *)s),SSL_state_string_long((SSL *)s));
  746.         break;
  747.     }
  748. }
  749.  
  750. #ifdef USE_CERT_CB
  751. /* Return 1, client cert is available */
  752. /* Return 0, no client cert is available */
  753. /* Return -1, callback must be called again. SSL_want_x509_lookup() == 1 */
  754. int
  755. #ifdef CK_ANSIC
  756. ssl_client_cert_callback(SSL * s, X509 ** x509, EVP_PKEY ** pkey)
  757. #else /* CK_ANSIC */
  758. ssl_client_cert_callback(s, x509, pkey)
  759.     SSL * s;
  760.     X509 ** x509;
  761.     EVP_PKEY ** pkey;
  762. #endif /* CK_ANSIC */
  763. {
  764.     if ( ssl_debug_flag ) {
  765.         const char * cipher_list=SSL_get_cipher(s);
  766.         printf("ssl_client_cert_callback called (%s)\r\n",
  767.                 cipher_list?cipher_list:"UNKNOWN");
  768.     }
  769. #ifdef COMMENT
  770.     if ( s == tls_con ) {
  771.         if (tls_load_certs(tls_cts,tls_con,0)) {
  772.             *x509 = SSL_get_certificate(s);
  773.             *pkey = SSL_get_privatekey(s);
  774.             return(1);
  775.         }
  776.     } else if ( s == ssl_con ) {
  777.         if (tls_load_certs(ssl_ctx,ssl_con,0)) {
  778.             *x509 = SSL_get_certificate(s);
  779.             *pkey = SSL_get_privatekey(s);
  780.             return(1);
  781.         }
  782.     }
  783.     return(0);
  784. #else /* COMMENT */
  785.     return(0);
  786. #endif /* COMMENT */
  787. }
  788. #endif /* USE_CERT_CB */
  789.  
  790. #ifndef MS_CALLBACK
  791. #define MS_CALLBACK
  792. #endif /* MS_CALLBACK */
  793.  
  794. static RSA MS_CALLBACK *
  795. #ifdef CK_ANSIC
  796. tmp_rsa_cb(SSL * s, int export, int keylength)
  797. #else /* CK_ANSIC */
  798. tmp_rsa_cb(s,export,keylength)
  799. SSL *s;
  800. int export;
  801. int keylength;
  802. #endif /* CK_ANSIC */
  803. {
  804.     static RSA *rsa_tmp=NULL;
  805.  
  806. #ifndef NO_RSA
  807.     if (rsa_tmp == NULL)
  808.     {
  809.         if (ssl_debug_flag)
  810.             printf("Generating temporary (%d bit) RSA key...\r\n",keylength);
  811.  
  812.         rsa_tmp=RSA_generate_key(keylength,RSA_F4,NULL,NULL);
  813.  
  814.         if (ssl_debug_flag)
  815.             printf("\r\n");
  816.     }
  817. #else /* NO_RSA */
  818.     if (ssl_debug_flag)
  819.         printf("Unable to generate temporary RSA key...\r\n");
  820. #endif
  821.     return(rsa_tmp);
  822. }
  823.  
  824.  
  825. #ifndef NO_DH
  826. static unsigned char dh512_p[]={
  827.     0xE9,0x4E,0x3A,0x64,0xFA,0x65,0x5F,0xA6,0x44,0xC7,0xFC,0xF1,
  828.     0x16,0x8B,0x11,0x11,0x7A,0xF0,0xB2,0x49,0x80,0x56,0xA3,0xF8,
  829.     0x0F,0x7D,0x01,0x68,0x5D,0xF6,0x8A,0xEA,0x8C,0xDD,0x01,0xDC,
  830.     0x43,0x18,0xE0,0xC4,0x89,0x80,0xE6,0x2D,0x44,0x77,0x45,0xFD,
  831.     0xBA,0xFC,0x43,0x35,0x12,0xC0,0xED,0x32,0xD3,0x16,0xEF,0x51,
  832.     0x09,0x44,0xA2,0xDB,
  833. };
  834. static unsigned char dh512_g[]={
  835.     0x05,
  836. };
  837.  
  838. static unsigned char dh768_p[]={
  839.     0x8B,0x2A,0x8C,0x6C,0x0F,0x87,0xC7,0x34,0xEE,0x2E,0xFB,0x60,
  840.     0x94,0xB3,0xBF,0x95,0xBA,0x84,0x74,0x86,0xEA,0xE0,0xA4,0x33,
  841.     0xE0,0x8F,0x7C,0x79,0x5C,0x62,0xE2,0x91,0xC5,0x6D,0x68,0xB9,
  842.     0x6C,0x5E,0x4E,0x94,0x0C,0x8E,0x56,0x8E,0xEB,0x98,0x7C,0x6E,
  843.     0x0E,0xF2,0xD5,0xAA,0x22,0x27,0x3F,0x0F,0xAF,0x10,0xB5,0x0B,
  844.     0x16,0xCC,0x05,0x27,0xBB,0x58,0x6D,0x61,0x4B,0x2B,0xAB,0xDC,
  845.     0x6A,0x15,0xBC,0x36,0x75,0x4D,0xEC,0xAB,0xFA,0xB6,0xE1,0xB1,
  846.     0x13,0x70,0xD8,0x77,0xCD,0x5E,0x51,0x77,0x81,0x0D,0x77,0x43,
  847. };
  848. static unsigned char dh768_g[]={
  849.     0x05,
  850. };
  851.  
  852. static unsigned char dh1024_p[]={
  853.     0xA4,0x75,0xCF,0x35,0x00,0xAF,0x3C,0x17,0xCE,0xB0,0xD0,0x52,
  854.     0x43,0xA0,0x0E,0xFA,0xA2,0xC9,0xBE,0x0B,0x76,0x7A,0xD9,0x2E,
  855.     0xF4,0x97,0xAC,0x02,0x24,0x69,0xF6,0x36,0x4F,0xAB,0xCC,0x43,
  856.     0xC1,0x74,0xFF,0xA3,0xD4,0x04,0x0F,0x11,0x2B,0x6D,0x8C,0x47,
  857.     0xC9,0xCF,0x40,0x93,0x9B,0x7D,0x1E,0x52,0x85,0xB2,0x17,0x55,
  858.     0x9C,0xF2,0x41,0x02,0x2A,0x9D,0x5F,0x24,0x22,0xC6,0x04,0xC4,
  859.     0xAB,0x92,0x6D,0xC7,0xC8,0xF3,0x41,0x58,0x6C,0x86,0xFD,0xB8,
  860.     0x0F,0x2D,0xDD,0xBF,0xA8,0x40,0x0C,0x58,0xC8,0xF2,0x3F,0x18,
  861.     0xEF,0xF1,0x93,0x3E,0xBA,0x16,0x41,0xBE,0x32,0x6C,0xC5,0x63,
  862.     0xFF,0x8A,0x02,0x3D,0xAC,0xD5,0x5A,0x49,0x64,0x34,0x14,0x2E,
  863.     0xFB,0x2E,0xE7,0x39,0x1A,0x0F,0x3C,0x33,
  864. };
  865. static unsigned char dh1024_g[]={
  866.     0x05,
  867. };
  868.  
  869. static unsigned char dh1536_p[]={
  870.     0xA3,0x2B,0x75,0x0E,0x7B,0x31,0x82,0xCA,0xF2,0xFC,0xF3,0x3D,
  871.     0xCE,0x5F,0xCD,0x5B,0x95,0xF6,0x2F,0xA4,0x5D,0x08,0x26,0xD2,
  872.     0x5F,0xC0,0x3F,0xC5,0xD8,0xA2,0xFE,0x83,0x26,0xBC,0xEB,0x7D,
  873.     0xF0,0x4E,0xD2,0xA6,0xBB,0x3C,0x88,0x63,0xCE,0x98,0xDE,0x08,
  874.     0xE2,0xE1,0xAF,0xE2,0x38,0xA8,0xFA,0x68,0x76,0x8D,0xBF,0xDF,
  875.     0xBB,0x30,0x15,0xFE,0xBD,0x22,0xCC,0x03,0x4E,0x5E,0x33,0xA3,
  876.     0x6D,0xD6,0x68,0x12,0x97,0x17,0x4B,0xB5,0x84,0x5F,0x5F,0xA3,
  877.     0x5C,0x2F,0xA4,0x10,0xC1,0xAD,0xBF,0xAC,0x30,0xCA,0x47,0x64,
  878.     0x63,0xFE,0xEE,0xEE,0xA1,0x64,0x73,0x70,0xAA,0xF9,0xFE,0xC6,
  879.     0xAD,0x5E,0xF6,0xF3,0x9C,0xDF,0x34,0x53,0x34,0x72,0xA6,0xA4,
  880.     0xBB,0x81,0x5A,0x43,0x41,0xFD,0x41,0x05,0x5B,0x77,0x7B,0x84,
  881.     0x03,0xFA,0x8A,0xFA,0xF7,0x8E,0x0F,0xCB,0x51,0xA2,0xB8,0x45,
  882.     0xFF,0x59,0x42,0xEF,0xCF,0xF6,0x25,0x37,0xE2,0x6D,0xFF,0x69,
  883.     0x11,0xF5,0x77,0x59,0x79,0x1C,0x5F,0x05,0xFC,0x7A,0x65,0x81,
  884.     0x03,0x4A,0x78,0xC6,0xE9,0x48,0x73,0xF6,0x10,0xBC,0x99,0x1C,
  885.     0xEE,0x44,0x2F,0x8B,0x70,0xCA,0xA8,0xB6,0x02,0x83,0x3E,0x0B,
  886. };
  887. static unsigned char dh1536_g[]={
  888.     0x05,
  889. };
  890.  
  891. static unsigned char dh2048_p[]={
  892.     0xFA,0x4E,0xE4,0x3B,0xFA,0xC1,0x87,0xDD,0xE7,0xC6,0x8B,0xE6,
  893.     0x13,0x85,0xBC,0x9B,0x2B,0x8B,0x5B,0x46,0xBB,0x8B,0x86,0x6D,
  894.     0xD7,0xB6,0xD5,0x49,0xC5,0x54,0xF2,0x3E,0xD2,0x39,0x64,0x9B,
  895.     0x0E,0x33,0x39,0x8F,0xFA,0xFA,0xD9,0x78,0xED,0x34,0x82,0x29,
  896.     0x37,0x58,0x4D,0x5D,0x40,0xCB,0x69,0xE3,0x8A,0x9F,0x17,0x0C,
  897.     0x01,0x23,0x6B,0x05,0x01,0xAF,0x33,0xDE,0xDF,0x1A,0xBB,0x7B,
  898.     0x6A,0x9F,0xD8,0xED,0x8D,0x5E,0x44,0x19,0x5B,0xE0,0xB6,0x23,
  899.     0xF9,0x7A,0x96,0x6E,0x94,0x33,0x31,0x49,0xBA,0x84,0xD5,0x12,
  900.     0xD7,0x6D,0xDC,0x35,0x54,0x64,0xA3,0xD8,0x04,0x26,0xC5,0xAF,
  901.     0x7F,0xE3,0xFE,0x6F,0xBE,0xD5,0x17,0x72,0x4B,0xA6,0xD0,0xA7,
  902.     0x5F,0x18,0xF5,0xF0,0x2D,0x11,0x9A,0xF6,0xD5,0x3B,0x6C,0x61,
  903.     0x3C,0x6F,0x8E,0x09,0x4F,0x2C,0xE1,0x26,0x06,0x51,0xB3,0x19,
  904.     0x85,0x85,0x13,0xF9,0xC2,0x6E,0x80,0x28,0x9E,0x8A,0xA0,0x01,
  905.     0x46,0xD1,0x85,0x44,0x8C,0xE6,0xEE,0x7E,0x1E,0x17,0x3D,0xBA,
  906.     0x54,0xFF,0xE8,0x0E,0xDD,0x51,0xF3,0x74,0x7F,0x0D,0x0B,0xAB,
  907.     0xCA,0x84,0x8D,0x24,0x5D,0x56,0xD4,0x47,0x02,0xFC,0x93,0x9F,
  908.     0xAE,0x9B,0x5C,0xDB,0x63,0xEB,0x65,0x01,0x38,0xC2,0x7B,0x30,
  909.     0x1E,0x17,0x1C,0x75,0xF5,0x16,0x3B,0x4F,0x5F,0x41,0x32,0xB5,
  910.     0xFF,0x9E,0x61,0xFD,0xD2,0x62,0x6E,0xFD,0x8A,0x28,0x93,0x59,
  911.     0x2D,0x70,0x14,0x4D,0xE1,0x86,0xD5,0x90,0xB4,0xDF,0x72,0x71,
  912.     0xE0,0xB4,0xD0,0xD6,0x82,0x3A,0x4A,0x04,0x58,0x32,0x0B,0xD3,
  913.     0x51,0x13,0x32,0x63,
  914. };
  915. static unsigned char dh2048_g[]={
  916.     0x02,
  917. };
  918.  
  919. static DH *
  920. get_dh512()
  921. {
  922.     DH *dh=NULL;
  923.  
  924.     if ((dh=DH_new()) == NULL)
  925.         return(NULL);
  926.     dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
  927.     dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
  928.     if ((dh->p == NULL) || (dh->g == NULL))
  929.         return(NULL);
  930.     return(dh);
  931. }
  932.  
  933. static DH *
  934. get_dh768()
  935. {
  936.     DH *dh=NULL;
  937.  
  938.     if ((dh=DH_new()) == NULL)
  939.         return(NULL);
  940.     dh->p=BN_bin2bn(dh768_p,sizeof(dh768_p),NULL);
  941.     dh->g=BN_bin2bn(dh768_g,sizeof(dh768_g),NULL);
  942.     if ((dh->p == NULL) || (dh->g == NULL))
  943.         return(NULL);
  944.     return(dh);
  945. }
  946.  
  947. static DH *
  948. get_dh1024()
  949. {
  950.     DH *dh=NULL;
  951.  
  952.     if ((dh=DH_new()) == NULL)
  953.         return(NULL);
  954.     dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
  955.     dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
  956.     if ((dh->p == NULL) || (dh->g == NULL))
  957.         return(NULL);
  958.     return(dh);
  959. }
  960.  
  961. static DH *
  962. get_dh1536()
  963. {
  964.     DH *dh=NULL;
  965.  
  966.     if ((dh=DH_new()) == NULL)
  967.         return(NULL);
  968.     dh->p=BN_bin2bn(dh1536_p,sizeof(dh1536_p),NULL);
  969.     dh->g=BN_bin2bn(dh1536_g,sizeof(dh1536_g),NULL);
  970.     if ((dh->p == NULL) || (dh->g == NULL))
  971.         return(NULL);
  972.     return(dh);
  973. }
  974.  
  975. static DH *
  976. get_dh2048()
  977. {
  978.     DH *dh=NULL;
  979.  
  980.     if ((dh=DH_new()) == NULL)
  981.         return(NULL);
  982.     dh->p=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL);
  983.     dh->g=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL);
  984.     if ((dh->p == NULL) || (dh->g == NULL))
  985.         return(NULL);
  986.     return(dh);
  987. }
  988. #endif /* NO_DH */
  989.  
  990. static DH MS_CALLBACK *
  991. #ifdef CK_ANSIC
  992. tmp_dh_cb(SSL * s, int export, int keylength)
  993. #else /* CK_ANSIC */
  994. tmp_dh_cb(s,export,keylength)
  995. SSL *s;
  996. int export;
  997. int keylength;
  998. #endif /* CK_ANSIC */
  999. {
  1000.     static DH *dh_tmp=NULL;
  1001.     BIO *bio=NULL;
  1002.  
  1003. #ifndef NO_DH
  1004.     if (dh_tmp == NULL)
  1005.     {
  1006.         if (ssl_dh_param_file  &&
  1007.              (bio=BIO_new_file(ssl_dh_param_file,"r")) != NULL)
  1008.             dh_tmp=PEM_read_bio_DHparams(bio,NULL,NULL,NULL);
  1009.         if (bio != NULL)
  1010.             BIO_free(bio);
  1011.  
  1012.         if ( dh_tmp == NULL ) {
  1013.             if ( keylength < 768 )
  1014.                 dh_tmp = get_dh512();
  1015.             else if ( keylength < 1024 )
  1016.                 dh_tmp = get_dh768();
  1017.             else if ( keylength < 1536 )
  1018.                 dh_tmp = get_dh1024();
  1019.             else if ( keylength < 2048 )
  1020.                 dh_tmp = get_dh1536();
  1021.             else
  1022.                 dh_tmp = get_dh2048();
  1023.         }
  1024.     }
  1025. #else /* NO_DH */
  1026.     if (ssl_debug_flag)
  1027.         printf("DH not supported...\r\n");
  1028. #endif /* NO_DH */
  1029.     return(dh_tmp);
  1030. }
  1031.  
  1032. static void
  1033. ssl_display_comp(SSL * ssl)
  1034. {
  1035.     if ( quiet )            /* fdc - Mon Nov 28 11:44:15 2005 */
  1036.         return;
  1037.  
  1038.     if ( !ck_ssleay_is_installed() )
  1039.         return;
  1040.  
  1041.     if (ssl == NULL)
  1042.         return;
  1043.  
  1044.     if (ssl->expand == NULL || ssl->expand->meth == NULL)
  1045.         printf("Compression: None\r\n");
  1046.     else {
  1047.         printf("Compression: %s\r\n",ssl->expand->meth->name);
  1048.     }
  1049. }
  1050.  
  1051. int
  1052. #ifdef CK_ANSIC
  1053. ssl_display_connect_details(SSL * ssl_con, int server, int verbose)
  1054. #else /* CK_ANSIC */
  1055. ssl_display_connect_details(ssl_con,server,verbose)
  1056. SSL *ssl_con;
  1057. int server;
  1058. int verbose;
  1059. #endif /* CK_ANSIC */
  1060. {
  1061.     X509 *peer;
  1062.     SSL_CIPHER * cipher;
  1063.     const char *cipher_list;
  1064.     char buf[512]="";
  1065.  
  1066.     if ( quiet )            /* fdc - Mon Nov 28 11:44:15 2005 */
  1067.         return(0);
  1068.  
  1069.     if ( !ck_ssleay_is_installed() )
  1070.         return(0);
  1071.  
  1072.     if ( inserver && !tn_deb )
  1073.         return(0);
  1074.  
  1075.     /* the cipher list *can* be NULL ... useless but it happens! */
  1076.     cipher = SSL_get_current_cipher(ssl_con);
  1077.     cipher_list = SSL_CIPHER_get_name(cipher);
  1078.     SSL_CIPHER_description(cipher,buf,sizeof(buf));
  1079.     if (cipher_list==NULL)
  1080.         cipher_list="<NULL>";
  1081.     printf("[TLS - %s",buf);
  1082.     ssl_display_comp(ssl_con);
  1083.  
  1084.     if ( server ) {
  1085.         cipher_list=SSL_get_shared_ciphers(ssl_con,buf,512);
  1086.         if (cipher_list==NULL)
  1087.             cipher_list="<NULL>";
  1088.         printf("[TLS - shared ciphers=%s]\r\n",
  1089.                 cipher_list);
  1090.         }       
  1091.     if ( server || tn_deb ) {
  1092.         peer=SSL_get_peer_certificate(ssl_con);
  1093.         if (peer != NULL) {
  1094.             X509_NAME_oneline(X509_get_subject_name(peer),buf,512);
  1095.             printf("[TLS - subject=%s]\r\n",buf);
  1096.             X509_NAME_oneline(X509_get_issuer_name(peer),buf,512);
  1097.             printf("[TLS - issuer=%s]\r\n",buf);
  1098.             /* X509_free(peer); */
  1099.         } else if (!tls_is_krb5(0)) {
  1100.             if ( !sstelnet && !tcp_incoming ) {
  1101.                 printf("[TLS - No certificate provided.]\r\n");
  1102.                 printf(
  1103.      "[TLS - The identity of the host could not be verified.]\r\n");
  1104.             }
  1105.         }
  1106.     }
  1107.     return(0);
  1108. }
  1109.  
  1110. /*
  1111.  * Use SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *, void * userdata)
  1112.  * to set the value of the userdata.  We are going to use it to store the
  1113.  * prompt.
  1114.  */
  1115.  
  1116. int
  1117. #ifdef CK_ANSIC
  1118. ssl_passwd_callback(char *buf, int len, int rwflag, VOID * userdata)
  1119. #else /* CK_ANSIC */
  1120. ssl_passwd_callback(buf,len,rwflag,userdata)
  1121.     char * buf; int len; int rwflag; VOID *userdata;
  1122. #endif /* CK_ANSIC */
  1123. {
  1124.     extern char pwbuf[];
  1125.     extern int  pwflg, pwcrypt;
  1126.     int   ok;
  1127.     char *prompt=NULL;
  1128.  
  1129.     if ( pwbuf[0] && pwflg ) {
  1130.         int n;
  1131.         n = ckstrncpy(buf,pwbuf,len);
  1132. #ifdef OS2
  1133.         if ( pwcrypt )
  1134.             ck_encrypt((char *)buf);
  1135. #endif /* OS2 */
  1136.         return(n);
  1137.     }
  1138.  
  1139.     if ( userdata == NULL )
  1140.         prompt="Enter certificate passphrase: ";
  1141.     else
  1142.         prompt=(char*)userdata;
  1143.     ok = uq_txt(NULL,prompt,2,NULL,buf,len,NULL,DEFAULT_UQ_TIMEOUT);
  1144.     return(ok > 0 ? strlen(buf) : 0);
  1145. }
  1146.  
  1147.  
  1148. /* Attempts to load certificate data into the TLS context structures */
  1149. /* Returns 1 on success; 0 on failure */
  1150. int
  1151. tls_load_certs(SSL_CTX * ctx, SSL * con, int server)
  1152. {
  1153.     int rc = 1;
  1154.  
  1155.     if ( !ck_ssleay_is_installed() )
  1156.         return(0);
  1157.  
  1158.     debug(F111,"tls_load_certs","SSL_CTX",ctx);
  1159.     debug(F111,"tls_load_certs","SSL",con);
  1160.     debug(F111,"tls_load_certs","server",server);
  1161.  
  1162.     if ( con ) {
  1163.         if (ssl_rsa_cert_file) {
  1164.             if ( ssl_debug_flag )
  1165.                 printf("Loading RSA certificate into SSL\r\n");
  1166.  
  1167.             rc = SSL_use_certificate_file(con, ssl_rsa_cert_file,
  1168.                                                X509_FILETYPE_PEM);
  1169.             if (!rc)
  1170.             {
  1171.                 if ( !quiet || ssl_debug_flag )
  1172.                     printf("Error loading certificate from %s\r\n",
  1173.                             ssl_rsa_cert_file);
  1174.             } else {
  1175.                 if (!ssl_rsa_key_file || !ssl_rsa_key_file[0])
  1176.                     makestr(&ssl_rsa_key_file,ssl_rsa_cert_file);
  1177.  
  1178.                 rc = SSL_use_PrivateKey_file(con, ssl_rsa_key_file,
  1179.                                                   X509_FILETYPE_PEM);
  1180.                 if (!rc)
  1181.                     rc = SSL_use_PrivateKey_file(con, ssl_rsa_cert_file,
  1182.                                                       X509_FILETYPE_PEM);
  1183.                 if (!rc)
  1184.                 {
  1185.                     if ( !quiet || ssl_debug_flag )
  1186.                         printf("Error loading key from %s\r\n",
  1187.                                 ssl_rsa_key_file);
  1188.                 } else {
  1189.                     rc = SSL_check_private_key(con);
  1190.                     if (!rc)
  1191.                     {
  1192.                         if ( ssl_debug_flag )
  1193.                             printf(
  1194.                 "Private key does not match the certificate public key\r\n");
  1195.                     }
  1196.                 }
  1197.             }
  1198.         }
  1199.  
  1200.         if (ssl_dsa_cert_file) {
  1201.             if ( ssl_debug_flag )
  1202.                 printf("Loading DSA certificate into SSL\r\n");
  1203.  
  1204.             rc = SSL_use_certificate_file(con, ssl_dsa_cert_file,
  1205.                                                X509_FILETYPE_PEM);
  1206.             if (!rc)
  1207.             {
  1208.                 if ( ssl_debug_flag ) {
  1209.                     printf("Error loading certificate from %s\r\n",
  1210.                             ssl_dsa_cert_file);
  1211.                 }
  1212.             } else {
  1213.                 if (!ssl_dh_key_file || !ssl_dh_key_file[0])
  1214.                     makestr(&ssl_dh_key_file,ssl_dsa_cert_file);
  1215.                 rc = SSL_use_PrivateKey_file(con, ssl_dh_key_file,
  1216.                                                   X509_FILETYPE_PEM);
  1217.                 if (!rc)
  1218.                     rc = SSL_use_PrivateKey_file(con, ssl_dsa_cert_file,
  1219.                                                       X509_FILETYPE_PEM);
  1220.                 if (!rc)
  1221.                 {
  1222.                     if ( !quiet || ssl_debug_flag ) {
  1223.                         printf("Error loading key from %s\r\n",
  1224.                                 ssl_dh_key_file);
  1225.                     }
  1226.                 } else {
  1227.                     rc = SSL_check_private_key(con);
  1228.                     if (!rc)
  1229.                     {
  1230.                         if ( ssl_debug_flag )
  1231.                             printf(
  1232.                    "Private key does not match the certificate public key\n");
  1233.                     }
  1234.                 }
  1235.             }
  1236.         }
  1237.     } else {
  1238.         if (ssl_rsa_cert_file) {
  1239.             if ( ssl_debug_flag )
  1240.                 printf("Loading RSA certificate into SSL\r\n");
  1241.  
  1242.             rc = SSL_CTX_use_certificate_file(ctx, ssl_rsa_cert_file,
  1243.                                        X509_FILETYPE_PEM);
  1244.             if (!rc)
  1245.             {
  1246.                 if ( !quiet || ssl_debug_flag )
  1247.                     printf("Error loading certificate from %s\r\n",
  1248.                             ssl_rsa_cert_file);
  1249.             } else {
  1250.                 if (!ssl_rsa_key_file || !ssl_rsa_key_file[0])
  1251.                     makestr(&ssl_rsa_key_file,ssl_rsa_cert_file);
  1252.  
  1253.                 rc = SSL_CTX_use_PrivateKey_file(ctx, ssl_rsa_key_file,
  1254.                                                   X509_FILETYPE_PEM);
  1255.                 if (!rc)
  1256.                   rc = SSL_CTX_use_PrivateKey_file(ctx, ssl_rsa_cert_file,
  1257.                                                    X509_FILETYPE_PEM);
  1258.                 if (!rc) {
  1259.                     if ( ssl_debug_flag )
  1260.                       printf("Error loading key from %s\r\n",ssl_rsa_key_file);
  1261.                 } else {
  1262.                     rc = SSL_CTX_check_private_key(ctx);
  1263.                     if (!rc) {
  1264.                         if ( ssl_debug_flag )
  1265.                           printf(
  1266.                 "Private key does not match the certificate public key\r\n");
  1267.                     }
  1268.                 }
  1269.             }
  1270.         }
  1271.         if (ssl_dsa_cert_file) {
  1272.             if ( ssl_debug_flag )
  1273.               printf("Loading DSA certificate into SSL\r\n");
  1274.  
  1275.             rc = SSL_CTX_use_certificate_file(ctx, ssl_dsa_cert_file,
  1276.                                               X509_FILETYPE_PEM);
  1277.             if (!rc) {
  1278.                 if ( ssl_debug_flag ) {
  1279.                     printf("Error loading certificate from %s\r\n",
  1280.                            ssl_dsa_cert_file);
  1281.                 }
  1282.             } else {
  1283.                 if (!ssl_dh_key_file || !ssl_dh_key_file[0])
  1284.                     makestr(&ssl_dh_key_file,ssl_dsa_cert_file);
  1285.                 rc = SSL_CTX_use_PrivateKey_file(ctx, ssl_dh_key_file,
  1286.                                                   X509_FILETYPE_PEM);
  1287.                 if (!rc)
  1288.                   rc = SSL_CTX_use_PrivateKey_file(ctx, ssl_dsa_cert_file,
  1289.                                                       X509_FILETYPE_PEM);
  1290.                 if (!rc) {
  1291.                     if ( ssl_debug_flag )
  1292.                       printf("Error loading key from %s\r\n",ssl_dh_key_file);
  1293.                 } else {
  1294.                     rc = SSL_CTX_check_private_key(ctx);
  1295.                     if (!rc) {
  1296.                         if ( ssl_debug_flag )
  1297.                           printf(
  1298.                    "Private key does not match the certificate public key\n");
  1299.                     }
  1300.                 }
  1301.             }
  1302.         }
  1303.     }
  1304.  
  1305.     if (ssl_rsa_cert_chain_file && server) {
  1306.         int skip1st = 0;
  1307.         if (ssl_debug_flag)
  1308.             printf("Loading RSA Certificate Chain into SSL\r\n");
  1309.         if (!ckstrcmp(ssl_rsa_cert_chain_file,ssl_rsa_cert_file,-1,
  1310. #ifdef OS2
  1311.                        0
  1312. #else
  1313.                        1
  1314. #endif /* OS2 */
  1315.                        ))
  1316.             skip1st = 1;
  1317.         rc = SSL_CTX_use_certificate_chain_file(ctx,ssl_rsa_cert_chain_file);
  1318.         if (!rc && ssl_debug_flag)
  1319.                 printf("Error loading RSA Certificate Chain into SSL\r\n");
  1320.     }
  1321.     if (ssl_dsa_cert_chain_file && server) {
  1322.         int skip1st = 0;
  1323.         if (ssl_debug_flag)
  1324.             printf("Loading DSA Certificate Chain into SSL\r\n");
  1325.         if (!ckstrcmp(ssl_dsa_cert_chain_file,ssl_dsa_cert_file,-1,
  1326. #ifdef OS2
  1327.                        0
  1328. #else
  1329.                        1
  1330. #endif /* OS2 */
  1331.                        ))
  1332.             skip1st = 1;
  1333.         rc = SSL_CTX_use_certificate_chain_file(ctx,ssl_dsa_cert_chain_file);
  1334.         if (!rc && ssl_debug_flag)
  1335.                 printf("Error loading DSA Certificate Chain into SSL\r\n");
  1336.     }
  1337.     return(rc);
  1338. }
  1339.  
  1340. VOID
  1341. #ifdef CK_ANSIC
  1342. ssl_once_init(void)
  1343. #else
  1344. ssl_once_init()
  1345. #endif /* CK_ANSIC */
  1346. {
  1347.     COMP_METHOD * cm;
  1348.  
  1349.     if ( !ck_ssleay_is_installed() )
  1350.         return;
  1351.  
  1352.     debug(F111,"Kermit built for OpenSSL",OPENSSL_VERSION_TEXT,SSLEAY_VERSION_NUMBER);
  1353. #ifndef OS2ONLY
  1354.     debug(F111,"OpenSSL Library",SSLeay_version(SSLEAY_VERSION),
  1355.            SSLeay());
  1356.     debug(F110,"OpenSSL Library",SSLeay_version(SSLEAY_BUILT_ON),0);
  1357.     debug(F110,"OpenSSL Library",SSLeay_version(SSLEAY_CFLAGS),0);
  1358.     debug(F110,"OpenSSL Library",SSLeay_version(SSLEAY_PLATFORM),0);
  1359.  
  1360.     /* The following test is suggested by Richard Levitte */
  1361.     if (((OPENSSL_VERSION_NUMBER ^ SSLeay()) & 0xffffff0f) 
  1362. #ifdef OS2
  1363.          || ckstrcmp(OPENSSL_VERSION_TEXT,(char *)SSLeay_version(SSLEAY_VERSION),-1,1)
  1364. #endif /* OS2 */
  1365.          ) {
  1366.         ssl_installed = 0;
  1367.         debug(F111,"OpenSSL Version does not match.  Built with",
  1368.                SSLeay_version(SSLEAY_VERSION),SSLEAY_VERSION_NUMBER);
  1369.         printf("?OpenSSL libraries do not match required version.");
  1370.         printf("  SSL\\TLS support disabled\r\n\r\n");
  1371.         bleep(BP_FAIL);
  1372. #ifdef SSLDLL
  1373.         ck_ssl_unloaddll();
  1374.         ck_crypto_unloaddll();
  1375. #endif /* SSLDLL */
  1376.         return;
  1377.     }
  1378. #endif /* OS2ONLY */
  1379.  
  1380.     /* init things so we will get meaningful error messages
  1381.     * rather than numbers
  1382.     */
  1383.     SSL_load_error_strings();
  1384.  
  1385. #ifdef SSHBUILTIN
  1386.     OPENSSL_add_all_algorithms_noconf();
  1387. #else
  1388.     /* SSL_library_init() only loads those ciphers needs for SSL  */
  1389.     /* These happen to be a similar set to those required for SSH */
  1390.     /* but they are not a complete set of ciphers provided by the */
  1391.     /* crypto library.                                            */
  1392.     SSL_library_init();
  1393. #endif /* SSHBUILTIN */
  1394.  
  1395. #ifdef ZLIB
  1396.     cm = COMP_zlib();
  1397.     if (cm != NULL && cm->type != NID_undef) {
  1398.         SSL_COMP_add_compression_method(0xe0, cm); /* EAY's ZLIB ID */
  1399.     }
  1400. #endif /* ZLIB */
  1401.     cm = COMP_rle();
  1402.     if (cm != NULL && cm->type != NID_undef)
  1403.         SSL_COMP_add_compression_method(0xe1, cm); /* EAY's RLE ID */
  1404.  
  1405.     /* Ensure the Random number generator has enough entropy */
  1406.     if ( !RAND_status() ) {
  1407.         char buffer[256]="";
  1408.         char randombytes[256];
  1409.         int rc1 = -1, rc2 = 1;  /* assume failure and success */
  1410.  
  1411.         debug(F110,"ssl_once_init","!RAND_status()",0);
  1412.  
  1413.         if ( ssl_rnd_file == NULL ) {
  1414.             debug(F110,"ssl_rnd_file","ssl_rnd_file is NULL",0);
  1415.             RAND_file_name(buffer,256);
  1416.             if ( buffer[0] )
  1417.                 makestr(&ssl_rnd_file, buffer);
  1418.             else
  1419.                 makestr(&ssl_rnd_file,".rnd");
  1420.         }
  1421.         debug(F110,"ssl_rnd_file",ssl_rnd_file,0);
  1422.  
  1423.         rc1 = RAND_egd(ssl_rnd_file);
  1424.         debug(F111,"ssl_once_init","RAND_egd()",rc1);
  1425.         if ( rc1 <= 0 ) {
  1426.             rc2 = RAND_load_file(ssl_rnd_file, -1);
  1427.             debug(F111,"ssl_once_init","RAND_load_file()",rc1);
  1428.         }
  1429.  
  1430.         if ( rc1 <= 0 && !rc2 )
  1431.         {
  1432.             time_t t = time(NULL);
  1433.             int tlen = sizeof(time_t);
  1434.             int pid = getpid();
  1435.             int plen = sizeof(int);
  1436.             int n;
  1437. #ifndef RAND_MAX
  1438. #define RAND_MAX 0x7FFF
  1439. #endif
  1440.             debug(F110,"ssl_once_init","calling RAND_seed()",0);
  1441.  
  1442.             RAND_seed((unsigned char *)&t, tlen);
  1443.             RAND_seed((unsigned char *)&pid, plen);
  1444.  
  1445.             srand((unsigned int)t);
  1446.             sprintf(buffer, "%.0f", (((double)(rand()%RAND_MAX)/RAND_MAX)*
  1447.                                       (sizeof(randombytes)-128-1)));
  1448.             n = (atoi(buffer)+1)%(sizeof(randombytes)-128-1);
  1449.             RAND_seed(randombytes, 128);
  1450.         }
  1451.  
  1452.         if ( !RAND_status() ) {
  1453.             debug(F110,"ssl_once_init","Unable to initialize PRNG",0);
  1454.             printf(" Unable to load 'random state'\n");
  1455.             printf(" SSL and TLS are unavailble.\n");
  1456.             printf(" Use SET AUTH SSL RANDOM-FILE <file> command to provide random data.\n");
  1457.             printf(" Specified file will be overwritten with new random data after use.\n");
  1458.             return;
  1459.         }
  1460.  
  1461.         if ( ssl_rnd_file ) {
  1462.             int rc = RAND_write_file(ssl_rnd_file);
  1463.             debug(F111,"ssl_once_init","RAND_write_file()",rc);
  1464.         }
  1465.     }
  1466.  
  1467. #ifdef NT
  1468.     // Initialize additional OID types for use when saving certs to a file
  1469.     OBJ_create("2.99999.3","SET.ex3","SET x509v3 extension 3");
  1470. #endif /* NT */
  1471.  
  1472.     /* make sure we have somewhere we can log errors to */
  1473.     bio_err=BIO_new(BIO_s_mem());
  1474.  
  1475.     debug(F100,"ssl_once_init() complete","",0);
  1476. }
  1477.  
  1478. int
  1479. #ifdef CK_ANSIC
  1480. ssl_tn_init(int mode)
  1481. #else
  1482. ssl_tn_init(mode) int mode;
  1483. #endif /* CK_ANSIC */
  1484. {
  1485. #ifdef KRB5
  1486.     extern char * k5_keytab;
  1487.     extern char * krb5_d_srv;
  1488. #endif /* KRB5 */
  1489.     static int last_ssl_mode = -1;
  1490.     SSL * ssl_conx=NULL, * tls_conx=NULL;
  1491.  
  1492.     ssl_initialized = 0;
  1493.  
  1494.     if ( !ck_ssleay_is_installed() )
  1495.         return(0);
  1496.  
  1497.     debug(F111,"ssl_tn_init","mode",mode);
  1498.  
  1499.     if (ssl_debug_flag)
  1500.         printf("SSL_DEBUG_FLAG on\r\n");
  1501.  
  1502.     if (last_ssl_mode != mode) {
  1503.         if (ssl_ctx) {
  1504.             SSL_CTX_free(ssl_ctx);
  1505.             ssl_ctx = NULL;
  1506.         }
  1507.         if (tls_ctx) {
  1508.             SSL_CTX_free(tls_ctx);
  1509.             tls_ctx = NULL;
  1510.         }
  1511.     }
  1512.  
  1513.     if ( (last_ssl_mode != mode) || !ssl_ctx || !tls_ctx ) {
  1514.         if ( mode == SSL_CLIENT ) {
  1515.             ssl_ctx=(SSL_CTX *)SSL_CTX_new(SSLv23_client_method());
  1516.             /* This can fail because we do not have RSA available */
  1517.             if ( !ssl_ctx ) {
  1518.                 debug(F110,"ssl_tn_init","SSLv23_client_method failed",0);
  1519.                 ssl_ctx=(SSL_CTX *)SSL_CTX_new(SSLv3_client_method());
  1520.             }
  1521.             if ( !ssl_ctx ) {
  1522.                 debug(F110,"ssl_tn_init","SSLv3_client_method failed",0);
  1523.                 last_ssl_mode = -1;
  1524.                 return(0);
  1525.             }
  1526. #ifndef COMMENT
  1527.             tls_ctx=(SSL_CTX *)SSL_CTX_new(TLSv1_client_method());
  1528. #else /* COMMENT */
  1529.             tls_ctx=(SSL_CTX *)SSL_CTX_new(SSLv23_client_method());
  1530.             /* This can fail because we do not have RSA available */
  1531.             if ( !tls_ctx ) {
  1532.                 debug(F110,"ssl_tn_init","SSLv23_client_method failed",0);
  1533.                 tls_ctx=(SSL_CTX *)SSL_CTX_new(SSLv3_client_method());
  1534.             }
  1535. #endif /* COMMENT */
  1536.             if ( !tls_ctx ) {
  1537.                 debug(F110,"ssl_tn_init","TLSv1_client_method failed",0);
  1538.                 last_ssl_mode = -1;
  1539.                 return(0);
  1540.             }
  1541. #ifdef USE_CERT_CB
  1542.             SSL_CTX_set_client_cert_cb(ssl_ctx,ssl_client_cert_callback);
  1543.             SSL_CTX_set_client_cert_cb(tls_ctx,ssl_client_cert_callback);
  1544. #endif /* USE_CERT_CB */
  1545.         } else if (mode == SSL_SERVER) {
  1546.             /* We are a server */
  1547.             ssl_ctx=(SSL_CTX *)SSL_CTX_new(SSLv23_server_method());
  1548.             /* This can fail because we do not have RSA available */
  1549.             if ( !ssl_ctx ) {
  1550.                 debug(F110,"ssl_tn_init","SSLv23_server_method failed",0);
  1551.                 ssl_ctx=(SSL_CTX *)SSL_CTX_new(SSLv3_server_method());
  1552.             }
  1553.             if ( !ssl_ctx ) {
  1554.                 debug(F110,"ssl_tn_init","SSLv3_server_method failed",0);
  1555.                 last_ssl_mode = -1;
  1556.                 return(0);
  1557.             }
  1558. #ifdef COMMENT
  1559.             tls_ctx=(SSL_CTX *)SSL_CTX_new(TLSv1_server_method());
  1560. #else /* COMMENT */
  1561.             tls_ctx=(SSL_CTX *)SSL_CTX_new(SSLv23_server_method());
  1562.             /* This can fail because we do not have RSA available */
  1563.             if ( !tls_ctx ) {
  1564.                 debug(F110,"ssl_tn_init","SSLv23_server_method failed",0);
  1565.                 tls_ctx=(SSL_CTX *)SSL_CTX_new(TLSv1_server_method());
  1566.             }
  1567. #endif /* COMMENT */
  1568.             if ( !tls_ctx ) {
  1569.                 debug(F110,"ssl_tn_init","TLSv1_server_method failed",0);
  1570.                 last_ssl_mode = -1;
  1571.                 return(0);
  1572.             }
  1573.         } else /* Unknown mode */
  1574.             return(0);
  1575.  
  1576.         if ( !inserver ) {
  1577.             SSL_CTX_set_default_passwd_cb(ssl_ctx,
  1578.                                    (pem_password_cb *)ssl_passwd_callback);
  1579.             SSL_CTX_set_default_passwd_cb(tls_ctx,
  1580.                                    (pem_password_cb *)ssl_passwd_callback);
  1581.         }
  1582.  
  1583.         /* for SSL switch on all the interoperability and bug
  1584.          * workarounds so that we will communicate with people
  1585.          * that cannot read poorly written specs :-)
  1586.          * for TLS be sure to prevent use of SSLv2
  1587.          */
  1588.         SSL_CTX_set_options(ssl_ctx,SSL_OP_ALL|SSL_OP_NO_SSLv2);
  1589.         SSL_CTX_set_options(tls_ctx,
  1590.                  SSL_OP_NO_SSLv2|SSL_OP_SINGLE_DH_USE|SSL_OP_EPHEMERAL_RSA);
  1591.  
  1592.         SSL_CTX_set_info_callback(ssl_ctx,ssl_client_info_callback);
  1593.         SSL_CTX_set_info_callback(tls_ctx,ssl_client_info_callback);
  1594.  
  1595. #ifndef COMMENT
  1596.         /* Set the proper caching mode */
  1597.         if ( mode == SSL_SERVER ) {
  1598.             SSL_CTX_set_session_cache_mode(ssl_ctx,SSL_SESS_CACHE_SERVER);
  1599.             SSL_CTX_set_session_cache_mode(tls_ctx,SSL_SESS_CACHE_SERVER);
  1600.         } else {
  1601.             SSL_CTX_set_session_cache_mode(ssl_ctx,SSL_SESS_CACHE_CLIENT);
  1602.             SSL_CTX_set_session_cache_mode(tls_ctx,SSL_SESS_CACHE_CLIENT);
  1603.         }
  1604.         SSL_CTX_set_session_id_context(ssl_ctx,(CHAR *)"1",1);
  1605.         SSL_CTX_set_session_id_context(tls_ctx,(CHAR *)"2",1);
  1606. #else /* COMMENT */
  1607.         SSL_CTX_set_session_cache_mode(ssl_ctx,SSL_SESS_CACHE_OFF);
  1608.         SSL_CTX_set_session_cache_mode(tls_ctx,SSL_SESS_CACHE_OFF);
  1609. #endif /* COMMENT */
  1610.     }
  1611.  
  1612.     /* The server uses defaults for the certificate files. */
  1613.     /* The client does not.                                */
  1614.     if (mode == SSL_SERVER) {
  1615.         char cert_filepath[1024];
  1616.         const char * defdir = NULL;
  1617.         DH * dh = NULL;
  1618.  
  1619.         defdir = getenv("SSL_CERT_DIR");
  1620.         if ( !defdir ) {
  1621. #ifdef OS2
  1622.             defdir = exedir;
  1623. #else /* OS2 */
  1624.             defdir = X509_get_default_cert_dir();
  1625. #endif /* OS2 */
  1626.             debug(F110,"ssl_tn_init - setting default directory to",defdir,0);
  1627.         }
  1628.         if ( !defdir )
  1629.             defdir = "";
  1630.  
  1631.         if (!ssl_rsa_cert_file) {
  1632.             /* we need to know the fullpath to the location of the
  1633.             * certificate that we will be running with as we cannot
  1634.             * be sure of the cwd when we are launched
  1635.             */
  1636.             sprintf(cert_filepath,"%s/%s",defdir,"telnetd-rsa.pem");
  1637.             if (zchki(cert_filepath) > 0)
  1638.                 makestr(&ssl_rsa_cert_file,cert_filepath);
  1639.         }
  1640.         if (ssl_rsa_cert_file && !ssl_rsa_key_file) {
  1641.             /* we need to know the fullpath to the location of the
  1642.             * certificate that we will be running with as we cannot
  1643.             * be sure of the cwd when we are launched
  1644.             */
  1645.             sprintf(cert_filepath,"%s/%s",defdir,"telnetd-rsa-key.pem");
  1646.             if (zchki(cert_filepath) > 0)
  1647.                 makestr(&ssl_rsa_key_file,cert_filepath);
  1648.         }
  1649.         if (!ssl_dsa_cert_file) {
  1650.             /* we need to know the fullpath to the location of the
  1651.             * certificate that we will be running with as we cannot
  1652.             * be sure of the cwd when we are launched
  1653.             */
  1654.             sprintf(cert_filepath,"%s/%s",defdir,"telnetd-dsa.pem");
  1655.             if (zchki(cert_filepath) > 0)
  1656.                 makestr(&ssl_dsa_cert_file,cert_filepath);
  1657.         }
  1658.         if (ssl_dsa_cert_file && !ssl_dh_key_file) {
  1659.             /* we need to know the fullpath to the location of the
  1660.             * certificate that we will be running with as we cannot
  1661.             * be sure of the cwd when we are launched
  1662.             */
  1663.             sprintf(cert_filepath,"%s/%s",defdir,"telnetd-dsa-key.pem");
  1664.             if (zchki(cert_filepath) > 0)
  1665.                 makestr(&ssl_dh_key_file,cert_filepath);
  1666.         }
  1667.         if (!ssl_crl_dir) {
  1668.             /* we need to know the fullpath to the location of the
  1669.             * certificate that we will be running with as we cannot
  1670.             * be sure of the cwd when we are launched
  1671.             */
  1672.             sprintf(cert_filepath,"%s/crl",defdir);
  1673.             if (zchki(cert_filepath) > 0)
  1674.                 makestr(&ssl_crl_dir,cert_filepath);
  1675.         }
  1676.  
  1677.         if (ssl_only_flag && !tls_load_certs(ssl_ctx,ssl_con,1)) {
  1678.             debug(F110,"ssl_tn_init","Unable to load SSL certs",0);
  1679.             last_ssl_mode = -1;
  1680.             return(0);
  1681.         }
  1682.         if (tls_only_flag && !tls_load_certs(tls_ctx,tls_con,1)) {
  1683.             debug(F110,"ssl_tn_init","Unable to load TLS certs",0);
  1684.             last_ssl_mode = -1;
  1685.             return(0);
  1686.         }
  1687.  
  1688.         if ( (last_ssl_mode != mode) || !ssl_ctx || !tls_ctx ) {
  1689.             /* we may require a temp 512 bit RSA key because of the
  1690.              * wonderful way export things work ... if so we generate
  1691.              * one now!
  1692.              */
  1693.  
  1694.             SSL_CTX_set_tmp_rsa_callback(ssl_ctx, tmp_rsa_cb);
  1695.             SSL_CTX_set_tmp_dh_callback( ssl_ctx, tmp_dh_cb);
  1696.             SSL_CTX_set_tmp_rsa_callback(tls_ctx, tmp_rsa_cb);
  1697.             SSL_CTX_set_tmp_dh_callback( tls_ctx, tmp_dh_cb);
  1698.  
  1699.             dh = tmp_dh_cb(NULL,0,512);
  1700.             SSL_CTX_set_tmp_dh(ssl_ctx,dh);
  1701.             SSL_CTX_set_tmp_dh(tls_ctx,dh);
  1702.  
  1703.             /* The following code is only called if we are using a
  1704.              * certificate with an RSA public key and where the
  1705.              * certificate has a key length less than 512 bits or is
  1706.              * marked for signing only.  This is so we can support
  1707.              * the greatest legal privacy level with exportable clients.
  1708.              */
  1709.  
  1710.             if (SSL_CTX_need_tmp_RSA(ssl_ctx) ||
  1711.                  SSL_CTX_need_tmp_RSA(tls_ctx))
  1712.             {
  1713.                 RSA *rsa;
  1714.  
  1715.                 if ( ssl_debug_flag )
  1716.                     printf("Generating temp (512 bit) RSA key ...\r\n");
  1717.                 rsa=RSA_generate_key(512,RSA_F4,NULL,NULL);
  1718.                 if ( ssl_debug_flag )
  1719.                     printf("Generation of temp (512 bit) RSA key done\r\n");
  1720.  
  1721.                 if (SSL_CTX_need_tmp_RSA(ssl_ctx)) {
  1722.                     if (!SSL_CTX_set_tmp_rsa(ssl_ctx,rsa)) {
  1723.                         if ( ssl_debug_flag )
  1724.                             printf(
  1725.   "Failed to assign generated temp RSA key to SSL!\r\n");
  1726.                     }
  1727.                 }
  1728.                 if (SSL_CTX_need_tmp_RSA(tls_ctx)) {
  1729.                     if (!SSL_CTX_set_tmp_rsa(tls_ctx,rsa)) {
  1730.                         if ( ssl_debug_flag )
  1731.                             printf(
  1732.   "Failed to assign generated temp RSA key to TLS!\r\n");
  1733.                     }
  1734.                 }
  1735.                 RSA_free(rsa);
  1736.                 if ( ssl_debug_flag )
  1737.                     printf("Assigned temp (512 bit) RSA key\r\n");
  1738.             }
  1739.         }
  1740.     }
  1741.  
  1742.     /* make sure we will find certificates in the standard
  1743.      * location ... otherwise we don't look anywhere for
  1744.      * these things which is going to make client certificate
  1745.      * exchange rather useless :-)
  1746.      * In OS2, default values for ssl_verify_file and ssl_verify_path.
  1747.      */
  1748.  
  1749. #ifdef OS2
  1750. #ifdef NT
  1751.     {
  1752.         /* The defaults in the SSL crypto library are not appropriate for OS/2 */
  1753.         char path[CKMAXPATH];
  1754.  
  1755.         ckmakmsg(path,CKMAXPATH,exedir,"certs",NULL,NULL);
  1756.         if (isdir(path) && 
  1757.             SSL_CTX_load_verify_locations(tls_ctx,NULL,path) == 1)  {
  1758.             debug(F110,"ssl_tn_init certificate verify dir",path,0);
  1759.             if (ssl_debug_flag)
  1760.                 printf("  Certificate Verification Directory: %s\r\n",path);
  1761.             SSL_CTX_load_verify_locations(ssl_ctx,NULL,path);
  1762.         }
  1763.         ckmakmsg(path,CKMAXPATH,GetAppData(1),"kermit 95/certs",NULL,NULL);
  1764.         if (isdir(path) &&
  1765.             SSL_CTX_load_verify_locations(tls_ctx,NULL,path) == 1)  {
  1766.             debug(F110,"ssl_tn_init certificate verify dir",path,0);
  1767.             if (ssl_debug_flag)
  1768.                 printf("  Certificate Verification Directory: %s\r\n",path);
  1769.             SSL_CTX_load_verify_locations(ssl_ctx,NULL,path);
  1770.         }
  1771.         ckmakmsg(path,CKMAXPATH,GetAppData(0),"kermit 95/certs",NULL,NULL);
  1772.         if (isdir(path) &&
  1773.             SSL_CTX_load_verify_locations(tls_ctx,NULL,path) == 1)  {
  1774.             debug(F110,"ssl_tn_init certificate verify dir",path,0);
  1775.             if (ssl_debug_flag)
  1776.                 printf("  Certificate Verification Directory: %s\r\n",path);
  1777.             SSL_CTX_load_verify_locations(ssl_ctx,NULL,path);
  1778.         }
  1779.         ckmakmsg(path,CKMAXPATH,exedir,"ca_certs.pem",NULL,NULL);
  1780.         if (zchki(path) > 0 && 
  1781.             SSL_CTX_load_verify_locations(tls_ctx,path,NULL) == 1) {
  1782.             debug(F110,"ssl_tn_init certificate verify file",path,0);
  1783.             if (ssl_debug_flag)
  1784.                 printf("  Certificate Verification File: %s\r\n",path);
  1785.             SSL_CTX_load_verify_locations(ssl_ctx,path,NULL);
  1786.         }
  1787.         ckmakmsg(path,CKMAXPATH,GetAppData(1),"kermit 95/ca_certs.pem",NULL,NULL);
  1788.         if (zchki(path) > 0 && 
  1789.             SSL_CTX_load_verify_locations(tls_ctx,path,NULL) == 1) {
  1790.             debug(F110,"ssl_tn_init certificate verify file",path,0);
  1791.             if (ssl_debug_flag)
  1792.                 printf("  Certificate Verification File: %s\r\n",path);
  1793.             SSL_CTX_load_verify_locations(ssl_ctx,path,NULL);
  1794.         }
  1795.         ckmakmsg(path,CKMAXPATH,GetAppData(0),"kermit 95/ca_certs.pem",NULL,NULL);
  1796.         if (zchki(path) > 0 && 
  1797.             SSL_CTX_load_verify_locations(tls_ctx,path,NULL) == 1) {
  1798.             debug(F110,"ssl_tn_init certificate verify file",path,0);
  1799.             if (ssl_debug_flag)
  1800.                 printf("  Certificate Verification File: %s\r\n",path);
  1801.             SSL_CTX_load_verify_locations(ssl_ctx,path,NULL);
  1802.         }
  1803.     }
  1804. #else /* NT */
  1805.     {
  1806.         /* The defaults in the SSL crypto library are not appropriate for OS/2 */
  1807.         char path[CKMAXPATH];
  1808.  
  1809.         ckmakmsg(path,CKMAXPATH,exedir,"certs",NULL,NULL);
  1810.         if (isdir(path) && 
  1811.             SSL_CTX_load_verify_locations(tls_ctx,NULL,path) == 1)  {
  1812.             debug(F110,"ssl_tn_init certificate verify dir",path,0);
  1813.             if (ssl_debug_flag)
  1814.                 printf("  Certificate Verification Directory: %s\r\n",path);
  1815.             SSL_CTX_load_verify_locations(ssl_ctx,NULL,path);
  1816.         }
  1817.         ckmakmsg(path,CKMAXPATH,exedir,"ca_certs.pem",NULL,NULL);
  1818.         if (zchki(path) > 0 && 
  1819.             SSL_CTX_load_verify_locations(tls_ctx,path,NULL) == 1) {
  1820.             debug(F110,"ssl_tn_init certificate verify file",path,0);
  1821.             if (ssl_debug_flag)
  1822.                 printf("  Certificate Verification File: %s\r\n",path);
  1823.             SSL_CTX_load_verify_locations(ssl_ctx,path,NULL);
  1824.         }
  1825.     }
  1826. #endif /* NT */
  1827. #else /* OS2 */
  1828.     SSL_CTX_set_default_verify_paths(ssl_ctx);
  1829.     SSL_CTX_set_default_verify_paths(tls_ctx);
  1830. #endif /* OS2 */
  1831.  
  1832.     if (ssl_verify_file) {
  1833.         if (zchki(ssl_verify_file) > 0 && 
  1834.             SSL_CTX_load_verify_locations(tls_ctx,ssl_verify_file,NULL) == 1) {
  1835.             debug(F110,"ssl_tn_init certificate verify file",ssl_verify_file,0);
  1836.             if (ssl_debug_flag)
  1837.                 printf("  Certificate Verification File: %s\r\n",ssl_verify_file);
  1838.             SSL_CTX_load_verify_locations(ssl_ctx,ssl_verify_file,NULL);
  1839.         }
  1840.     }
  1841.     if (ssl_verify_dir && isdir(ssl_verify_dir)) {
  1842.         if (SSL_CTX_load_verify_locations(tls_ctx,NULL,ssl_verify_dir) == 1)  {
  1843.             debug(F110,"ssl_tn_init certificate verify dir",ssl_verify_dir,0);
  1844.             if (ssl_debug_flag)
  1845.                 printf("  Certificate Verification Directory: %s\r\n",ssl_verify_dir);
  1846.             SSL_CTX_load_verify_locations(ssl_ctx,NULL,ssl_verify_dir);
  1847.         }
  1848.     }
  1849.     if (mode == SSL_SERVER) {
  1850.         SSL_CTX_set_verify(ssl_ctx,
  1851.                      ssl_verify_flag?ssl_verify_flag|SSL_VERIFY_CLIENT_ONCE:0,
  1852.                            ssl_server_verify_callback);
  1853.         SSL_CTX_set_verify(tls_ctx,
  1854.                      ssl_verify_flag?ssl_verify_flag|SSL_VERIFY_CLIENT_ONCE:0,
  1855.                            ssl_server_verify_callback);
  1856.     } else {
  1857.         SSL_CTX_set_verify(ssl_ctx,ssl_verify_flag,
  1858.                            ssl_client_verify_callback);
  1859.         SSL_CTX_set_verify(tls_ctx,ssl_verify_flag,
  1860.                            ssl_client_verify_callback);
  1861.     }
  1862.  
  1863.     /* Free the existing CRL Store */
  1864.     if (crl_store) {
  1865.         X509_STORE_free(crl_store);
  1866.         crl_store = NULL;
  1867.     }
  1868.  
  1869.     /* set up the new CRL Store */
  1870.     crl_store = X509_STORE_new();
  1871.     if (crl_store) {
  1872. #ifdef OS2
  1873.         char path[CKMAXPATH];
  1874.  
  1875.         ckmakmsg(path,CKMAXPATH,exedir,"crls",NULL,NULL);
  1876.         if (isdir(path) &&
  1877.             X509_STORE_load_locations(crl_store,NULL,path) == 1) {
  1878.             debug(F110,"ssl_tn_init crl dir",path,0);
  1879.             if (ssl_debug_flag)
  1880.                 printf("  CRL Directory: %s\r\n",path);
  1881.         }
  1882. #ifdef NT
  1883.         ckmakmsg(path,CKMAXPATH,GetAppData(1),"kermit 95/crls",NULL,NULL);
  1884.         if (isdir(path) && 
  1885.             X509_STORE_load_locations(crl_store,NULL,path) == 1) {
  1886.             debug(F110,"ssl_tn_init crl dir",path,0);
  1887.             if (ssl_debug_flag)
  1888.                 printf("  CRL Directory: %s\r\n",path);
  1889.         }
  1890.         ckmakmsg(path,CKMAXPATH,GetAppData(0),"kermit 95/crls",NULL,NULL);
  1891.         if (isdir(path) && 
  1892.             X509_STORE_load_locations(crl_store,NULL,path) == 1) {
  1893.             debug(F110,"ssl_tn_init crl dir",path,0);
  1894.             if (ssl_debug_flag)
  1895.                 printf("  CRL Directory: %s\r\n",path);
  1896.         }
  1897. #endif /* NT */
  1898.         
  1899.         ckmakmsg(path,CKMAXPATH,exedir,"ca_crls.pem",NULL,NULL);
  1900.         if (zchki(path) > 0 && 
  1901.             X509_STORE_load_locations(crl_store,path,NULL) == 1) {
  1902.             debug(F110,"ssl_tn_init crl file",path,0);
  1903.             if (ssl_debug_flag)
  1904.                 printf("  CRL File: %s\r\n",path);
  1905.         }
  1906. #ifdef NT
  1907.         ckmakmsg(path,CKMAXPATH,GetAppData(1),"kermit 95/ca_crls.pem",NULL,NULL);
  1908.         if (zchki(path) > 0 && 
  1909.             X509_STORE_load_locations(crl_store,path,NULL) == 1) {
  1910.             debug(F110,"ssl_tn_init crl file",path,0);
  1911.             if (ssl_debug_flag)
  1912.                 printf("  CRL File: %s\r\n",path);
  1913.         }
  1914.         ckmakmsg(path,CKMAXPATH,GetAppData(0),"kermit 95/ca_crls.pem",NULL,NULL);
  1915.         if (zchki(path) > 0 && 
  1916.             X509_STORE_load_locations(crl_store,path,NULL) == 1) {
  1917.             debug(F110,"ssl_tn_init crl file",path,0);
  1918.             if (ssl_debug_flag)
  1919.                 printf("  CRL File: %s\r\n",path);
  1920.         }
  1921. #endif /* NT */
  1922. #endif /* OS2 */
  1923.  
  1924.         if (ssl_crl_file || ssl_crl_dir) {
  1925.             if (ssl_crl_file && zchki(ssl_crl_file) > 0 && 
  1926.                 X509_STORE_load_locations(crl_store,ssl_crl_file,NULL) == 1) {
  1927.                 debug(F110,"ssl_tn_init crl file",ssl_crl_file,0);
  1928.                 if (ssl_debug_flag)
  1929.                     printf("  CRL File: %s\r\n",ssl_crl_file);
  1930.             }
  1931.             if (ssl_crl_dir && isdir(ssl_crl_dir) &&
  1932.                 X509_STORE_load_locations(crl_store,NULL,ssl_crl_dir) == 1) {
  1933.                 debug(F110,"ssl_tn_init crl dir",ssl_crl_dir,0);
  1934.                 if (ssl_debug_flag)
  1935.                     printf("  CRL Directory: %s\r\n",ssl_crl_dir);
  1936.             }
  1937.         } 
  1938. #ifndef OS2
  1939.         else {
  1940.             X509_STORE_set_default_paths(crl_store);
  1941.         }
  1942. #endif /* OS2 */
  1943.     }
  1944.  
  1945. #ifndef COMMENT
  1946.     ssl_conx = ssl_con;
  1947.     ssl_con=(SSL *)SSL_new(ssl_ctx);
  1948.     if ( !ssl_con ) {
  1949.         debug(F110,"ssl_tn_init","SSL_new(ssl_con) failed",0);
  1950.         last_ssl_mode = -1;
  1951.         ssl_con = ssl_conx;
  1952.         return(0);
  1953.     }
  1954.     if (ssl_conx) {
  1955.         if ( mode == SSL_CLIENT ) {
  1956.             SSL_set_session(ssl_con, SSL_get_session(ssl_conx));
  1957.         }
  1958. #ifdef SSL_KRB5
  1959.         if (ssl_conx->kssl_ctx) {
  1960.             kssl_ctx_free(ssl_conx->kssl_ctx);
  1961.             ssl_conx->kssl_ctx = NULL;
  1962.         }
  1963. #endif /* SSL_KRB5 */
  1964.         SSL_free(ssl_conx);
  1965.         ssl_conx = NULL;
  1966.     }
  1967.     tls_conx = tls_con;
  1968.     tls_con=(SSL *)SSL_new(tls_ctx);
  1969.     if ( !tls_con ) {
  1970.         debug(F110,"ssl_tn_init","SSL_new(tls_con) failed",0);
  1971.         last_ssl_mode = -1;
  1972.         tls_con = tls_conx;
  1973.         return(0);
  1974.     }
  1975.     if (tls_conx) {
  1976.         if ( mode == SSL_CLIENT )
  1977.             SSL_set_session(tls_con, SSL_get_session(tls_conx));
  1978. #ifdef SSL_KRB5
  1979.         if (tls_conx->kssl_ctx) {
  1980.             kssl_ctx_free(tls_conx->kssl_ctx);
  1981.             tls_conx->kssl_ctx = NULL;
  1982.         }
  1983. #endif /* SSL_KRB5 */
  1984.         SSL_free(tls_conx);
  1985.         tls_conx = NULL;
  1986.     }
  1987. #else /* COMMENT */
  1988.     /* I don't know why this does not work to reuse the connection. */
  1989.     if ( ssl_con ) {
  1990.         SSL_clear(ssl_con);
  1991.         SSL_set_session(ssl_con,NULL);
  1992.         SSL_set_accept_state(ssl_con) ;
  1993.     } else {
  1994.         ssl_con=(SSL *)SSL_new(ssl_ctx);
  1995.         if (!ssl_con) {
  1996.             debug(F110,"ssl_tn_init","SSL_new(ssl_ctx) failed",0);
  1997.             last_ssl_mode = -1;
  1998.             ssl_con = ssl_conx;
  1999.             return(0);
  2000.         }
  2001.     }
  2002.  
  2003.     if ( tls_con ) {
  2004.         SSL_clear(tls_con);
  2005.         SSL_set_session(tls_con,NULL);
  2006.         SSL_set_accept_state(tls_con) ;
  2007.     } else {
  2008.         tls_con=(SSL *)SSL_new(tls_ctx);
  2009.         if ( !tls_con ) {
  2010.             debug(F110,"ssl_tn_init","SSL_new(tls_ctx) failed",0);
  2011.             last_ssl_mode = -1;
  2012.             tls_con = tls_conx;
  2013.             return(0);
  2014.         }
  2015.     }
  2016. #endif /* COMMENT */
  2017.  
  2018. #ifdef SSL_KRB5
  2019. #ifndef KRB5_SERVICE_NAME
  2020. #define KRB5_SERVICE_NAME    "host"
  2021. #endif
  2022.  
  2023.     if (ssl_con->kssl_ctx == NULL)
  2024.         ssl_con->kssl_ctx = kssl_ctx_new();
  2025.     if (tls_con->kssl_ctx == NULL)
  2026.     tls_con->kssl_ctx = kssl_ctx_new();
  2027.     if (mode == SSL_SERVER) {
  2028.         if (ssl_con->kssl_ctx != NULL)
  2029.             kssl_ctx_setstring(ssl_con->kssl_ctx, KSSL_KEYTAB, k5_keytab);
  2030.         if (tls_con->kssl_ctx != NULL)
  2031.             kssl_ctx_setstring(tls_con->kssl_ctx, KSSL_KEYTAB, k5_keytab);
  2032.     } else {
  2033.         if (ssl_con->kssl_ctx != NULL)
  2034.             kssl_ctx_setstring(ssl_con->kssl_ctx, KSSL_SERVER, szHostName);
  2035.         if (tls_con->kssl_ctx != NULL)
  2036.             kssl_ctx_setstring(tls_con->kssl_ctx, KSSL_SERVER, szHostName);
  2037.     }
  2038.     kssl_ctx_setstring(ssl_con->kssl_ctx, KSSL_SERVICE,
  2039.                         krb5_d_srv ? krb5_d_srv : KRB5_SERVICE_NAME);
  2040.     kssl_ctx_setstring(tls_con->kssl_ctx, KSSL_SERVICE,
  2041.                         krb5_d_srv ? krb5_d_srv : KRB5_SERVICE_NAME);
  2042. #endif /* SSL_KRB5 */
  2043.  
  2044.     if (ssl_cipher_list) {
  2045.         SSL_set_cipher_list(ssl_con,ssl_cipher_list);
  2046.         SSL_set_cipher_list(tls_con,ssl_cipher_list);
  2047.     } else {
  2048.         char * p;
  2049.         if (p = getenv("SSL_CIPHER")) {
  2050.             SSL_set_cipher_list(ssl_con,p);
  2051.             SSL_set_cipher_list(tls_con,p);
  2052.         } else {
  2053.             SSL_set_cipher_list(ssl_con,DEFAULT_CIPHER_LIST);
  2054.             SSL_set_cipher_list(tls_con,DEFAULT_CIPHER_LIST);
  2055.         }
  2056.     }
  2057.  
  2058.     ssl_verify_depth = -1;
  2059.  
  2060.     if ( ssl_debug_flag )
  2061.         printf("SSL/TLS init done!\r\n");
  2062.  
  2063.     ssl_initialized = 1;
  2064.     last_ssl_mode = mode;
  2065.     debug(F110,"ssl_tn_init","done",0);
  2066.     return(1);
  2067. }
  2068.  
  2069. #ifndef NOHTTP
  2070. int
  2071. #ifdef CK_ANSIC
  2072. ssl_http_init(char * hostname)
  2073. #else
  2074. ssl_http_init(hostname) char * hostname;
  2075. #endif /* CK_ANSIC */
  2076. {
  2077. #ifdef KRB5
  2078.     extern char * k5_keytab;
  2079.     extern char * krb5_d_srv;
  2080. #endif /* KRB5 */
  2081.     SSL * tls_conx=NULL;
  2082.  
  2083.     ssl_http_initialized = 0;
  2084.  
  2085.     if ( !ck_ssleay_is_installed() )
  2086.         return(0);
  2087.     debug(F110,"ssl_http_init",hostname,0);
  2088.  
  2089.     if (ssl_debug_flag)
  2090.         printf("SSL_DEBUG_FLAG on\r\n");
  2091.  
  2092.     if (!tls_http_ctx ) {
  2093. #ifdef COMMENT
  2094.         /* too many web servers still do not support TLSv1 */
  2095.         tls_http_ctx=(SSL_CTX *)SSL_CTX_new(TLSv1_client_method());
  2096. #else /* COMMENT */
  2097.         tls_http_ctx=(SSL_CTX *)SSL_CTX_new(SSLv23_client_method());
  2098.         /* This can fail because we do not have RSA available */
  2099.         if ( !tls_http_ctx ) {
  2100.             debug(F110,"ssl_http_init","SSLv23_client_method failed",0);
  2101.             tls_http_ctx=(SSL_CTX *)SSL_CTX_new(SSLv3_client_method());
  2102.         }
  2103. #endif /* COMMENT */
  2104.         if ( !tls_http_ctx ) {
  2105.             debug(F110,"ssl_http_init","TLSv1_client_method failed",0);
  2106.             return(0);
  2107.         }
  2108. #ifdef USE_CERT_CB
  2109.         SSL_CTX_set_client_cert_cb(tls_http_ctx,ssl_client_cert_callback);
  2110. #endif /* USE_CERT_CB */
  2111.     }
  2112.  
  2113.     SSL_CTX_set_default_passwd_cb(tls_http_ctx,
  2114.                                   (pem_password_cb *)ssl_passwd_callback);
  2115.  
  2116.     /* for SSL switch on all the interoperability and bug
  2117.      * workarounds so that we will communicate with people
  2118.      * that cannot read poorly written specs :-)
  2119.      * for TLS be sure to prevent use of SSLv2
  2120.      */
  2121.     SSL_CTX_set_options(tls_http_ctx,
  2122.             SSL_OP_NO_SSLv2|SSL_OP_SINGLE_DH_USE|SSL_OP_EPHEMERAL_RSA);
  2123.  
  2124.     SSL_CTX_set_info_callback(tls_http_ctx,ssl_client_info_callback);
  2125.  
  2126. #ifndef COMMENT
  2127.     SSL_CTX_set_session_cache_mode(tls_http_ctx,SSL_SESS_CACHE_CLIENT);
  2128.     SSL_CTX_set_session_id_context(tls_http_ctx,(CHAR *)"3",1);
  2129. #else /* COMMENT */
  2130.     SSL_CTX_set_session_cache_mode(tls_http_ctx,SSL_SESS_CACHE_OFF);
  2131. #endif /* COMMENT */
  2132.  
  2133.     /* make sure we will find certificates in the standard
  2134.      * location ... otherwise we don't look anywhere for
  2135.      * these things which is going to make client certificate
  2136.      * exchange rather useless :-)
  2137.      */
  2138.  
  2139. #ifdef OS2
  2140. #ifdef NT
  2141.     {
  2142.         /* The defaults in the SSL crypto library are not appropriate for OS/2 */
  2143.         char path[CKMAXPATH];
  2144.  
  2145.         ckmakmsg(path,CKMAXPATH,exedir,"certs",NULL,NULL);
  2146.         if (SSL_CTX_load_verify_locations(tls_http_ctx,NULL,path) == 0)  {
  2147.             debug(F110,"ssl_http_init unable to load path",path,0);
  2148.             if (ssl_debug_flag)
  2149.                 printf("?Unable to load verify-dir: %s\r\n",path);
  2150.         }
  2151.  
  2152.         ckmakmsg(path,CKMAXPATH,GetAppData(1),"kermit 95/certs",NULL,NULL);
  2153.         if (SSL_CTX_load_verify_locations(tls_http_ctx,NULL,path) == 0)  {
  2154.             debug(F110,"ssl_http_init unable to load path",path,0);
  2155.             if (ssl_debug_flag)
  2156.                 printf("?Unable to load verify-dir: %s\r\n",path);
  2157.         }
  2158.  
  2159.         ckmakmsg(path,CKMAXPATH,GetAppData(0),"kermit 95/certs",NULL,NULL);
  2160.         if (SSL_CTX_load_verify_locations(tls_http_ctx,NULL,path) == 0)  {
  2161.             debug(F110,"ssl_http_init unable to load path",path,0);
  2162.             if (ssl_debug_flag)
  2163.                 printf("?Unable to load verify-dir: %s\r\n",path);
  2164.         }
  2165.  
  2166.         ckmakmsg(path,CKMAXPATH,exedir,"ca_certs.pem",NULL,NULL);
  2167.         if (SSL_CTX_load_verify_locations(tls_http_ctx,path,NULL) == 0) {
  2168.             debug(F110,"ssl_http_init unable to load path",path,0);
  2169.             if (ssl_debug_flag)
  2170.                 printf("?Unable to load verify-file: %s\r\n",path);
  2171.         }
  2172.  
  2173.         ckmakmsg(path,CKMAXPATH,GetAppData(1),"kermit 95/ca_certs.pem",NULL,NULL);
  2174.         if (SSL_CTX_load_verify_locations(tls_http_ctx,path,NULL) == 0) {
  2175.             debug(F110,"ssl_http_init unable to load path",path,0);
  2176.             if (ssl_debug_flag)
  2177.                 printf("?Unable to load verify-file: %s\r\n",path);
  2178.         }
  2179.  
  2180.         ckmakmsg(path,CKMAXPATH,GetAppData(0),"kermit 95/ca_certs.pem",NULL,NULL);
  2181.         if (SSL_CTX_load_verify_locations(tls_http_ctx,path,NULL) == 0) {
  2182.             debug(F110,"ssl_http_init unable to load path",path,0);
  2183.             if (ssl_debug_flag)
  2184.                 printf("?Unable to load verify-file: %s\r\n",path);
  2185.         }
  2186.     }
  2187. #else /* NT */
  2188.     {
  2189.         /* The defaults in the SSL crypto library are not appropriate for OS/2 */
  2190.         char path[CKMAXPATH];
  2191.  
  2192.         ckmakmsg(path,CKMAXPATH,exedir,"certs",NULL,NULL);
  2193.         if (SSL_CTX_load_verify_locations(tls_http_ctx,NULL,path) == 0)  {
  2194.             debug(F110,"ssl_http_init unable to load path",path,0);
  2195.             if (ssl_debug_flag)
  2196.                 printf("?Unable to load verify-dir: %s\r\n",path);
  2197.         }
  2198.         ckmakmsg(path,CKMAXPATH,exedir,"ca_certs.pem",NULL,NULL);
  2199.         if (SSL_CTX_load_verify_locations(tls_http_ctx,path,NULL) == 0) {
  2200.             debug(F110,"ssl_http_init unable to load path",path,0);
  2201.             if (ssl_debug_flag)
  2202.                 printf("?Unable to load verify-file: %s\r\n",path);
  2203.         }
  2204.     }
  2205. #endif /* NT */
  2206. #else /* OS2 */
  2207.     SSL_CTX_set_default_verify_paths(tls_http_ctx);
  2208. #endif /* OS2 */
  2209.  
  2210.     if (ssl_verify_file &&
  2211.         SSL_CTX_load_verify_locations(tls_http_ctx,ssl_verify_file,NULL) == 0)  {
  2212.         debug(F110,"ssl_http_init unable to load ssl_verify_file",ssl_verify_file,0);
  2213.         if (ssl_debug_flag)
  2214.             printf("?Unable to load verify-file: %s\r\n",ssl_verify_file);
  2215.     }
  2216.     if (ssl_verify_dir &&
  2217.         SSL_CTX_load_verify_locations(tls_http_ctx,NULL,ssl_verify_dir) == 0)  {
  2218.         debug(F110,"ssl_http_init unable to load ssl_verify_dir",ssl_verify_dir,0);
  2219.         if (ssl_debug_flag)
  2220.             printf("?Unable to load verify-dir: %s\r\n",ssl_verify_dir);
  2221.     }
  2222.  
  2223.     SSL_CTX_set_verify(tls_http_ctx,ssl_verify_flag,
  2224.                            ssl_client_verify_callback);
  2225.  
  2226.     /* Free the existing CRL Store */
  2227.     if (crl_store) {
  2228.         X509_STORE_free(crl_store);
  2229.         crl_store = NULL;
  2230.     }
  2231.  
  2232.     /* set up the new CRL Store */
  2233.     crl_store = X509_STORE_new();
  2234.     if (crl_store) {
  2235. #ifdef OS2
  2236.         char path[CKMAXPATH];
  2237.  
  2238.         ckmakmsg(path,CKMAXPATH,exedir,"crls",NULL,NULL);
  2239.         if (X509_STORE_load_locations(crl_store,NULL,path) == 0) {
  2240.             debug(F110,"ssl_http_init unable to load dir",path,0);
  2241.             if (ssl_debug_flag)
  2242.                 printf("?Unable to load crl-dir: %s\r\n",path);
  2243.         }
  2244. #ifdef NT
  2245.         ckmakmsg(path,CKMAXPATH,GetAppData(1),"kermit 95/crls",NULL,NULL);
  2246.         if (X509_STORE_load_locations(crl_store,NULL,path) == 0) {
  2247.             debug(F110,"ssl_http_init unable to load dir",path,0);
  2248.             if (ssl_debug_flag)
  2249.                 printf("?Unable to load crl-dir: %s\r\n",path);
  2250.         }
  2251.         ckmakmsg(path,CKMAXPATH,GetAppData(0),"kermit 95/crls",NULL,NULL);
  2252.         if (X509_STORE_load_locations(crl_store,NULL,path) == 0) {
  2253.             debug(F110,"ssl_http_init unable to load dir",path,0);
  2254.             if (ssl_debug_flag)
  2255.                 printf("?Unable to load crl-dir: %s\r\n",path);
  2256.         }
  2257. #endif /* NT */
  2258.         
  2259.         ckmakmsg(path,CKMAXPATH,exedir,"ca_crls.pem",NULL,NULL);
  2260.         if (X509_STORE_load_locations(crl_store,path,NULL) == 0) {
  2261.             debug(F110,"ssl_http_init unable to load file",path,0);
  2262.             if (ssl_debug_flag)
  2263.                 printf("?Unable to load crl-file: %s\r\n",path);
  2264.         }
  2265. #ifdef NT
  2266.         ckmakmsg(path,CKMAXPATH,GetAppData(1),"kermit 95/ca_crls.pem",NULL,NULL);
  2267.         if (X509_STORE_load_locations(crl_store,path,NULL) == 0) {
  2268.             debug(F110,"ssl_http_init unable to load file",path,0);
  2269.             if (ssl_debug_flag)
  2270.                 printf("?Unable to load crl-file: %s\r\n",path);
  2271.         }
  2272.         ckmakmsg(path,CKMAXPATH,GetAppData(0),"kermit 95/ca_crls.pem",NULL,NULL);
  2273.         if (X509_STORE_load_locations(crl_store,path,NULL) == 0) {
  2274.             debug(F110,"ssl_http_init unable to load file",path,0);
  2275.             if (ssl_debug_flag)
  2276.                 printf("?Unable to load crl-file: %s\r\n",path);
  2277.         }
  2278. #endif /* NT */
  2279. #endif /* OS2 */
  2280.  
  2281.         if (ssl_crl_file || ssl_crl_dir) {
  2282.             if (ssl_crl_file &&
  2283.                 X509_STORE_load_locations(crl_store,ssl_crl_file,NULL) == 0) {
  2284.                 debug(F110,"ssl_http_init unable to load ssl_crl_file",ssl_crl_file,0);
  2285.                 if (ssl_debug_flag)
  2286.                     printf("?Unable to load crl-file: %s\r\n",ssl_crl_file);
  2287.             }
  2288.             if (ssl_crl_dir &&
  2289.                 X509_STORE_load_locations(crl_store,NULL,ssl_crl_dir) == 0) {
  2290.                 debug(F110,"ssl_http_init unable to load ssl_crl_dir",ssl_crl_dir,0);
  2291.                 if (ssl_debug_flag)
  2292.                     printf("?Unable to load crl-dir: %s\r\n",ssl_crl_dir);
  2293.             }
  2294.         } else {
  2295.             X509_STORE_set_default_paths(crl_store);
  2296.         }
  2297.     }
  2298.  
  2299. #ifndef COMMENT
  2300.     tls_conx = tls_http_con;
  2301.     tls_http_con=(SSL *)SSL_new(tls_http_ctx);
  2302.     if ( !tls_http_con ) {
  2303.         debug(F110,"ssl_http_init","SSL_new(tls_http_con) failed",0);
  2304.         tls_http_con = tls_conx;
  2305.         return(0);
  2306.     }
  2307.     if (tls_conx) {
  2308.         SSL_set_session(tls_http_con, SSL_get_session(tls_conx));
  2309. #ifdef SSL_KRB5
  2310.         if (tls_conx->kssl_ctx) {
  2311.             kssl_ctx_free(tls_conx->kssl_ctx);
  2312.             tls_conx->kssl_ctx = NULL;
  2313.         }
  2314. #endif /* SSL_KRB5 */
  2315.         SSL_free(tls_conx);
  2316.         tls_conx = NULL;
  2317.     }
  2318. #else /* COMMENT */
  2319.     /* I don't know why this does not work to reuse the connection. */
  2320.     if ( tls_http_con ) {
  2321.         SSL_clear(tls_http_con);
  2322.         SSL_set_session(tls_http_con,NULL);
  2323.         SSL_set_accept_state(tls_http_con) ;
  2324.     } else {
  2325.         tls_http_con=(SSL *)SSL_new(tls_http_ctx);
  2326.         if ( !tls_http_con ) {
  2327.             debug(F110,"ssl_http_init","SSL_new(tls_http_ctx) failed",0);
  2328.             tls_http_con = tls_conx;
  2329.             return(0);
  2330.         }
  2331.     }
  2332. #endif /* COMMENT */
  2333.  
  2334. #ifdef SSL_KRB5
  2335. #ifndef KRB5_SERVICE_NAME
  2336. #define KRB5_SERVICE_NAME    "host"
  2337. #endif
  2338.  
  2339.     if (tls_http_con->kssl_ctx == NULL)
  2340.     tls_http_con->kssl_ctx = kssl_ctx_new();
  2341.     if (tls_http_con->kssl_ctx != NULL)
  2342.         kssl_ctx_setstring(tls_http_con->kssl_ctx, KSSL_SERVER, hostname);
  2343.  
  2344.     kssl_ctx_setstring(tls_http_con->kssl_ctx, KSSL_SERVICE,
  2345.                         krb5_d_srv ? krb5_d_srv : KRB5_SERVICE_NAME);
  2346. #endif /* SSL_KRB5 */
  2347.  
  2348.     if (ssl_cipher_list)
  2349.         SSL_set_cipher_list(tls_http_con,ssl_cipher_list);
  2350.     else {
  2351.         char * p;
  2352.         if (p = getenv("SSL_CIPHER")) {
  2353.             SSL_set_cipher_list(tls_http_con,p);
  2354.         } else {
  2355.             SSL_set_cipher_list(tls_http_con,DEFAULT_CIPHER_LIST);
  2356.         }
  2357.     }
  2358.  
  2359.     ssl_verify_depth = -1;
  2360.  
  2361.     if ( ssl_debug_flag )
  2362.         printf("SSL/TLS init done!\r\n");
  2363.  
  2364.     ssl_http_initialized = 1;
  2365.     return(1);
  2366. }
  2367. #endif /* NOHTTP */
  2368.  
  2369. char *
  2370. ssl_get_dNSName(ssl) SSL * ssl;
  2371. {
  2372.     static char *dns = NULL;
  2373.     X509 *server_cert = NULL;
  2374.     int i;
  2375.     X509_EXTENSION *ext = NULL;
  2376.     STACK_OF(GENERAL_NAME) *ialt = NULL;
  2377.     GENERAL_NAME *gen = NULL;
  2378.  
  2379.     if ( dns ) {
  2380.         free(dns);
  2381.         dns = NULL;
  2382.     }
  2383.  
  2384.     if (server_cert = SSL_get_peer_certificate(ssl)) {
  2385.         if ((i = X509_get_ext_by_NID(server_cert, NID_subject_alt_name, -1))<0)
  2386.             return NULL;
  2387.         if (!(ext = X509_get_ext(server_cert, i)))
  2388.             return NULL;
  2389.         X509V3_add_standard_extensions();
  2390.         if (!(ialt = X509V3_EXT_d2i(ext)))
  2391.             return NULL;
  2392.         for (i = 0; i < sk_GENERAL_NAME_num(ialt); i++) {
  2393.             gen = sk_GENERAL_NAME_value(ialt, i);
  2394.             if (gen->type == GEN_DNS) {
  2395.                 if(!gen->d.ia5 || !gen->d.ia5->length)
  2396.                     break;
  2397.                 dns = malloc(gen->d.ia5->length + 1);
  2398.                 if (dns) {
  2399.                     memcpy(dns, gen->d.ia5->data, gen->d.ia5->length);
  2400.                     dns[gen->d.ia5->length] = 0;
  2401.                 }
  2402.                 break;
  2403.             }
  2404.         }
  2405.         X509V3_EXT_cleanup();
  2406.     }
  2407. cleanup:
  2408.     if (ialt)           sk_GENERAL_NAME_free(ialt);
  2409.     if (server_cert)    X509_free(server_cert);
  2410.     return dns;
  2411. }
  2412.  
  2413. char *
  2414. ssl_get_commonName(ssl) SSL * ssl;
  2415. {
  2416.     static char name[256];
  2417.     int err;
  2418.     X509 *server_cert;
  2419.  
  2420.     if (server_cert = SSL_get_peer_certificate(ssl)) {
  2421.         err = X509_NAME_get_text_by_NID(X509_get_subject_name(server_cert),
  2422.                 NID_commonName, name, sizeof(name));
  2423.         X509_free(server_cert);
  2424.     }
  2425.     if (err > 0)
  2426.         return name;
  2427.     else
  2428.         return NULL;
  2429. }
  2430.  
  2431. char *
  2432. ssl_get_issuer_name(ssl) SSL * ssl;
  2433. {
  2434.     static char name[256];
  2435.     X509 *server_cert;
  2436.  
  2437.     name[0] = '\0';
  2438.     if (server_cert = SSL_get_peer_certificate(ssl)) {
  2439.         X509_NAME_oneline(X509_get_issuer_name(server_cert),name,sizeof(name));
  2440.         X509_free(server_cert);
  2441.         return name;
  2442.     }
  2443.     else {
  2444. #ifdef COMMENT
  2445.       fprintf(stderr, "Warning: No certificate from server!\r\n");
  2446. #endif /* COMMENT */
  2447.         return NULL;
  2448.     }
  2449. }
  2450.  
  2451. char *
  2452. ssl_get_subject_name(ssl) SSL * ssl;
  2453. {
  2454.     static char name[256];
  2455.     X509 *server_cert;
  2456.  
  2457.     name[0] = '\0';
  2458.     if (server_cert = SSL_get_peer_certificate(ssl)) {
  2459.        X509_NAME_oneline(X509_get_subject_name(server_cert),name,sizeof(name));
  2460.        X509_free(server_cert);
  2461.        return name;
  2462.     }
  2463.     else
  2464.         return NULL;
  2465. }
  2466.  
  2467. #ifdef COMMENT
  2468. #ifdef CK_SSL
  2469.             && !(ck_ssleay_is_installed() &&
  2470.                (tls_active_flag || ssl_active_flag) &&
  2471.                ssl_anonymous_cipher(tls_active_flag?tls_con:ssl_con))
  2472. #endif /* CK_SSL */
  2473.  
  2474. int
  2475. ssl_anonymous_cipher(ssl) SSL * ssl;
  2476. {
  2477.     X509 * cert;
  2478.  
  2479.     if (sstelnet)
  2480.         cert = SSL_get_certificate(ssl);
  2481.     else
  2482.         cert = SSL_get_peer_certificate(ssl);
  2483.  
  2484.     if ( cert ) {
  2485.         X509_free(cert);
  2486.         return 0;
  2487.     }
  2488.     return 1;
  2489. }
  2490. #endif /* COMMENT */
  2491.  
  2492. /*
  2493.   This one is (very much!) based on work by
  2494.   Ralf S. Engelschall <rse@engelschall.com>.
  2495.   Comments by Ralf.
  2496. */
  2497. int
  2498. ssl_verify_crl(int ok, X509_STORE_CTX *ctx)
  2499. {
  2500.     X509_OBJECT obj;
  2501.     X509_NAME *subject = NULL;
  2502.     X509_NAME *issuer = NULL;
  2503.     X509 *xs = NULL;
  2504.     X509_CRL *crl = NULL;
  2505.     X509_REVOKED *revoked = NULL;
  2506.     X509_STORE_CTX * store_ctx = NULL;
  2507.     long serial;
  2508.     BIO *bio = NULL;
  2509.     int i, n, rc;
  2510.     char *cp;
  2511.     char *cp2;
  2512.  
  2513.     /*
  2514.      * Unless a revocation store for CRLs was created we
  2515.      * cannot do any CRL-based verification, of course.
  2516.      */
  2517.     if (!crl_store)
  2518.         return ok;
  2519.  
  2520.     store_ctx = X509_STORE_CTX_new();
  2521.     if ( !store_ctx )
  2522.         return(ok);
  2523.  
  2524.     /*
  2525.      * Determine certificate ingredients in advance
  2526.      */
  2527.     xs      = X509_STORE_CTX_get_current_cert(ctx);
  2528.     subject = X509_get_subject_name(xs);
  2529.     issuer  = X509_get_issuer_name(xs);
  2530.  
  2531.     /*
  2532.      * OpenSSL provides the general mechanism to deal with CRLs but does not
  2533.      * use them automatically when verifying certificates, so we do it
  2534.      * explicitly here. We will check the CRL for the currently checked
  2535.      * certificate, if there is such a CRL in the store.
  2536.      *
  2537.      * We come through this procedure for each certificate in the certificate
  2538.      * chain, starting with the root-CA's certificate. At each step we've to
  2539.      * both verify the signature on the CRL (to make sure it's a valid CRL)
  2540.      * and it's revocation list (to make sure the current certificate isn't
  2541.      * revoked).  But because to check the signature on the CRL we need the
  2542.      * public key of the issuing CA certificate (which was already processed
  2543.      * one round before), we've a little problem. But we can both solve it and
  2544.      * at the same time optimize the processing by using the following
  2545.      * verification scheme (idea and code snippets borrowed from the GLOBUS
  2546.      * project):
  2547.      *
  2548.      * 1. We'll check the signature of a CRL in each step when we find a CRL
  2549.      *    through the _subject_ name of the current certificate. This CRL
  2550.      *    itself will be needed the first time in the next round, of course.
  2551.      *    But we do the signature processing one round before this where the
  2552.      *    public key of the CA is available.
  2553.      *
  2554.      * 2. We'll check the revocation list of a CRL in each step when
  2555.      *    we find a CRL through the _issuer_ name of the current certificate.
  2556.      *    This CRLs signature was then already verified one round before.
  2557.      *
  2558.      * This verification scheme allows a CA to revoke its own certificate as
  2559.      * well, of course.
  2560.      */
  2561.  
  2562.     /*
  2563.      * Try to retrieve a CRL corresponding to the _subject_ of
  2564.      * the current certificate in order to verify it's integrity.
  2565.      */
  2566.     memset((char *)&obj, 0, sizeof(obj));
  2567.     X509_STORE_CTX_init(store_ctx, crl_store, NULL, NULL);
  2568.     rc = X509_STORE_get_by_subject(store_ctx, X509_LU_CRL, subject, &obj);
  2569.     X509_STORE_CTX_cleanup(store_ctx);
  2570.     crl = obj.data.crl;
  2571.     if (rc > 0 && crl != NULL) {
  2572.         /*
  2573.          * Verify the signature on this CRL
  2574.          */
  2575.         if (X509_CRL_verify(crl, X509_get_pubkey(xs)) <= 0) {
  2576.             fprintf(stderr, "Invalid signature on CRL!\n");
  2577.             X509_STORE_CTX_set_error(ctx, X509_V_ERR_CRL_SIGNATURE_FAILURE);
  2578.             X509_OBJECT_free_contents(&obj);
  2579.             X509_STORE_CTX_free(store_ctx);
  2580.             return 0;
  2581.         }
  2582.  
  2583.         /*
  2584.          * Check date of CRL to make sure it's not expired
  2585.          */
  2586.         i = X509_cmp_current_time(X509_CRL_get_nextUpdate(crl));
  2587.         if (i == 0) {
  2588.             fprintf(stderr, "Found CRL has invalid nextUpdate field.\n");
  2589.             X509_STORE_CTX_set_error(ctx,
  2590.                                     X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD);
  2591.             X509_OBJECT_free_contents(&obj);
  2592.             X509_STORE_CTX_free(store_ctx);
  2593.             return 0;
  2594.         }
  2595.         if (i < 0) {
  2596.             fprintf(stderr,
  2597. "Found CRL is expired - revoking all certificates until you get updated CRL.\n"
  2598.                     );
  2599.             X509_STORE_CTX_set_error(ctx, X509_V_ERR_CRL_HAS_EXPIRED);
  2600.             X509_OBJECT_free_contents(&obj);
  2601.             X509_STORE_CTX_free(store_ctx);
  2602.             return 0;
  2603.         }
  2604.         X509_OBJECT_free_contents(&obj);
  2605.     }
  2606.  
  2607.     /*
  2608.      * Try to retrieve a CRL corresponding to the _issuer_ of
  2609.      * the current certificate in order to check for revocation.
  2610.      */
  2611.     memset((char *)&obj, 0, sizeof(obj));
  2612.     X509_STORE_CTX_init(store_ctx, crl_store, NULL, NULL);
  2613.     rc = X509_STORE_get_by_subject(store_ctx, X509_LU_CRL, issuer, &obj);
  2614.     X509_STORE_CTX_free(store_ctx);        /* calls X509_STORE_CTX_cleanup() */
  2615.     crl = obj.data.crl;
  2616.     if (rc > 0 && crl != NULL) {
  2617.         /*
  2618.          * Check if the current certificate is revoked by this CRL
  2619.          */
  2620.         n = sk_X509_REVOKED_num(X509_CRL_get_REVOKED(crl));
  2621.         for (i = 0; i < n; i++) {
  2622.             revoked = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i);
  2623.             if (ASN1_INTEGER_cmp(revoked->serialNumber,
  2624.                                  X509_get_serialNumber(xs)) == 0) {
  2625.  
  2626.                 serial = ASN1_INTEGER_get(revoked->serialNumber);
  2627.                 cp = X509_NAME_oneline(issuer, NULL, 0);
  2628.                 free(cp);
  2629.  
  2630.                 X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED);
  2631.                 X509_OBJECT_free_contents(&obj);
  2632.                 return 0;
  2633.             }
  2634.         }
  2635.         X509_OBJECT_free_contents(&obj);
  2636.     }
  2637.     return ok;
  2638. }
  2639.  
  2640. char *
  2641. tls_userid_from_client_cert(ssl) SSL * ssl;
  2642. {
  2643.     static char cn[256];
  2644.     static char *r = cn;
  2645.     int err;
  2646.     X509 *client_cert;
  2647.  
  2648.     if (client_cert = SSL_get_peer_certificate(ssl)) {
  2649.         /* call the custom function */
  2650.         err = X509_to_user(client_cert, cn, sizeof(cn));
  2651.         X509_free(client_cert);
  2652.         if (err)
  2653.             return r = NULL;
  2654.         else
  2655.             return r;
  2656.     }
  2657.     else
  2658.         return r = NULL;
  2659. }
  2660.  
  2661. unsigned char **
  2662. tls_get_SAN_objs(SSL * ssl, int type)
  2663. /* returns NULL or an array of malloc'ed objects of type `type' from the server's
  2664.  * subjectAltName, remember to free() them all!
  2665.  */
  2666. {
  2667. #define NUM_SAN_OBJS 64
  2668.     static unsigned char *objs[NUM_SAN_OBJS];
  2669.     unsigned char **rv = NULL;
  2670.     X509 *server_cert = NULL;
  2671.     int i, j;
  2672.     X509_EXTENSION *ext = NULL;
  2673.     STACK_OF(GENERAL_NAME) *ialt = NULL;
  2674.     GENERAL_NAME *gen = NULL;
  2675.  
  2676.     memset(objs, 0, sizeof(objs));
  2677.     if (server_cert = SSL_get_peer_certificate(ssl)) {
  2678.         if ((i = X509_get_ext_by_NID(server_cert, NID_subject_alt_name, -1)) < 0)
  2679.             goto eject;
  2680.         if (!(ext = X509_get_ext(server_cert, i)))
  2681.             goto eject;
  2682.         X509V3_add_standard_extensions();
  2683.         if (!(ialt = X509V3_EXT_d2i(ext)))
  2684.             goto eject;
  2685.         rv = objs;
  2686.         for (i = 0, j = 0; i < sk_GENERAL_NAME_num(ialt) && j < NUM_SAN_OBJS - 2; i++) {
  2687.             gen = sk_GENERAL_NAME_value(ialt, i);
  2688.             /* The use of V_ASN1_CONTEXT_SPECIFIC is because OpenSSL 0.9.6 defined its
  2689.              * types | V_ASN1_CONTEXT_SPECIFIC.  0.9.7 does not.  In case, we are built
  2690.              * with one and linked to the other we use this hack.
  2691.              */
  2692.             if ((gen->type | V_ASN1_CONTEXT_SPECIFIC) == (type | V_ASN1_CONTEXT_SPECIFIC)) {
  2693.                 if(!gen->d.ia5 || !gen->d.ia5->length)
  2694.                     break;
  2695.                 objs[j] = malloc(gen->d.ia5->length + 1);
  2696.                 if (objs[j]) {
  2697.                     memcpy(objs[j], gen->d.ia5->data, gen->d.ia5->length);
  2698.                     objs[j][gen->d.ia5->length] = 0;
  2699.                     j++;
  2700.                 }
  2701.             }
  2702.         }
  2703.         X509V3_EXT_cleanup();
  2704.     }
  2705. eject:
  2706.     if (ialt)           sk_GENERAL_NAME_free(ialt);
  2707.     if (server_cert)    X509_free(server_cert);
  2708.     return rv;
  2709. }
  2710.  
  2711.  
  2712. static int
  2713. dNSName_cmp(const char *host, const char *dNSName)
  2714. {
  2715.     int c1 = 1, c2 = 1, num_comp, rv = -1;
  2716.     char *p, *p1, *p2, *host_copy=NULL, *dNSName_copy=NULL;
  2717.  
  2718.     /* first we count the number of domain name components in both parameters.
  2719.      * they should be equal many, or it's not a match
  2720.      */
  2721.     p = (char *) host;
  2722.     while (p = strstr(p, ".")) {
  2723.         c1++;
  2724.         p++;
  2725.     }
  2726.     p = (char *) dNSName;
  2727.     while (p = strstr(p, ".")) {
  2728.         c2++;
  2729.         p++;
  2730.     }
  2731.     if (c1 != c2)
  2732.         return -1;
  2733.     num_comp = c1;
  2734.  
  2735.     makestr(&host_copy,host);
  2736.     makestr(&dNSName_copy,dNSName);
  2737.     if (host_copy == NULL || dNSName_copy == NULL)
  2738.         goto eject;
  2739.     /* make substrings by replacing '.' with '\0' */
  2740.     p = dNSName_copy;
  2741.     while (p = strstr(p, ".")) {
  2742.         *p = '\0';
  2743.         p++;
  2744.     }
  2745.     p = host_copy;
  2746.     while (p = strstr(p, ".")) {
  2747.         *p = '\0';
  2748.         p++;
  2749.     }
  2750.  
  2751.     /* compare each component */
  2752.     p1 = host_copy;
  2753.     p2 = dNSName_copy;
  2754.     for (; num_comp; num_comp--) {
  2755.         if (!ckmatch(p2, p1,0,1))
  2756.             /* failed match */
  2757.             goto eject;
  2758.         p1 += strlen(p1) + 1;
  2759.         p2 += strlen(p2) + 1;
  2760.     }
  2761.     /* match ok */
  2762.     rv = 0;
  2763.  
  2764.   eject:
  2765.     if (dNSName_copy)   free(dNSName_copy);
  2766.     if (host_copy)      free(host_copy);
  2767.     return rv;
  2768. }
  2769.  
  2770.  
  2771.  
  2772. static int
  2773. show_hostname_warning(char *s1, char *s2)
  2774. {
  2775.     char prefix[1024];
  2776.     int ok = 1;
  2777.     ckmakxmsg(prefix,1024,
  2778.               "Warning: Hostname (\"", s1, 
  2779.               "\") does not match server's certificate (\"", s2, "\")",
  2780.               NULL,NULL,NULL,NULL,NULL,NULL,NULL);
  2781.     if (ssl_verify_flag)
  2782.         ok = uq_ok(prefix,
  2783.                     "Continue? (Y/N) ",
  2784.                     3, NULL, 0);
  2785.     else if (ssl_verbose_flag)
  2786.         printf(prefix);
  2787.     return(ok);
  2788. }
  2789.  
  2790. #ifndef OSF50
  2791. #ifndef HPUX10
  2792. #ifndef HPUX1100
  2793. #ifndef SCO_OSR505
  2794. #ifndef OpenBSD
  2795. #ifndef FREEBSD4
  2796. #ifndef LINUX
  2797. #ifndef AIX41
  2798. #ifndef UW7
  2799. #ifndef SOLARIS9
  2800. #ifndef SOLARIS8
  2801. #ifndef SOLARIS7
  2802. #ifndef MACOSX
  2803. #ifdef DEC_TCPIP
  2804. #define inet_aton INET_ATON
  2805. #endif /* DEC_TCPIP */
  2806. static int
  2807. inet_aton(char * ipaddress, struct in_addr * ia) {
  2808.     struct stringarray * q;
  2809.     union {
  2810.         unsigned long l;
  2811.         unsigned char b[4];
  2812.     } dummy;
  2813.  
  2814.     q = cksplit(1,0,ipaddress,".","0123456789abcdefACDEF",8,0,0);
  2815.     if (q->a_size == 4) {
  2816.         dummy.b[0] = atoi(q->a_head[1]);
  2817.         dummy.b[1] = atoi(q->a_head[2]);
  2818.         dummy.b[2] = atoi(q->a_head[3]);
  2819.         dummy.b[3] = atoi(q->a_head[4]);
  2820.         ia->s_addr = dummy.l;
  2821.         return(ia->s_addr != 0);
  2822.     }
  2823.     return(0);
  2824. }
  2825. #endif /* MACOSX */
  2826. #endif /* SOLARIS7 */
  2827. #endif /* SOLARIS8 */
  2828. #endif /* SOLARIS9 */
  2829. #endif /* UW7 */
  2830. #endif /* AIX41 */
  2831. #endif /* LINUX */
  2832. #endif /* FREEBSD4 */
  2833. #endif /* OpenBSD */
  2834. #endif /* SCO_OSR505 */
  2835. #endif /* HPUX1100 */
  2836. #endif /* HPUX10 */
  2837. #endif /* OSF50 */
  2838.  
  2839. int
  2840. ssl_check_server_name(SSL * ssl, char * hostname)
  2841. /* returns 0 if hostname and server's cert matches, else -1 */
  2842. {
  2843.     char * commonName;
  2844.     unsigned char ** dNSName;
  2845.     unsigned char ** ipAddress;
  2846.     struct in_addr ia;
  2847.     int rv;
  2848.  
  2849.     if (ssl_verbose_flag && !inserver) {
  2850.         if (dNSName = tls_get_SAN_objs(ssl,GEN_DNS)) {
  2851.             int i = 0;
  2852.             for (i = 0; dNSName[i]; i++) {
  2853.                 printf("Certificate[0] altSubjectName DNS=%s\r\n",dNSName[i]);
  2854.                 free(dNSName[i]);
  2855.             }
  2856.         }
  2857.         if (ipAddress = tls_get_SAN_objs(ssl,GEN_IPADD)) {
  2858.             int i = 0;
  2859.             char *server_ip;
  2860.             struct in_addr ia;
  2861.  
  2862.             for (i = 0; ipAddress[i]; i++) {
  2863.                 if (ipAddress[i]) {
  2864.                     ia.s_addr = *(unsigned long *)ipAddress[i];
  2865.                     server_ip = inet_ntoa(ia);
  2866.                     printf("Certificate[0] altSubjectName IPAddr=%s\r\n",server_ip);
  2867.                 }
  2868.                 free(ipAddress[i]);
  2869.             }
  2870.             /* ipAddress points to a static - don't free */
  2871.         }
  2872.         if (dNSName = tls_get_SAN_objs(ssl,GEN_EMAIL)) {
  2873.             int i = 0;
  2874.             for (i = 0; dNSName[i]; i++) {
  2875.                 printf("Certificate[0] altSubjectName Email=%s\r\n",dNSName[i]);
  2876.                 free(dNSName[i]);
  2877.             }
  2878.         }
  2879.         if (dNSName = tls_get_SAN_objs(ssl,GEN_URI)) {
  2880.             int i = 0;
  2881.             for (i = 0; dNSName[i]; i++) {
  2882.                 printf("Certificate[0] altSubjectName URI=%s\r\n",dNSName[i]);
  2883.                 free(dNSName[i]);
  2884.             }
  2885.         }
  2886.         if (dNSName = tls_get_SAN_objs(ssl,GEN_OTHERNAME)) {
  2887.             int i = 0;
  2888.             for (i = 0; dNSName[i]; i++) {
  2889.                 printf("Certificate[0] altSubjectName Other=%s\r\n",dNSName[i]);
  2890.                 free(dNSName[i]);
  2891.             }
  2892.         }
  2893.     }
  2894.  
  2895.     /* first we check if `hostname' is in fact an ip address */
  2896.     if (inet_aton(hostname, &ia)) {
  2897.         ipAddress = tls_get_SAN_objs(ssl,GEN_IPADD);
  2898.         if (ipAddress) {
  2899.             int i = 0;
  2900.             char *server_ip = "UNKNOWN";
  2901.  
  2902.             for (i = 0; ipAddress[i]; i++)
  2903.                 if (*(unsigned long *)ipAddress[i] == ia.s_addr)
  2904.                     return 0;
  2905.  
  2906.             if (ipAddress[i - 1]) {
  2907.                 ia.s_addr = *(unsigned long *)ipAddress[i - 1];
  2908.                 server_ip = inet_ntoa(ia);
  2909.             }
  2910.             rv = show_hostname_warning(hostname, server_ip) ? 0 : -1;
  2911.             for (i = 0; ipAddress[i]; i++)
  2912.                 free(ipAddress[i]);
  2913.         } else {
  2914.             rv = show_hostname_warning(hostname, "NO IP IN CERT") ? 0 : -1;
  2915.         }
  2916.         return(rv);
  2917.     }
  2918.  
  2919.     /* look for dNSName(s) in subjectAltName in the server's certificate */
  2920.     dNSName = tls_get_SAN_objs(ssl,GEN_DNS);
  2921.     if (dNSName) {
  2922.         int i = 0;
  2923.         for (i = 0; dNSName[i]; i++) {
  2924.             if (!dNSName_cmp(hostname,(char *)dNSName[i]))
  2925.                 return 0;
  2926.         }
  2927.         rv = show_hostname_warning(hostname,
  2928.                    (char *)((dNSName[i - 1] == NULL) ? 
  2929.                        (char *)"UNKNOWN" : (char *)dNSName[i - 1]))
  2930.          ? 0 : -1;
  2931.         for (i = 0; dNSName[i]; i++)
  2932.             free(dNSName[i]);
  2933.         return rv;
  2934.     } else if ((commonName = ssl_get_commonName(ssl))) {
  2935.        /* so the server didn't have any dNSName's, check the commonName */
  2936.        if (!dNSName_cmp(hostname, commonName))
  2937.            return 0;
  2938.        else
  2939.            return (show_hostname_warning(hostname, commonName) ? 0 : -1);
  2940.     }
  2941.     return -1;
  2942. }
  2943.  
  2944. /* Is 'user' authorized to access the system without a login */
  2945. int
  2946. tls_is_user_valid(SSL * ssl, const char *user)
  2947. {
  2948.     X509 *client_cert;
  2949.     int r = 0;
  2950.  
  2951.     if ( !ssl || !user || !user[0] )
  2952.         return(0);
  2953.  
  2954.     if (!(client_cert = SSL_get_peer_certificate(ssl)))
  2955.         return 0;
  2956.  
  2957.     /* Use user supplied function */
  2958.     r = X509_userok(client_cert,user);
  2959.  
  2960.     X509_free(client_cert);
  2961.     return r;
  2962. }
  2963.  
  2964. int
  2965. tls_is_anon(int x)
  2966. {
  2967.     char buf[128];
  2968.     SSL_CIPHER * cipher;
  2969.     SSL * ssl = NULL;
  2970.  
  2971.     switch ( x ) {
  2972. #ifndef NOFTP
  2973. #ifndef SYSFTP
  2974.     case 1:     /* ftp command */
  2975.         if ( ssl_ftp_active_flag )
  2976.             ssl = ssl_ftp_con;
  2977.         else
  2978.             return(0);
  2979.         break;
  2980.     case 2:     /* ftp data */
  2981.         if ( ssl_ftp_data_active_flag )
  2982.             ssl = ssl_ftp_data_con;
  2983.         else
  2984.             return(0);
  2985.         break;
  2986. #endif /* SYSFTP */
  2987. #endif /* NOFTP */
  2988.     default:
  2989.         if (tls_active_flag)
  2990.             ssl = tls_con;
  2991.         else if (ssl_active_flag)
  2992.             ssl = ssl_con;
  2993.         else
  2994.             return(0);
  2995.     }
  2996.  
  2997.     cipher = SSL_get_current_cipher(ssl);
  2998.     if (SSL_CIPHER_description(cipher,buf,sizeof(buf))) {
  2999.         if (ckindex("Au=None",buf,0,0,0) != 0)
  3000.             return(1);                  /* anonymous */
  3001.         return(0);                  /* known */
  3002.     } else {
  3003.         /* could not get cipher description.  Assume anonymous */
  3004.         return(1);
  3005.     }
  3006. }
  3007.  
  3008. int
  3009. tls_is_krb5(int x)
  3010. {
  3011.     char buf[128];
  3012.     SSL_CIPHER * cipher;
  3013.     SSL * ssl = NULL;
  3014.  
  3015.     switch ( x ) {
  3016. #ifndef NOFTP
  3017. #ifndef SYSFTP
  3018.     case 1:     /* ftp command */
  3019.         if ( ssl_ftp_active_flag )
  3020.             ssl = ssl_ftp_con;
  3021.         else
  3022.             return(0);
  3023.         break;
  3024.     case 2:     /* ftp data */
  3025.         if ( ssl_ftp_data_active_flag )
  3026.             ssl = ssl_ftp_data_con;
  3027.         else
  3028.             return(0);
  3029.         break;
  3030. #endif /* SYSFTP */
  3031. #endif /* NOFTP */
  3032. #ifndef NOHTTP
  3033.     case 3:
  3034.         if ( tls_http_active_flag )
  3035.             ssl = tls_http_con;
  3036.         break;
  3037. #endif /* NOHTTP */
  3038.     default:
  3039.         if (tls_active_flag)
  3040.             ssl = tls_con;
  3041.         else if (ssl_active_flag)
  3042.             ssl = ssl_con;
  3043.         else
  3044.             return(0);
  3045.     }
  3046.  
  3047.     cipher = SSL_get_current_cipher(ssl);
  3048.     if (cipher && SSL_CIPHER_description(cipher,buf,sizeof(buf))) {
  3049.         if (ckindex("Au=KRB5",buf,0,0,0) != 0)
  3050.             return(1);                  /* krb5 */
  3051.     }
  3052.     return(0);                          /* not */
  3053. }
  3054.  
  3055. int
  3056. ssl_get_client_finished(char *buf, int count)
  3057. {
  3058. #ifdef NO_GET_FINISHED
  3059.     return(0);
  3060. #else
  3061.     if (sstelnet || tcp_incoming) {
  3062.         return(SSL_get_peer_finished(ssl_active_flag?ssl_con:tls_con,
  3063.                                       buf,count));
  3064.     } else {
  3065.         return(SSL_get_finished(ssl_active_flag?ssl_con:tls_con,
  3066.                                       buf,count));
  3067.     }
  3068. #endif /* NO_GET_FINISHED */
  3069. }
  3070.  
  3071. int
  3072. ssl_get_server_finished(char *buf, int count)
  3073. {
  3074. #ifdef NO_GET_FINISHED
  3075.     return(0);
  3076. #else
  3077.     if (sstelnet || tcp_incoming) {
  3078.         return(SSL_get_finished(ssl_active_flag?ssl_con:tls_con,
  3079.                                       buf,count));
  3080.     } else {
  3081.         return(SSL_get_peer_finished(ssl_active_flag?ssl_con:tls_con,
  3082.                                       buf,count));
  3083.     }
  3084. #endif /* NO_GET_FINISHED */
  3085. }
  3086.  
  3087.  
  3088. #ifdef CK_AUTHENTICATION
  3089. int
  3090. #ifdef CK_ANSIC
  3091. ssl_reply(int how, unsigned char *data, int cnt)
  3092. #else
  3093. ssl_reply(how,data,cnt) int how; unsigned char *data; int cnt;
  3094. #endif
  3095. {
  3096.     char * str=NULL;
  3097.  
  3098.     data += 4;                          /* Point to status byte */
  3099.     cnt  -= 4;
  3100.  
  3101.     if(cnt-- < 1) {
  3102.         auth_finished(AUTH_REJECT);
  3103.         return AUTH_FAILURE;
  3104.     }
  3105.  
  3106.     switch(*data++) {
  3107.     case SSL_ACCEPT:
  3108.         if (tn_deb || debses)
  3109.             tn_debug("[SSL - handshake starting]");
  3110.         else if ( ssl_verbose_flag )
  3111.             printf("[SSL - handshake starting]\r\n");
  3112.         debug(F110,"ssl_reply","[SSL - handshake starting]",0);
  3113.  
  3114.         /* right ... now we drop into the SSL library */
  3115.         if (!ssl_only_flag) {
  3116.             if (ssl_dummy_flag) {
  3117.                 if (tn_deb || debses)
  3118.                     tn_debug("[SSL - Dummy Connected]");
  3119.                 else if ( ssl_verbose_flag ) {
  3120.                     printf("[SSL - Dummy Connected]\r\n");
  3121.                 }
  3122.                 debug(F110,"ssl_reply","[SSL - Dummy Connected]",0);
  3123.                 auth_finished(AUTH_UNKNOWN);
  3124.                 accept_complete = 1;
  3125.                 return AUTH_SUCCESS;
  3126.             }
  3127.  
  3128.             if (SSL_connect(ssl_con) <= 0) {
  3129.                 int len;
  3130.                 if (tn_deb || debses) {
  3131.                     tn_debug("[SSL - FAILED]");
  3132.                     ERR_print_errors(bio_err);
  3133.                     len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  3134.                     ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  3135.                     printf(ssl_err);
  3136.                 } else if ( ssl_verbose_flag ) {
  3137.                     printf("[SSL - FAILED]\r\n");
  3138.                     ERR_print_errors(bio_err);
  3139.                     len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  3140.                     ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  3141.                     printf(ssl_err);
  3142.                 }
  3143.                 debug(F110,"ssl_reply","[SSL - FAILED]",0);
  3144.                 auth_finished(AUTH_REJECT);
  3145.                 ttclos(0);
  3146.                 return AUTH_FAILURE;
  3147.             } else {
  3148.                 if (tn_deb || debses)
  3149.                     tn_debug("[SSL - OK]");
  3150.                 else if ( ssl_verbose_flag ) {
  3151.                     printf("[SSL - OK]\r\n");
  3152.                 }
  3153.                 debug(F110,"ssl_reply","[SSL - OK]",0);
  3154.  
  3155.                 ssl_active_flag = 1;
  3156.                 ssl_display_connect_details(ssl_con,0,ssl_verbose_flag);
  3157.             }
  3158.         }
  3159.         auth_finished(AUTH_UNKNOWN);
  3160.         accept_complete = 1;
  3161.         break;
  3162.  
  3163.     case SSL_REJECT:
  3164.         if (tn_deb || debses) {
  3165.             tn_debug(
  3166.                  "[SSL - failed to switch on SSL - trying plaintext login]");
  3167.         } else if ( ssl_verbose_flag ) {
  3168.             printf("[SSL - failed to switch on SSL]\r\n");
  3169.             printf("Trying plaintext login:\r\n");
  3170.         }
  3171.         debug(F110,"ssl_reply","[SSL - failed to switch on SSL]",0);
  3172.         auth_finished(AUTH_REJECT);
  3173.         return AUTH_FAILURE;
  3174.  
  3175.     default:
  3176.         return AUTH_FAILURE;
  3177.     }
  3178.     return AUTH_SUCCESS;
  3179. }
  3180.  
  3181. int
  3182. #ifdef CK_ANSIC
  3183. ssl_is(unsigned char *data, int cnt)
  3184. #else
  3185. ssl_is(data,cnt) unsigned char *data; int cnt;
  3186. #endif
  3187. {
  3188.     if ((cnt -= 4) < 1)
  3189.         return AUTH_FAILURE;
  3190.  
  3191.     data += 4;
  3192.     switch(*data++) {
  3193.     case SSL_START:
  3194.         /* server starts the SSL stuff now ... */
  3195.         if (!ssl_only_flag) {
  3196.             if ( !tls_load_certs(ssl_ctx,ssl_con,1) ) {
  3197.                 auth_finished(AUTH_REJECT);
  3198.                 return AUTH_FAILURE;
  3199.             }
  3200.  
  3201.             if (tn_deb || debses)
  3202.                 tn_debug("[SSL - handshake starting]");
  3203.             else if ( ssl_verbose_flag )
  3204.                 printf("[SSL - handshake starting]\r\n");
  3205.             debug(F110,"ssl_is","[SSL - handshake starting]",0);
  3206.  
  3207.             SendSSLAuthSB(SSL_ACCEPT, (void *)0, 0);
  3208.  
  3209.             auth_ssl_valid = 1;
  3210.  
  3211.             if (ssl_dummy_flag) {
  3212.                 if (tn_deb || debses)
  3213.                     tn_debug("[SSL - Dummy Connected]");
  3214.                 else if ( ssl_verbose_flag ) {
  3215.                     printf("[SSL - Dummy Connected]\r\n");
  3216.                 }
  3217.                 debug(F110,"ssl_is","[SSL - Dummy Connected]",0);
  3218.                 accept_complete = 1;
  3219.                 auth_finished(AUTH_UNKNOWN);
  3220.                 return AUTH_SUCCESS;
  3221.             }
  3222.  
  3223.             if (SSL_accept(ssl_con) <= 0) {
  3224.                 char errbuf[1024];
  3225.  
  3226.                 sprintf(errbuf,"[SSL - SSL_accept error: %s",
  3227.                          ERR_error_string(ERR_get_error(),NULL));
  3228.  
  3229.                 if (tn_deb || debses)
  3230.                     tn_debug(errbuf);
  3231.                 else if ( ssl_debug_flag )
  3232.                     printf("%s\r\n",errbuf);
  3233.                 else if ( ssl_verbose_flag )
  3234.                     printf("[SSL - SSL_accept error]\r\n");
  3235.  
  3236.                 debug(F110,"ssl_is",errbuf,0);
  3237.  
  3238.                 auth_finished(AUTH_REJECT);
  3239.                 ttclos(0);
  3240.                 return AUTH_FAILURE;
  3241.             }
  3242.  
  3243.             if (tn_deb || debses)
  3244.                 tn_debug("[SSL - OK]");
  3245.             else if ( ssl_verbose_flag ) {
  3246.                 printf("[SSL - OK]\r\n");
  3247.             }
  3248.             debug(F110,"ssl_is","[SSL - OK]",0);
  3249.             ssl_active_flag = 1;
  3250.             ssl_display_connect_details(ssl_con,1,ssl_verbose_flag);
  3251.  
  3252.             /* now check to see that we got exactly what we
  3253.             * wanted from the caller ... if a certificate is
  3254.             * required then we make 100% sure that we were
  3255.             * given one during the handshake (as it is an optional
  3256.             * part of SSL)
  3257.             */
  3258.  
  3259. #ifdef SSL_KRB5
  3260.             if ( tls_is_krb5(0) ) {
  3261.                 if (ssl_con->kssl_ctx->client_princ)
  3262.                     debug(F110,"ssl_is KRB5",ssl_con->kssl_ctx->client_princ,0);
  3263.             } else
  3264. #endif /* SSL_KRB5 */
  3265.             if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
  3266.                 X509 * peer = SSL_get_peer_certificate(ssl_con);
  3267.                 if (peer == NULL) {
  3268.                     if (tn_deb || debses)
  3269.                         tn_debug("[SSL - peer check failed]");
  3270.                     else if (ssl_debug_flag)
  3271.                         printf("[SSL - peer check failed]\r\n");
  3272.                     debug(F110,"ssl_is","[SSL - peer check failed]",0);
  3273.  
  3274.                     /* LOGGING REQUIRED HERE! */
  3275.                     auth_finished(AUTH_REJECT);
  3276.                     return AUTH_FAILURE;
  3277.                 }
  3278.             }
  3279.             auth_finished(AUTH_UNKNOWN);
  3280.             accept_complete = 1;
  3281.         }
  3282.         break;
  3283.  
  3284.     default:
  3285.         SendSSLAuthSB(SSL_REJECT, (void *) "Unknown option received", -1);
  3286.         if (tn_deb || debses)
  3287.             tn_debug("[SSL - Unknown option received]");
  3288.         else
  3289.             printf("Unknown SSL option %d\r\n", data[-1]);
  3290.         debug(F111,"ssl_is","[SSL - Unknown option received]",data[-1]);
  3291.         auth_ssl_valid = 0;
  3292.         auth_finished(AUTH_REJECT);
  3293.         return(AUTH_FAILURE);
  3294.     }
  3295.     return AUTH_SUCCESS;
  3296. }
  3297.  
  3298. #endif /* CK_AUTHENTICATION */
  3299.  
  3300. int
  3301. ck_tn_tls_negotiate(VOID)
  3302. {
  3303.     X509 * peer = NULL;
  3304.     char str[256], *uid=NULL;
  3305.     extern int sstelnet;
  3306.  
  3307.     if ( !ck_ssleay_is_installed() )
  3308.         return(-1);
  3309.  
  3310.     if (sstelnet) {
  3311.         /* server starts the TLS stuff now ... */
  3312.         if (!tls_only_flag) {
  3313.             if ( !tls_load_certs(tls_ctx,tls_con,1) ) {
  3314.                 auth_finished(AUTH_REJECT);
  3315.                 return -1;
  3316.             }
  3317.  
  3318.             if (tn_deb || debses)
  3319.                 tn_debug("[TLS - handshake starting]");
  3320.             else if ( ssl_verbose_flag )
  3321.                 printf("[TLS - handshake starting]\r\n");
  3322.             debug(F110,"ck_tn_tls_negotiate","[TLS - handshake starting]",0);
  3323.  
  3324.             if (ssl_dummy_flag) {
  3325.                 if (tn_deb || debses)
  3326.                     tn_debug("[TLS - Dummy Connected]");
  3327.                 else if ( ssl_verbose_flag ) {
  3328.                     printf("[TLS - Dummy Connected]\r\n");
  3329.                 }
  3330.                 debug(F110,"ck_tn_tls_negotiate","[TLS - Dummy Connected]",0);
  3331.                 accept_complete = 1;
  3332.                 auth_finished(AUTH_REJECT);
  3333.                 return 0;
  3334.             }
  3335.  
  3336.             if (SSL_accept(tls_con) <= 0) {
  3337.                 char errbuf[1024];
  3338.  
  3339.                 sprintf(errbuf,"[TLS - SSL_accept error: %s",
  3340.                          ERR_error_string(ERR_get_error(),NULL));
  3341.  
  3342.                 if (tn_deb || debses)
  3343.                     tn_debug(errbuf);
  3344.                 else if ( ssl_debug_flag )
  3345.                     printf("%s\r\n",errbuf);
  3346.                 else if ( ssl_verbose_flag )
  3347.                     printf("[TLS - SSL_accept error]\r\n");
  3348.  
  3349.                 debug(F110,"ck_tn_tls_negotiate",errbuf,0);
  3350.                 auth_finished(AUTH_REJECT);
  3351.                 return -1;
  3352.             }
  3353.  
  3354.             if (tn_deb || debses)
  3355.                 tn_debug("[TLS - OK]");
  3356.             else if ( ssl_verbose_flag ) {
  3357.                 printf("[TLS - OK]\r\n");
  3358.             }
  3359.  
  3360.             debug(F110,"ck_tn_tls_negotiate","[TLS - OK]",0);
  3361.             tls_active_flag = 1;
  3362.             ssl_display_connect_details(tls_con,1,ssl_verbose_flag);
  3363.  
  3364.  
  3365. #ifdef SSL_KRB5
  3366.             if ( tls_is_krb5(0) ) {
  3367.                 if (tls_con->kssl_ctx->client_princ) {
  3368.                     char *p;
  3369.                     ckstrncpy(szUserNameAuthenticated,
  3370.                                tls_con->kssl_ctx->client_princ,
  3371.                                UIDBUFLEN);
  3372.                     ckstrncpy(szUserNameRequested,
  3373.                                tls_con->kssl_ctx->client_princ,
  3374.                                UIDBUFLEN);
  3375.                     for ( p = szUserNameRequested; *p ; p++ ) {
  3376.                         if ( *p == '@' || *p == '/' ) {
  3377.                             *p = '\0';
  3378.                             break;
  3379.                         }
  3380.                     }
  3381.                 } else {
  3382.                     szUserNameRequested[0] = '\0';
  3383.                     szUserNameAuthenticated[0] = '\0';
  3384.                 }
  3385. #ifdef CK_LOGIN
  3386.                 if (zvuser(szUserNameRequested))
  3387.                     auth_finished(AUTH_VALID);
  3388.                 else
  3389. #endif /* CK_LOGIN */
  3390.                     auth_finished(AUTH_USER);
  3391.             } else
  3392. #endif /* SSL_KRB5 */
  3393.             {
  3394.             /* now check to see that we got exactly what we
  3395.             * wanted from the caller ... if a certificate is
  3396.             * required then we make 100% sure that we were
  3397.             * given one during the handshake (as it is an optional
  3398.             * part of TLS)
  3399.             */
  3400.             peer=SSL_get_peer_certificate(tls_con);
  3401.             if (peer == NULL) {
  3402.                 debug(F100,"SSL_get_peer_certificate() == NULL","",0);
  3403.                 auth_finished(AUTH_REJECT);
  3404.                 if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
  3405.                     if (tn_deb || debses)
  3406.                         tn_debug("[TLS - peer check failed]");
  3407.                     else if (ssl_debug_flag) {
  3408.                         printf("[TLS - peer check failed]\r\n");
  3409.                     }
  3410.                     debug(F110,
  3411.                            "ck_tn_tls_negotiate",
  3412.                            "[TLS - peer check failed]",
  3413.                            0
  3414.                            );
  3415.                     /* LOGGING REQUIRED HERE! */
  3416.                     return -1;
  3417.                 }
  3418.             } else {
  3419.                 debug(F100,"SSL_get_peer_certificate() != NULL","",0);
  3420.                 X509_NAME_get_text_by_NID(X509_get_subject_name(peer),
  3421.                                            NID_commonName,str,
  3422.                                            256
  3423.                                            );
  3424.                 if ( ssl_verbose_flag )
  3425.                     printf("[TLS - commonName=%s]\r\n",str);
  3426.  
  3427.                 X509_NAME_get_text_by_NID(X509_get_subject_name(peer),
  3428. #ifndef NID_x500UniqueIdentifier
  3429.                                            NID_uniqueIdentifier,
  3430. #else
  3431.                                            NID_x500UniqueIdentifier,
  3432. #endif
  3433.                                            str,
  3434.                                            256
  3435.                                            );
  3436.                 if ( ssl_verbose_flag )
  3437.                     printf("[TLS - uniqueIdentifier=%s]\r\n",str);
  3438.  
  3439.                 /* Try to determine user name */
  3440.                 uid = tls_userid_from_client_cert(tls_con);
  3441.                 if ( uid ) {
  3442.                     /* This code is very questionable.
  3443.                      * How should it behave?
  3444.                      * The client has presented a certificate that
  3445.                      * contains a username.  We have validated the
  3446.                      * certificate but we do not automatically
  3447.                      * log the user in unless there is a .tlslogin
  3448.                      * file.
  3449.                      */
  3450.  
  3451.                     ckstrncpy(szUserNameRequested,uid,UIDBUFLEN);
  3452. #ifdef CK_LOGIN
  3453.                     if (zvuser(uid))
  3454.                         auth_finished(AUTH_VALID);
  3455.                     else
  3456. #endif /* CK_LOGIN */
  3457.                         auth_finished(AUTH_USER);
  3458.                 }
  3459.                 else {
  3460.                     szUserNameRequested[0] = '\0';
  3461.                     auth_finished(AUTH_REJECT);
  3462.                 }
  3463.             }
  3464.             }
  3465.         }
  3466.     } else {
  3467.         char * str=NULL;
  3468.  
  3469.         if (tn_deb || debses)
  3470.             tn_debug("[TLS - handshake starting]");
  3471.         else if ( ssl_verbose_flag )
  3472.             printf("[TLS - handshake starting]\r\n");
  3473.         debug(F110,"ck_tn_tls_negotiate","[TLS - handshake starting]",0);
  3474.  
  3475.         /* right ... now we drop into the SSL library */
  3476.         if (!tls_only_flag) {
  3477.             char *subject=NULL, *issuer=NULL, *commonName=NULL, *dNSName=NULL;
  3478.  
  3479.             if (ssl_dummy_flag) {
  3480.                 if (tn_deb || debses)
  3481.                     tn_debug("[TLS - Dummy Connected]");
  3482.                 else if ( ssl_verbose_flag ) {
  3483.                     printf("[TLS - Dummy Connected]\r\n");
  3484.                 }
  3485.                 debug(F110,"ck_tn_tls_negotiate","[TLS - Dummy Connected]",0);
  3486.                 auth_finished(AUTH_REJECT);
  3487.                 accept_complete = 1;
  3488.                 return 0;
  3489.             }
  3490.  
  3491. #ifndef USE_CERT_CB
  3492.             if (!tls_load_certs(tls_ctx,tls_con,0))
  3493.                 return(-1);
  3494. #endif /* USE_CERT_CB */
  3495.             if (SSL_connect(tls_con) <= 0) {
  3496.                 int len;
  3497.                 if (tn_deb || debses) {
  3498.                     tn_debug("[TLS - FAILED]");
  3499.                     ERR_print_errors(bio_err);
  3500.                     len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  3501.                     ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  3502.                     printf(ssl_err);
  3503.                 } else if ( ssl_verbose_flag ) {
  3504.                     printf("[TLS - FAILED]\r\n");
  3505.                     ERR_print_errors(bio_err);
  3506.                     len = BIO_read(bio_err,ssl_err,SSL_ERR_BFSZ);
  3507.                     ssl_err[len < SSL_ERR_BFSZ ? len : SSL_ERR_BFSZ] = '\0';
  3508.                     printf(ssl_err);
  3509.                 }
  3510.                 debug(F110,"ck_tn_tls_negotiate","[TLS - FAILED]",0);
  3511.                 auth_finished(AUTH_REJECT);
  3512.                 return -1;
  3513.             }
  3514.  
  3515.             tls_active_flag = 1;
  3516.             if ( !ssl_certsok_flag && (ssl_verify_flag & SSL_VERIFY_PEER)
  3517.                  && !tls_is_krb5(0)) {
  3518.                 char prmpt[1024];
  3519.                 subject = ssl_get_subject_name(tls_con);
  3520.  
  3521.                 if (!subject) {
  3522.                     if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
  3523.                     {
  3524.                         if (tn_deb || debses)
  3525.                             tn_debug("[TLS - FAILED]");
  3526.                         else if ( ssl_verbose_flag )
  3527.                             printf("[TLS - FAILED]\r\n");
  3528.                         debug(F110,"ck_tn_tls_negotiate","[TLS - FAILED]",0);
  3529.                         auth_finished(AUTH_REJECT);
  3530.                         return -1;
  3531.                     } else {
  3532.                         int ok;
  3533.                         ok = uq_ok("Warning: Server didn't provide a certificate",
  3534.                                    "Continue? (Y/N)", 3, NULL, 0);
  3535.                         if (!ok) {
  3536.                             if (tn_deb || debses)
  3537.                                 tn_debug("[TLS - FAILED]");
  3538.                             else if ( ssl_verbose_flag )
  3539.                                 printf("[TLS - FAILED]\r\n");
  3540.                             debug(F110,
  3541.                                    "ck_tn_tls_negotiate","[TLS - FAILED]",0);
  3542.                             auth_finished(AUTH_REJECT);
  3543.                             return -1;
  3544.                         }
  3545.                     }
  3546.                 } else if (ssl_check_server_name(tls_con, szHostName)) {
  3547.                     if (tn_deb || debses)
  3548.                         tn_debug("[TLS - FAILED]");
  3549.                     else if ( ssl_verbose_flag )
  3550.                         printf("[TLS - FAILED]\r\n");
  3551.                     debug(F110,
  3552.                            "ck_tn_tls_negotiate","[TLS - FAILED]",0);
  3553.                     auth_finished(AUTH_REJECT);
  3554.                     return -1;
  3555.                 }
  3556.             }
  3557.  
  3558.             if ( ssl_debug_flag && ssl_finished_messages) {
  3559.                 char msg[32];
  3560.                 int i, len=32;
  3561.                 extern char tn_msg[], hexbuf[];
  3562.  
  3563.                 tn_msg[0] = '\0';
  3564.                 len = ssl_get_client_finished(msg,len);
  3565.                 if ( len > 0 ) {
  3566.                     for ( i=0;i<len;i++ ) {
  3567.                         sprintf(hexbuf,"%02X ",msg[i]);
  3568.                         ckstrncat(tn_msg,hexbuf,TN_MSG_LEN);
  3569.                     }
  3570.                     printf("TLS client finished: %s\r\n",tn_msg);
  3571.                 }
  3572.                 tn_msg[0] = '\0';
  3573.                 len = ssl_get_server_finished(msg,len);
  3574.                 if ( len > 0 ) {
  3575.                     for ( i=0;i<len;i++ ) {
  3576.                         sprintf(hexbuf,"%02X ",msg[i]);
  3577.                         ckstrncat(tn_msg,hexbuf,TN_MSG_LEN);
  3578.                     }
  3579.                     printf("TLS server finished: %s\r\n",tn_msg);
  3580.                 }
  3581.             }
  3582.  
  3583.             if (tn_deb || debses)
  3584.                 tn_debug("[TLS - OK]");
  3585.             else if ( ssl_verbose_flag )
  3586.                 printf("[TLS - OK]\r\n");
  3587.             debug(F110,"ck_tn_tls_negotiate","[TLS - OK]",0);
  3588.  
  3589.             ssl_display_connect_details(tls_con,0,ssl_verbose_flag);
  3590.         }
  3591.         auth_finished(AUTH_REJECT);
  3592.     }
  3593.     accept_complete = 1;
  3594.     auth_ssl_valid = 1;
  3595.     return(0);
  3596. }
  3597.  
  3598. int
  3599. ck_ssl_incoming(fd) int fd;
  3600. {
  3601.     /* if we are not running in debug then any error
  3602.     * stuff from SSL debug *must* not go down
  3603.     * the socket (which 0,1,2 are all pointing to by
  3604.     * default)
  3605.     */
  3606.  
  3607.     int timo = 2000;
  3608.  
  3609.     if ( !ck_ssleay_is_installed() )
  3610.         return(-1);
  3611.  
  3612.     /* do the SSL stuff now ... before we play with pty's */
  3613.     SSL_set_fd(ssl_con,fd);
  3614.     SSL_set_fd(tls_con,fd);
  3615.  
  3616.     if (tls_only_flag) {
  3617.         if (tn_deb || debses)
  3618.             tn_debug("[TLS - handshake starting]");
  3619.         else if ( ssl_verbose_flag )
  3620.             printf("[TLS - handshake starting]\r\n");
  3621.         debug(F110,"ck_ssl_incoming","[TLS - handshake starting]",0);
  3622.  
  3623.         /* hmm ... only when running talking to things like
  3624.         * https servers should we hit this code and then
  3625.         * we really don't care *who* we talk to :-)
  3626.         */
  3627.         if (SSL_accept(tls_con) <= 0) {
  3628.             char errbuf[1024];
  3629.  
  3630.             sprintf(errbuf,"[TLS - SSL_accept error: %s",
  3631.                      ERR_error_string(ERR_get_error(),NULL));
  3632.  
  3633.             if (tn_deb || debses)
  3634.                 tn_debug(errbuf);
  3635.             else if ( ssl_debug_flag )
  3636.                 printf("%s\r\n",errbuf);
  3637.             else if ( ssl_verbose_flag )
  3638.                 printf("[TLS - SSL_accept error]\r\n");
  3639.  
  3640.             debug(F110,"ck_ssl_incoming",errbuf,0);
  3641.             return(-1);
  3642.         } else {
  3643.             if (tn_deb || debses)
  3644.                 tn_debug("[TLS - OK]");
  3645.             else if ( ssl_verbose_flag )
  3646.                 printf("[TLS - OK]\r\n");
  3647.             debug(F110,"ck_ssl_incoming","[TLS - OK]",0);
  3648.             tls_active_flag = 1;
  3649.         }
  3650.     } else if (ssl_only_flag) {
  3651.         if (tn_deb || debses)
  3652.             tn_debug("[SSL - handshake starting]");
  3653.         else if ( ssl_verbose_flag )
  3654.             printf("[SSL - handshake starting]\r\n");
  3655.         debug(F110,"ck_ssl_incoming","[SSL - handshake starting]",0);
  3656.  
  3657.         /* hmm ... only when running talking to things like
  3658.          * https servers should we hit this code and then
  3659.          * we really don't care *who* we talk to :-)
  3660.          */
  3661.         if (SSL_accept(ssl_con) <= 0) {
  3662.             char errbuf[1024];
  3663.  
  3664.             sprintf(errbuf,"[SSL - SSL_accept error: %s",
  3665.                      ERR_error_string(ERR_get_error(),NULL));
  3666.  
  3667.             if (tn_deb || debses)
  3668.                 tn_debug(errbuf);
  3669.             else if ( ssl_debug_flag )
  3670.                 printf("%s\r\n",errbuf);
  3671.             else if ( ssl_verbose_flag )
  3672.                 printf("[SSL - SSL_accept error]\r\n");
  3673.  
  3674.             debug(F110,"ck_ssl_incoming",errbuf,0);
  3675.             return(-1);
  3676.         } else {
  3677.             if (tn_deb || debses)
  3678.                 tn_debug("[SSL - OK]");
  3679.             else if ( ssl_verbose_flag )
  3680.             printf("[SSL - OK]\r\n");
  3681.             debug(F110,"ssl_is","[SSL - OK]",0);
  3682.             ssl_active_flag = 1;
  3683.         }
  3684.     }
  3685.     if (ssl_active_flag || tls_active_flag) {
  3686.         X509 *peer;
  3687.         char str[256], *uid=NULL;
  3688.  
  3689.         /* now check to see that we got exactly what we
  3690.          * wanted from the caller ... if a certificate is
  3691.          * required then we make 100% sure that we were
  3692.          * given on during the handshake (as it is an optional
  3693.          * part of SSL and TLS)
  3694.          */
  3695.  
  3696.         if ( tls_active_flag ) {
  3697.             peer=SSL_get_peer_certificate(tls_con);
  3698.         } else if ( ssl_active_flag ) {
  3699.             peer=SSL_get_peer_certificate(ssl_con);
  3700.         }
  3701.  
  3702.         if (peer == NULL) {
  3703.             debug(F100,"SSL_get_peer_certificate() == NULL","",0);
  3704.             auth_finished(AUTH_REJECT);
  3705.  
  3706.             if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
  3707.                 if (tn_deb || debses)
  3708.                     tn_debug("[SSL/TLS - peer check failed]");
  3709.                 else if (ssl_debug_flag) {
  3710.                     printf("[SSL/TLS - peer check failed]\r\n");
  3711.                 }
  3712.                 debug(F110,
  3713.                        "ck_tn_tls_negotiate",
  3714.                        "[SSL/TLS - peer check failed]",
  3715.                        0
  3716.                        );
  3717.                 /* LOGGING REQUIRED HERE! */
  3718.                 return -1;
  3719.             }
  3720.  
  3721.         } else {
  3722.             debug(F100,"SSL_get_peer_certificate() != NULL","",0);
  3723.             X509_NAME_get_text_by_NID(X509_get_subject_name(peer),
  3724.                                        NID_commonName,str,
  3725.                                        256
  3726.                                        );
  3727.             printf("[TLS - commonName=%s]\r\n",str);
  3728.  
  3729.             X509_NAME_get_text_by_NID(X509_get_subject_name(peer),
  3730. #ifndef NID_x500UniqueIdentifier
  3731.                                        NID_uniqueIdentifier,
  3732. #else   
  3733.                                        NID_x500UniqueIdentifier,
  3734. #endif
  3735.                                        str,256
  3736.                                        );
  3737.             printf("[TLS - uniqueIdentifier=%s]\r\n",str);
  3738.  
  3739.             /* Try to determine user name */
  3740.             uid = tls_userid_from_client_cert(tls_con);
  3741.             if ( uid ) {
  3742.                 /* This code is very questionable.
  3743.                 * How should it behave?
  3744.                 * The client has presented a certificate that
  3745.                 * contains a username.  We have validated the
  3746.                 * certificate but we do not automatically
  3747.                 * log the user in unless there is a .tlslogin
  3748.                 * file.
  3749.                 */
  3750.  
  3751.                 ckstrncpy(szUserNameRequested,uid,UIDBUFLEN);
  3752. #ifdef CK_LOGIN
  3753.                 if (zvuser(uid))
  3754.                     auth_finished(AUTH_VALID);
  3755.                 else
  3756. #endif /* CK_LOGIN */
  3757.                     auth_finished(AUTH_USER);
  3758.             }
  3759.             else {
  3760.                 szUserNameRequested[0] = '\0';
  3761.                 auth_finished(AUTH_REJECT);
  3762.             }
  3763.         }
  3764.     }
  3765.     return(0);  /* success */
  3766. }
  3767.  
  3768. int
  3769. ck_ssl_outgoing(fd) int fd;
  3770. {
  3771.     int timo = 2000;
  3772.  
  3773.     if ( !ck_ssleay_is_installed() )
  3774.         return(-1);
  3775.  
  3776.     /* bind in the network descriptor */
  3777.     SSL_set_fd(ssl_con,fd);
  3778.     SSL_set_fd(tls_con,fd);
  3779.  
  3780.     /* If we are doing raw TLS then start it now ... */
  3781.     if (tls_only_flag) {
  3782. #ifndef USE_CERT_CB
  3783.         if (!tls_load_certs(tls_ctx,tls_con,0)) {
  3784.             debug(F110,"ck_ssl_outgoing","tls_load_certs() failed",0);
  3785.             return(-1);
  3786.         }
  3787. #endif /* USE_CERT_CB */
  3788.         if (tn_deb || debses)
  3789.             tn_debug("[TLS - handshake starting]");
  3790.         else if (ssl_verbose_flag)
  3791.             printf("[TLS - handshake starting]\r\n");
  3792.         debug(F110,"ck_ssl_outgoing","[TLS - handshake starting]",0);
  3793.         if (SSL_connect(tls_con) <= 0) {
  3794.             char errbuf[1024];
  3795.  
  3796.             sprintf(errbuf,"[TLS - SSL_connect error: %s",
  3797.                      ERR_error_string(ERR_get_error(),NULL));
  3798.  
  3799.             if (tn_deb || debses)
  3800.                 tn_debug(errbuf);
  3801.             else if ( ssl_debug_flag )
  3802.                 printf("%s\r\n",errbuf);
  3803.  
  3804.             if (tn_deb || debses)
  3805.                 tn_debug("[TLS - FAILED]");
  3806.             else if ( ssl_verbose_flag )
  3807.                 printf("[TLS - FAILED]\r\n");
  3808.             debug(F110,"ck_ssl_outgoing","[TLS - FAILED]",0);
  3809.             netclos();
  3810.             return(-1);
  3811.         } else {
  3812.             tls_active_flag = 1;
  3813.             if ( !ssl_certsok_flag && (ssl_verify_flag & SSL_VERIFY_PEER) && 
  3814.                  !tls_is_krb5(0) ) {
  3815.                 char *subject = ssl_get_subject_name(tls_con);
  3816.  
  3817.                 if (!subject) {
  3818.                     if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
  3819.                     {
  3820.                         if (tn_deb || debses)
  3821.                             tn_debug("[TLS - FAILED]");
  3822.                         else if ( ssl_verbose_flag )
  3823.                             printf("[TLS - FAILED]\r\n");
  3824.                         debug(F110,"ck_tn_tls_negotiate","[TLS - FAILED]",0);
  3825.  
  3826.                         auth_finished(AUTH_REJECT);
  3827.                         return -1;
  3828.                     } else {
  3829.                         char prmpt[1024];
  3830.                         int ok;
  3831.                         ok = uq_ok("Warning: Server didn't provide a certificate",
  3832.                                    "Continue? (Y/N)", 3, NULL, 0);
  3833.                         if (!ok) {
  3834.                             if (tn_deb || debses)
  3835.                                 tn_debug("[TLS - FAILED]");
  3836.                             else if ( ssl_verbose_flag )
  3837.                                 printf("[TLS - FAILED]\r\n");
  3838.                             debug(F110,
  3839.                                    "ck_tn_tls_negotiate","[TLS - FAILED]",0);
  3840.                             auth_finished(AUTH_REJECT);
  3841.                             return -1;
  3842.                         }
  3843.                     }
  3844.                 } else if (ssl_check_server_name(tls_con, szHostName)) {
  3845.                     if (tn_deb || debses)
  3846.                         tn_debug("[TLS - FAILED]");
  3847.                     else if ( ssl_verbose_flag )
  3848.                         printf("[TLS - FAILED]\r\n");
  3849.                     debug(F110,
  3850.                            "ck_tn_tls_negotiate","[TLS - FAILED]",0);
  3851.                     auth_finished(AUTH_REJECT);
  3852.                     return -1;
  3853.                 }
  3854.             }
  3855.  
  3856.             if (tn_deb || debses)
  3857.                 tn_debug("[TLS - OK]");
  3858.             else if (!quiet)
  3859.         printf("[TLS - OK]\r\n");
  3860.             debug(F110,"ck_ssl_outgoing","[TLS - OK]",0);
  3861.             ssl_display_connect_details(tls_con,0,ssl_verbose_flag);
  3862.         }
  3863.     }
  3864.     /* if we are doing raw SSL then start it now ... */
  3865.     else if (ssl_only_flag) {
  3866. #ifndef USE_CERT_CB
  3867.         if (!tls_load_certs(ssl_ctx,ssl_con,0))
  3868.             return(-1);
  3869. #endif /* USE_CERT_CB */
  3870.         if (tn_deb || debses)
  3871.             tn_debug("[SSL - handshake starting]");
  3872.         else if ( ssl_verbose_flag )
  3873.             printf("[SSL - handshake starting]\r\n");
  3874.         debug(F110,"ck_ssl_outgoing","[SSL - handshake starting]",0);
  3875.         if (SSL_connect(ssl_con) <= 0) {
  3876.             if ( ssl_debug_flag ) {
  3877.                 char errbuf[1024];
  3878.  
  3879.                 sprintf(errbuf,"[SSL - SSL_connect error: %s",
  3880.                          ERR_error_string(ERR_get_error(),NULL));
  3881.                 printf("%s\r\n",errbuf);
  3882.             }
  3883.             if (tn_deb || debses)
  3884.                 tn_debug("[SSL - FAILED]");
  3885.             else if ( ssl_verbose_flag )
  3886.                 printf("[SSL - FAILED]\r\n");
  3887.             debug(F110,"ck_ssl_outgoing","[SSL - FAILED]",0);
  3888.             return(-1);
  3889.         } else {
  3890.             ssl_active_flag = 1;
  3891.  
  3892.             if ( !ssl_certsok_flag && (ssl_verify_flag & SSL_VERIFY_PEER) &&
  3893.                  !tls_is_krb5(0)) {
  3894.                 char *subject = ssl_get_subject_name(ssl_con);
  3895.  
  3896.                 if (!subject) {
  3897.                     if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
  3898.                     {
  3899.                         if (tn_deb || debses)
  3900.                             tn_debug("[SSL - FAILED]");
  3901.                         else if ( ssl_verbose_flag )
  3902.                             printf("[SSL - FAILED]\r\n");
  3903.                         debug(F110,"ck_tn_tls_negotiate","[SSL - FAILED]",0);
  3904.  
  3905.                         auth_finished(AUTH_REJECT);
  3906.                         return -1;
  3907.                     } else {
  3908.                         char prmpt[1024];
  3909.                         int ok;
  3910.                         ok = uq_ok("Warning: Server didn't provide a certificate",
  3911.                                    "Continue? (Y/N)", 3, NULL, 0);
  3912.                         if (!ok) {
  3913.                             if (tn_deb || debses)
  3914.                                 tn_debug("[SSL - FAILED]");
  3915.                             else if ( ssl_verbose_flag )
  3916.                                 printf("[SSL - FAILED]\r\n");
  3917.                             debug(F110,
  3918.                                    "ck_tn_tls_negotiate","[SSL - FAILED]",0);
  3919.                             auth_finished(AUTH_REJECT);
  3920.                             return -1;
  3921.                         }
  3922.                     }
  3923.                 } else if (ssl_check_server_name(ssl_con, szHostName)) {
  3924.                     if (tn_deb || debses)
  3925.                         tn_debug("[SSL - FAILED]");
  3926.                     else if ( ssl_verbose_flag )
  3927.                         printf("[SSL - FAILED]\r\n");
  3928.                     debug(F110, "ck_tn_tls_negotiate","[SSL - FAILED]",0);
  3929.                     auth_finished(AUTH_REJECT);
  3930.                     return -1;
  3931.                 }
  3932.             }
  3933.  
  3934.             if (tn_deb || debses)
  3935.                 tn_debug("[SSL - OK]");
  3936.         else if (!quiet)
  3937.             printf("[SSL - OK]\r\n");
  3938.             debug(F110,"ck_ssl_outgoing","[SSL - OK]",0);
  3939.             ssl_display_connect_details(ssl_con,0,ssl_verbose_flag);
  3940.         }
  3941.     }
  3942.     return(0);  /* success */
  3943. }
  3944.  
  3945. #ifndef NOHTTP
  3946. int
  3947. ck_ssl_http_client(fd, hostname) int fd; char * hostname;
  3948. {
  3949.     int timo = 2000;
  3950.  
  3951.     if ( !ck_ssleay_is_installed() )
  3952.         return(-1);
  3953.  
  3954.     /* bind in the network descriptor */
  3955.     SSL_set_fd(tls_http_con,fd);
  3956.  
  3957.     /* If we are doing raw TLS then start it now ... */
  3958.     if (1) {
  3959. #ifndef USE_CERT_CB
  3960.         if (!tls_load_certs(tls_http_ctx,tls_http_con,0)) {
  3961.             debug(F110,"ck_ssl_http_client","tls_load_certs() failed",0);
  3962.             return(-1);
  3963.         }
  3964. #endif /* USE_CERT_CB */
  3965.         if (tn_deb || debses)
  3966.             tn_debug("[TLS - handshake starting]");
  3967.         else if (ssl_verbose_flag)
  3968.             printf("[TLS - handshake starting]\r\n");
  3969.         debug(F110,"ck_ssl_outgoing","[TLS - handshake starting]",0);
  3970.         if (SSL_connect(tls_http_con) <= 0) {
  3971.             char errbuf[1024];
  3972.  
  3973.             sprintf(errbuf,"[TLS - SSL_connect error: %s",
  3974.                      ERR_error_string(ERR_get_error(),NULL));
  3975.  
  3976.             if (tn_deb || debses)
  3977.                 tn_debug(errbuf);
  3978.             else if ( ssl_debug_flag )
  3979.                 printf("%s\r\n",errbuf);
  3980.  
  3981.             if (tn_deb || debses)
  3982.                 tn_debug("[TLS - FAILED]");
  3983.             else if ( ssl_verbose_flag )
  3984.                 printf("[TLS - FAILED]\r\n");
  3985.             debug(F110,"ck_ssl_http_client","[TLS - FAILED]",0);
  3986.             http_close();
  3987.             return(-1);
  3988.         } else {
  3989.             tls_http_active_flag = 1;
  3990.             if ( !ssl_certsok_flag && (ssl_verify_flag & SSL_VERIFY_PEER) &&
  3991.                  !tls_is_krb5(3) ) {
  3992.                 char *subject = ssl_get_subject_name(tls_http_con);
  3993.  
  3994.                 if (!subject) {
  3995.                     if (ssl_verify_flag & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
  3996.                     {
  3997.                         if (tn_deb || debses)
  3998.                             tn_debug("[TLS - FAILED]");
  3999.                         else if ( ssl_verbose_flag )
  4000.                             printf("[TLS - FAILED]\r\n");
  4001.                         debug(F110,"ck_tn_tls_negotiate","[TLS - FAILED]",0);
  4002.                         return -1;
  4003.                     } else {
  4004.                         char prmpt[1024];
  4005.                         int ok;
  4006.                         ok = uq_ok("Warning: Server didn't provide a certificate",
  4007.                                    "Continue? (Y/N)", 3, NULL, 0);
  4008.                         if (!ok) {
  4009.                             if (tn_deb || debses)
  4010.                                 tn_debug("[TLS - FAILED]");
  4011.                             else if ( ssl_verbose_flag )
  4012.                                 printf("[TLS - FAILED]\r\n");
  4013.                             debug(F110,
  4014.                                    "ck_tn_tls_negotiate","[TLS - FAILED]",0);
  4015.                             return -1;
  4016.                         }
  4017.                     }
  4018.                 } else if (ssl_check_server_name(tls_http_con, hostname)) {
  4019.                     if (tn_deb || debses)
  4020.                         tn_debug("[TLS - FAILED]");
  4021.                     else if ( ssl_verbose_flag )
  4022.                         printf("[TLS - FAILED]\r\n");
  4023.                     debug(F110,
  4024.                            "ck_tn_tls_negotiate","[TLS - FAILED]",0);
  4025.                     return -1;
  4026.                 }
  4027.             }
  4028.  
  4029.             printf("[TLS - OK]\r\n");
  4030.             if (tn_deb || debses)
  4031.                 tn_debug("[TLS - OK]");
  4032.             debug(F110,"ck_ssl_outgoing","[TLS - OK]",0);
  4033.             ssl_display_connect_details(tls_http_con,0,ssl_verbose_flag);
  4034.         }
  4035.     }
  4036.     return(0);  /* success */
  4037. }
  4038. #endif /* NOHTTP */
  4039. int
  4040. ck_ssl_renegotiate_ciphers()
  4041. {
  4042.  
  4043.     if ( !ck_ssleay_is_installed() )
  4044.         return(0);
  4045.  
  4046.     if ( !sstelnet )
  4047.         return(0);
  4048.  
  4049.     if ( ssl_active_flag )
  4050.         return SSL_renegotiate(ssl_con);
  4051.     else if ( tls_active_flag )
  4052.         return SSL_renegotiate(tls_con);
  4053.     return(0);
  4054. }
  4055.  
  4056. #ifdef NT
  4057. int 
  4058. ck_X509_save_cert_to_user_store(X509 *cert)
  4059. {
  4060. #ifdef X509V3_EXT_DUMP_UNKNOWN
  4061.     char path[CKMAXPATH];
  4062.     char hash[16];
  4063.     char * GetAppData(int);
  4064.     BIO * out=NULL;
  4065.  
  4066.     if ( cert == NULL )
  4067.         return(0);
  4068.  
  4069.     sprintf(hash,"%08lx",X509_subject_name_hash(cert));
  4070.     ckmakmsg(path,CKMAXPATH,GetAppData(0),"kermit 95/certs/",
  4071.              hash,".0");
  4072.  
  4073.     
  4074.     out=BIO_new(BIO_s_file());
  4075.     if (out == NULL)
  4076.     {
  4077.         ERR_print_errors(bio_err);
  4078.         return(0);
  4079.     }
  4080.     if (BIO_write_filename(out,path) <= 0) {
  4081.         perror(path);
  4082.         return(0);
  4083.     }
  4084.  
  4085.     X509_print_ex(out, cert, XN_FLAG_SEP_MULTILINE, X509V3_EXT_DUMP_UNKNOWN);
  4086.     if (!PEM_write_bio_X509(out,cert)) {
  4087.         BIO_printf(bio_err,"unable to write certificate\n");
  4088.         ERR_print_errors(bio_err);
  4089.         BIO_free_all(out);
  4090.         return(0);
  4091.     }
  4092.     BIO_free_all(out);
  4093.     return(1);
  4094. #else /* X509V3_EXT_DUMP_UNKNOWN */
  4095.     return(0);
  4096. #endif /* X509V3_EXT_DUMP_UNKNOWN */
  4097. }
  4098. #endif /* NT */
  4099.  
  4100. #ifndef OS2
  4101. /* The following function should be replaced by institution specific */
  4102. /* code that will convert an X509 cert structure to a userid for the */
  4103. /* purposes of client to host login.  The example code included      */
  4104. /* simply returns the UID field of the Subject if it exists.         */
  4105.  
  4106. /* X509_to_user() returns 0 if valid userid in 'userid', else -1 */
  4107. int
  4108. X509_to_user(X509 *peer_cert, char *userid, int len)
  4109. {
  4110. #ifdef X509_UID_TO_USER
  4111.     /* BEGIN EXAMPLE */
  4112.     int err;
  4113.  
  4114.     if (!(peer_cert && userid) || len <= 0)
  4115.         return -1;
  4116.  
  4117.     userid[0] = '\0';
  4118.     debug(F110,"X509_to_user() subject",
  4119.            X509_NAME_oneline(X509_get_subject_name(peer_cert),NULL,0),0);
  4120.  
  4121.     /* userid is in cert subject /UID */
  4122.     err = X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert),
  4123. #ifndef NID_x500UniqueIdentifier
  4124.                                      NID_uniqueIdentifier,
  4125. #else
  4126.                                      NID_x500UniqueIdentifier,
  4127. #endif
  4128.                                      userid, len);
  4129.  
  4130.     debug(F111,"X509_to_user() userid",userid,err);
  4131.     if (err > 0)
  4132.         return 0;
  4133.  
  4134.     /* END EXAMPLE */
  4135. #else /* X509_UID_TO_USER */
  4136. #ifdef X509_SUBJECT_ALT_NAME_TO_USER
  4137.     /* BEGIN EXAMPLE */
  4138.     int i;
  4139.     X509_EXTENSION *ext = NULL;
  4140.     STACK_OF(GENERAL_NAME) *ialt = NULL;
  4141.     GENERAL_NAME *gen = NULL;
  4142.     char email[256];
  4143.  
  4144.     if (!(peer_cert && userid) || len <= 0)
  4145.         return -1;
  4146.  
  4147.     userid[0] = '\0';
  4148.     email[0] = '\0';
  4149.     debug(F110,"X509_to_user() subject",
  4150.            X509_NAME_oneline(X509_get_subject_name(peer_cert),NULL,0),0);
  4151.  
  4152.     if ((i = X509_get_ext_by_NID(peer_cert, NID_subject_alt_name, -1))<0)
  4153.         return -1;
  4154.     if (!(ext = X509_get_ext(peer_cert, i)))
  4155.         return -1;
  4156.     X509V3_add_standard_extensions();
  4157.     if (!(ialt = X509V3_EXT_d2i(ext)))
  4158.         return -1;
  4159.     for (i = 0; i < sk_GENERAL_NAME_num(ialt); i++) {
  4160.         gen = sk_GENERAL_NAME_value(ialt, i);
  4161.         if (gen->type == GEN_DNS) {
  4162.             if(!gen->d.ia5 || !gen->d.ia5->length)
  4163.                 break;
  4164.             if ( gen->d.ia5->length + 1 > sizeof(email) ) {
  4165.                 goto cleanup;
  4166.             }
  4167.             memcpy(email, gen->d.ia5->data, gen->d.ia5->length);
  4168.             email[gen->d.ia5->length] = 0;
  4169.             break;
  4170.         }
  4171.     }
  4172.   cleanup:
  4173.     X509V3_EXT_cleanup();
  4174.     if (ialt)
  4175.         sk_GENERAL_NAME_free(ialt);
  4176.  
  4177.     debug(F110,"X509_to_user() email",email,0);
  4178.  
  4179.     if ( email[0] ) {
  4180.         char * domain = NULL;
  4181.  
  4182.         /* Find domain */
  4183.         for ( i=0 ; email[i] ; i++ ) {
  4184.             if ( email[i] == '@' ) {
  4185.                 email[i] = '\0';
  4186.                 domain = &email[i+1];
  4187.                 break;
  4188.             }
  4189.         }
  4190.  
  4191.         if ( domain ) {
  4192.             /* XXX - Put code to Verify domain here */
  4193.  
  4194.             if ( /* domain is okay */ 1 )
  4195.                 ckstrncpy(userid,email,len);
  4196.         }
  4197.     }
  4198.  
  4199.     return(userid[0] ? 0 : -1);
  4200.     /* END EXAMPLE */
  4201. #endif /* X509_SUBJECT_ALT_NAME_TO_USER */
  4202. #endif /* X509_UID_TO_USER */
  4203.     return -1;
  4204. }
  4205.  
  4206. /* The following function should be replaced by institution specific */
  4207. /* code that will determine whether or not the combination of the    */
  4208. /* provided X509 certificate and username is valid for automatic     */
  4209. /* login.   Whereas X509_to_user() is used to provide authentication */
  4210. /* of the user, the X509_userok() function is used to provide        */
  4211. /* authorization.  The certificate passed into X509_userok() does    */
  4212. /* need to map to a userid; nor would the userid it would map to     */
  4213. /* need to match the userid provided to the function.  There are     */
  4214. /* numerous circumstances in which it is beneficial to have the ability */
  4215. /* for multiple users to gain access to a common account such as     */
  4216. /* 'root' on Unix; or a class account on a web server.  In Unix we   */
  4217. /* implement this capability with the ~userid/.tlslogin file which   */
  4218. /* a list of X509 certificates which may be used to access the       */
  4219. /* account 'userid'.                                                 */
  4220.  
  4221. /* X509_to_user() returns 0 if access is denied; 1 is access is permitted */
  4222. int
  4223. X509_userok(X509 * peer_cert, const char * userid)
  4224. {
  4225. #ifndef VMS
  4226.     /* check if clients cert is in "user"'s ~/.tlslogin file */
  4227.     char buf[512];
  4228.     int r = 0;
  4229.     FILE *fp;
  4230.     struct passwd *pwd;
  4231.     X509 *file_cert;
  4232.  
  4233.     if ( peer_cert == NULL )
  4234.         return(0);
  4235.  
  4236.     if (!(pwd = getpwnam(userid)))
  4237.        return 0;
  4238.     if (strlen(pwd->pw_dir) > 500)
  4239.        return(0);
  4240.     sprintf(buf, "%s/.tlslogin", pwd->pw_dir);
  4241.  
  4242.     if (!(fp = fopen(buf, "r")))
  4243.         return 0;
  4244.     while (!r && (file_cert = PEM_read_X509(fp, NULL, NULL, NULL))) {
  4245.         if (!ASN1_STRING_cmp(peer_cert->signature, file_cert->signature))
  4246.             r = 1;
  4247.         X509_free(file_cert);
  4248.     }
  4249.     fclose(fp);
  4250.     return(r);
  4251. #else /* VMS */
  4252.     /* Need to implement an appropriate function for VMS */
  4253.     return(0);
  4254. #endif /* VMS */
  4255. }
  4256. #endif /* OS2 */
  4257. #endif /* CK_SSL */
  4258.