5 /* For callbacks generating output, here are their file-descriptors. */
6 static FILE *fp_cb_ssl_info = NULL;
7 static FILE *fp_cb_ssl_verify = NULL;
11 * 1 = minimal, just errors,
12 * 2 = minimal, all steps,
13 * 3 = detail, all steps */
14 static unsigned int cb_ssl_verify_level = 1;
16 /* Other static rubbish (to mirror s_cb.c where required) */
17 static int int_verify_depth = 10;
20 * This function is largely borrowed from the one used in OpenSSL's
21 * "s_client" and "s_server" utilities.
23 void cb_ssl_info(const SSL *s, int where, int ret)
25 const char *str1, *str2;
31 w = where & ~SSL_ST_MASK;
32 str1 = (w & SSL_ST_CONNECT ? "SSL_connect" : (w & SSL_ST_ACCEPT ?
35 SSL_state_string_long(s);
37 if (where & SSL_CB_LOOP)
38 fprintf(fp_cb_ssl_info, "(%s) %s\n", str1, str2);
39 else if (where & SSL_CB_EXIT) {
41 fprintf(fp_cb_ssl_info, "(%s) failed in %s\n", str1, str2);
43 * In a non-blocking model, we get a few of these "error"s simply
44 * because we're calling "reads" and "writes" on the state-machine
45 * that are virtual NOPs simply to avoid wasting the time seeing if
46 * we *should* call them. Removing this case makes the "-out_state"
47 * output a lot easier on the eye.
51 fprintf(fp_cb_ssl_info, "%s:error in %s\n", str1, str2);
56 void cb_ssl_info_set_output(FILE *fp)
61 static const char *int_reason_no_issuer =
62 "X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT";
63 static const char *int_reason_not_yet = "X509_V_ERR_CERT_NOT_YET_VALID";
64 static const char *int_reason_before =
65 "X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD";
66 static const char *int_reason_expired = "X509_V_ERR_CERT_HAS_EXPIRED";
67 static const char *int_reason_after =
68 "X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD";
70 /* Stolen wholesale from apps/s_cb.c :-) And since then, mutilated ... */
71 int cb_ssl_verify(int ok, X509_STORE_CTX *ctx)
73 char buf1[256]; /* Used for the subject name */
74 char buf2[256]; /* Used for the issuer name */
75 const char *reason = NULL; /* Error reason (if any) */
79 if (!fp_cb_ssl_verify || (cb_ssl_verify_level == 0))
81 err_cert = X509_STORE_CTX_get_current_cert(ctx);
82 err = X509_STORE_CTX_get_error(ctx);
83 depth = X509_STORE_CTX_get_error_depth(ctx);
85 buf1[0] = buf2[0] = '\0';
87 X509_NAME_oneline(X509_get_subject_name(err_cert), buf1, 256);
89 X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf2, 256);
91 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
92 reason = int_reason_no_issuer;
94 case X509_V_ERR_CERT_NOT_YET_VALID:
95 reason = int_reason_not_yet;
97 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
98 reason = int_reason_before;
100 case X509_V_ERR_CERT_HAS_EXPIRED:
101 reason = int_reason_expired;
103 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
104 reason = int_reason_after;
108 if ((cb_ssl_verify_level == 1) && ok)
110 fprintf(fp_cb_ssl_verify, "chain-depth=%d, ", depth);
112 fprintf(fp_cb_ssl_verify, "error=%s\n", reason);
114 fprintf(fp_cb_ssl_verify, "error=%d\n", err);
115 if (cb_ssl_verify_level < 3)
117 fprintf(fp_cb_ssl_verify, "--> subject = %s\n", buf1);
118 fprintf(fp_cb_ssl_verify, "--> issuer = %s\n", buf2);
120 fprintf(fp_cb_ssl_verify, "--> verify error:num=%d:%s\n", err,
121 X509_verify_cert_error_string(err));
122 fprintf(fp_cb_ssl_verify, "--> verify return:%d\n", ok);
126 void cb_ssl_verify_set_output(FILE *fp)
128 fp_cb_ssl_verify = fp;
131 void cb_ssl_verify_set_depth(unsigned int verify_depth)
133 int_verify_depth = verify_depth;
136 void cb_ssl_verify_set_level(unsigned int level)
139 cb_ssl_verify_level = level;
142 RSA *cb_generate_tmp_rsa(SSL *s, int is_export, int keylength)
145 * TODO: Perhaps make it so our global key can be generated on-the-fly
146 * after certain intervals?
148 static RSA *rsa_tmp = NULL;
150 rsa_tmp = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
154 #endif /* !defined(NO_OPENSSL) */