void initAuthenticated (
std::string key_file, std::string cert_file, std::string chain_file)
{
initCommon ();
SSL_CTX* const ssl = m_context.native_handle ();
bool cert_set = false;
if (! cert_file.empty ())
{
boost::system::error_code error;
m_context.use_certificate_file (
cert_file, boost::asio::ssl::context::pem, error);
if (error)
{
beast::FatalError ("Problem with SSL certificate file.",
__FILE__, __LINE__);
}
cert_set = true;
}
if (! chain_file.empty ())
{
// VFALCO Replace fopen() with RAII
FILE* f = fopen (chain_file.c_str (), "r");
if (!f)
{
beast::FatalError ("Problem opening SSL chain file.",
__FILE__, __LINE__);
}
try
{
for (;;)
{
X509* const x = PEM_read_X509 (f, NULL, NULL, NULL);
if (x == nullptr)
break;
if (! cert_set)
{
if (SSL_CTX_use_certificate (ssl, x) != 1)
beast::FatalError ("Problem retrieving SSL certificate from chain file.",
__FILE__, __LINE__);
cert_set = true;
}
else if (SSL_CTX_add_extra_chain_cert (ssl, x) != 1)
{
X509_free (x);
beast::FatalError ("Problem adding SSL chain certificate.",
__FILE__, __LINE__);
}
}
fclose (f);
}
catch (...)
{
fclose (f);
beast::FatalError ("Reading the SSL chain file generated an exception.",
__FILE__, __LINE__);
}
}
if (! key_file.empty ())
{
boost::system::error_code error;
m_context.use_private_key_file (key_file,
boost::asio::ssl::context::pem, error);
if (error)
{
beast::FatalError ("Problem using the SSL private key file.",
__FILE__, __LINE__);
}
}
if (SSL_CTX_check_private_key (ssl) != 1)
{
beast::FatalError ("Invalid key in SSL private key file.",
__FILE__, __LINE__);
}
}
bool
SslContextInitializer::InitServer(boost::asio::ssl::context& context, std::shared_ptr<SSLCertificate> certificate, String ip_address, int port)
{
if (!certificate)
{
String errorMessage = Formatter::Format("Error initializing SSL. Certificate not set. Address: {0}, Port: {1}", ip_address, port);
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
SetContextOptions_(context);
EnableEllipticCurveCrypto_(context);
if (!SetCipherList_(context))
return false;
try
{
String bin_directory = Utilities::GetBinDirectory();
String dh2048_file = FileUtilities::Combine(bin_directory, "dh2048.pem");
if (FileUtilities::Exists(dh2048_file))
{
context.use_tmp_dh_file(AnsiString(dh2048_file));
}
else
{
ErrorManager::Instance()->ReportError(ErrorManager::Critical, 5603, "SslContextInitializer::InitServer", Formatter::Format("Unable to enable Diffie - Hellman key agreement.The required file {0} does not exist.", dh2048_file));
}
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to set SSL context options. Address: %s, Port: %i, Error: %s"),
String(ip_address).c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
AnsiString certificateFile = certificate->GetCertificateFile();
AnsiString privateKeyFile = certificate->GetPrivateKeyFile();
try
{
context.use_certificate_file(certificateFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile).c_str(), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.use_certificate_chain_file(certificateFile);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate chain from certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.set_password_callback(std::bind(&SslContextInitializer::GetPassword_));
context.use_private_key_file(privateKeyFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load private key file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(privateKeyFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
catch (...)
{
String errorMessage = "Error initializing SSL";
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
return true;
}
bool
SslContextInitializer::InitServer(boost::asio::ssl::context& context, std::shared_ptr<SSLCertificate> certificate, String ip_address, int port)
{
if (!certificate)
{
String errorMessage = Formatter::Format("Error initializing SSL. Certificate not set. Address: {0}, Port: {1}", ip_address, port);
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.set_options(boost::asio::ssl::context::default_workarounds |
boost::asio::ssl::context::no_sslv2);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to set SSL context options. Address: %s, Port: %i, Error: %s"),
String(ip_address).c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
AnsiString certificateFile = certificate->GetCertificateFile();
AnsiString privateKeyFile = certificate->GetPrivateKeyFile();
try
{
context.use_certificate_file(certificateFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile).c_str(), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.use_certificate_chain_file(certificateFile);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate chain from certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.set_password_callback(std::bind(&SslContextInitializer::GetPassword_));
context.use_private_key_file(privateKeyFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load private key file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(privateKeyFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
catch (...)
{
String errorMessage = "Error initializing SSL";
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
SetCipherList_(context);
return true;
}