void nano::rpc_secure::load_certs (boost::asio::ssl::context & context_a)
{
// This is called if the key is password protected
context_a.set_password_callback (
[this](std::size_t,
boost::asio::ssl::context_base::password_purpose) {
return config.secure.server_key_passphrase;
});
// The following two options disables the session cache and enables stateless session resumption.
// This is necessary because of the way the RPC server abruptly terminate connections.
SSL_CTX_set_session_cache_mode (context_a.native_handle (), SSL_SESS_CACHE_OFF);
SSL_CTX_set_options (context_a.native_handle (), SSL_OP_NO_TICKET);
context_a.set_options (
boost::asio::ssl::context::default_workarounds | boost::asio::ssl::context::no_sslv2 | boost::asio::ssl::context::no_sslv3 | boost::asio::ssl::context::single_dh_use);
context_a.use_certificate_chain_file (config.secure.server_cert_path);
context_a.use_private_key_file (config.secure.server_key_path, boost::asio::ssl::context::pem);
context_a.use_tmp_dh_file (config.secure.server_dh_path);
// Verify client certificates?
if (config.secure.client_certs_path.size () > 0)
{
context_a.set_verify_mode (boost::asio::ssl::verify_fail_if_no_peer_cert | boost::asio::ssl::verify_peer);
context_a.add_verify_path (config.secure.client_certs_path);
context_a.set_verify_callback ([this](auto preverified, auto & ctx) {
return this->on_verify_certificate (preverified, ctx);
});
}
}
void BaseClient::ssl_prepare(boost::asio::ssl::context &ssl_context) const
{
ssl_context.set_password_callback(boost::bind(&BaseClient::get_password,this));
ssl_context.set_verify_mode(boost::asio::ssl::context::verify_peer|boost::asio::ssl::context::verify_fail_if_no_peer_cert);
ssl_context.load_verify_file(my_certs_name);
ssl_context.use_certificate_chain_file(my_public_cert_name);
ssl_context.use_private_key_file(my_private_key_name, boost::asio::ssl::context::pem);
}
bool
SslContextInitializer::InitServer(boost::asio::ssl::context& context, std::shared_ptr<SSLCertificate> certificate, String ip_address, int port)
{
if (!certificate)
{
String errorMessage = Formatter::Format("Error initializing SSL. Certificate not set. Address: {0}, Port: {1}", ip_address, port);
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
SetContextOptions_(context);
EnableEllipticCurveCrypto_(context);
if (!SetCipherList_(context))
return false;
try
{
String bin_directory = Utilities::GetBinDirectory();
String dh2048_file = FileUtilities::Combine(bin_directory, "dh2048.pem");
if (FileUtilities::Exists(dh2048_file))
{
context.use_tmp_dh_file(AnsiString(dh2048_file));
}
else
{
ErrorManager::Instance()->ReportError(ErrorManager::Critical, 5603, "SslContextInitializer::InitServer", Formatter::Format("Unable to enable Diffie - Hellman key agreement.The required file {0} does not exist.", dh2048_file));
}
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to set SSL context options. Address: %s, Port: %i, Error: %s"),
String(ip_address).c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
AnsiString certificateFile = certificate->GetCertificateFile();
AnsiString privateKeyFile = certificate->GetPrivateKeyFile();
try
{
context.use_certificate_file(certificateFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile).c_str(), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.use_certificate_chain_file(certificateFile);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate chain from certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.set_password_callback(std::bind(&SslContextInitializer::GetPassword_));
context.use_private_key_file(privateKeyFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load private key file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(privateKeyFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
catch (...)
{
String errorMessage = "Error initializing SSL";
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
return true;
}
bool
SslContextInitializer::InitServer(boost::asio::ssl::context& context, std::shared_ptr<SSLCertificate> certificate, String ip_address, int port)
{
if (!certificate)
{
String errorMessage = Formatter::Format("Error initializing SSL. Certificate not set. Address: {0}, Port: {1}", ip_address, port);
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.set_options(boost::asio::ssl::context::default_workarounds |
boost::asio::ssl::context::no_sslv2);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to set SSL context options. Address: %s, Port: %i, Error: %s"),
String(ip_address).c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
AnsiString certificateFile = certificate->GetCertificateFile();
AnsiString privateKeyFile = certificate->GetPrivateKeyFile();
try
{
context.use_certificate_file(certificateFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile).c_str(), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.use_certificate_chain_file(certificateFile);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate chain from certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.set_password_callback(std::bind(&SslContextInitializer::GetPassword_));
context.use_private_key_file(privateKeyFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load private key file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(privateKeyFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
catch (...)
{
String errorMessage = "Error initializing SSL";
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
SetCipherList_(context);
return true;
}
