Mercurial > hg > freeDiameter
annotate libfdcore/config.c @ 820:0eb64b3a3632
Fix compilation with gnutls < 3.x
author | Sebastien Decugis <sdecugis@freediameter.net> |
---|---|
date | Tue, 11 Sep 2012 20:51:18 +0200 |
parents | c0a88c1bcc1e |
children | d8d0772586ad |
rev | line source |
---|---|
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
1 /********************************************************************************************************* |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
2 * Software License Agreement (BSD License) * |
740
4a9f08d6b6ba
Updated my mail address
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
706
diff
changeset
|
3 * Author: Sebastien Decugis <sdecugis@freediameter.net> * |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
4 * * |
808
c0a88c1bcc1e
Updated copyright information
Sebastien Decugis <sdecugis@freediameter.net>
parents:
807
diff
changeset
|
5 * Copyright (c) 2012, WIDE Project and NICT * |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
6 * All rights reserved. * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
7 * * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
8 * Redistribution and use of this software in source and binary forms, with or without modification, are * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
9 * permitted provided that the following conditions are met: * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
10 * * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
11 * * Redistributions of source code must retain the above * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
12 * copyright notice, this list of conditions and the * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
13 * following disclaimer. * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
14 * * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
15 * * Redistributions in binary form must reproduce the above * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
16 * copyright notice, this list of conditions and the * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
17 * following disclaimer in the documentation and/or other * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
18 * materials provided with the distribution. * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
19 * * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
20 * * Neither the name of the WIDE Project or NICT nor the * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
21 * names of its contributors may be used to endorse or * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
22 * promote products derived from this software without * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
23 * specific prior written permission of WIDE Project and * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
24 * NICT. * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
25 * * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
26 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
27 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
28 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
29 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
30 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
31 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
32 * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
33 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
34 *********************************************************************************************************/ |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
35 |
658
f198d16fa7f4
Initial commit for 1.1.0:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
578
diff
changeset
|
36 #include "fdcore-internal.h" |
304
ad3c46016584
Added install directives for cmake; also allow default directory to seek for extensions and configuration files
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
258
diff
changeset
|
37 #include <sys/stat.h> |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
38 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
39 /* Configuration management */ |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
40 |
18
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
41 #ifndef GNUTLS_DEFAULT_PRIORITY |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
42 # define GNUTLS_DEFAULT_PRIORITY "NORMAL" |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
43 #endif /* GNUTLS_DEFAULT_PRIORITY */ |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
44 #ifndef GNUTLS_DEFAULT_DHBITS |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
45 # define GNUTLS_DEFAULT_DHBITS 1024 |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
46 #endif /* GNUTLS_DEFAULT_DHBITS */ |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
47 |
658
f198d16fa7f4
Initial commit for 1.1.0:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
578
diff
changeset
|
48 /* Initialize the fd_g_config structure to default values -- it should already have been initialized to all-0 */ |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
49 int fd_conf_init() |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
50 { |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
51 TRACE_ENTRY(); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
52 |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
53 fd_g_config->cnf_eyec = EYEC_CONFIG; |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
54 |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
55 fd_g_config->cnf_timer_tc = 30; |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
56 fd_g_config->cnf_timer_tw = 30; |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
57 |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
58 fd_g_config->cnf_port = 3868; |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
59 fd_g_config->cnf_port_tls = 3869; |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
60 fd_g_config->cnf_sctp_str = 30; |
253
ad6c0118fb50
Configurable number of server threads
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
189
diff
changeset
|
61 fd_g_config->cnf_dispthr = 4; |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
62 fd_list_init(&fd_g_config->cnf_endpoints, NULL); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
63 fd_list_init(&fd_g_config->cnf_apps, NULL); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
64 #ifdef DISABLE_SCTP |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
65 fd_g_config->cnf_flags.no_sctp = 1; |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
66 #endif /* DISABLE_SCTP */ |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
67 |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
68 fd_g_config->cnf_orstateid = (uint32_t) time(NULL); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
69 |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
70 CHECK_FCT( fd_dict_init(&fd_g_config->cnf_dict) ); |
767
c47c16436f71
Added a limit on fifo queues to avoid memory exaustion when messages are received faster than handled
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
740
diff
changeset
|
71 CHECK_FCT( fd_fifo_new(&fd_g_config->cnf_main_ev, 0) ); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
72 |
18
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
73 /* TLS parameters */ |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
74 CHECK_GNUTLS_DO( gnutls_certificate_allocate_credentials (&fd_g_config->cnf_sec_data.credentials), return ENOMEM ); |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
75 CHECK_GNUTLS_DO( gnutls_dh_params_init (&fd_g_config->cnf_sec_data.dh_cache), return ENOMEM ); |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
76 #ifdef GNUTLS_VERSION_300 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
77 CHECK_GNUTLS_DO( gnutls_x509_trust_list_init(&fd_g_config->cnf_sec_data.trustlist, 0), return ENOMEM ); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
78 #endif /* GNUTLS_VERSION_300 */ |
18
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
79 |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
80 return 0; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
81 } |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
82 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
83 void fd_conf_dump() |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
84 { |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
85 if (!TRACE_BOOL(INFO)) |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
86 return; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
87 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
88 fd_log_debug("-- Configuration :\n"); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
89 fd_log_debug(" Debug trace level ...... : %+d\n", fd_g_debug_lvl); |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
90 fd_log_debug(" Configuration file ..... : %s\n", fd_g_config->cnf_file); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
91 fd_log_debug(" Diameter Identity ...... : %s (l:%Zi)\n", fd_g_config->cnf_diamid, fd_g_config->cnf_diamid_len); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
92 fd_log_debug(" Diameter Realm ......... : %s (l:%Zi)\n", fd_g_config->cnf_diamrlm, fd_g_config->cnf_diamrlm_len); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
93 fd_log_debug(" Tc Timer ............... : %u\n", fd_g_config->cnf_timer_tc); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
94 fd_log_debug(" Tw Timer ............... : %u\n", fd_g_config->cnf_timer_tw); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
95 fd_log_debug(" Local port ............. : %hu\n", fd_g_config->cnf_port); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
96 fd_log_debug(" Local secure port ...... : %hu\n", fd_g_config->cnf_port_tls); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
97 fd_log_debug(" Number of SCTP streams . : %hu\n", fd_g_config->cnf_sctp_str); |
253
ad6c0118fb50
Configurable number of server threads
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
189
diff
changeset
|
98 fd_log_debug(" Number of server threads : %hu\n", fd_g_config->cnf_dispthr); |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
99 if (FD_IS_LIST_EMPTY(&fd_g_config->cnf_endpoints)) { |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
100 fd_log_debug(" Local endpoints ........ : Default (use all available)\n"); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
101 } else { |
33
e6fcdf12b9a0
Added a lot of TODOs :)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
24
diff
changeset
|
102 fd_log_debug(" Local endpoints ........ : \n"); |
e6fcdf12b9a0
Added a lot of TODOs :)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
24
diff
changeset
|
103 fd_ep_dump( 29, &fd_g_config->cnf_endpoints ); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
104 } |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
105 if (FD_IS_LIST_EMPTY(&fd_g_config->cnf_apps)) { |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
106 fd_log_debug(" Local applications ..... : (none)\n"); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
107 } else { |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
108 struct fd_list * li = fd_g_config->cnf_apps.next; |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
109 fd_log_debug(" Local applications ..... : "); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
110 while (li != &fd_g_config->cnf_apps) { |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
111 struct fd_app * app = (struct fd_app *)li; |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
112 if (li != fd_g_config->cnf_apps.next) fd_log_debug(" "); |
106 | 113 fd_log_debug("App: %u\t%s%s\tVnd: %u\n", |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
114 app->appid, |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
115 app->flags.auth ? "Au" : "--", |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
116 app->flags.acct ? "Ac" : "--", |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
117 app->vndid); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
118 li = li->next; |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
119 } |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
120 } |
18
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
121 |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
122 fd_log_debug(" Flags : - IP ........... : %s\n", fd_g_config->cnf_flags.no_ip4 ? "DISABLED" : "Enabled"); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
123 fd_log_debug(" - IPv6 ......... : %s\n", fd_g_config->cnf_flags.no_ip6 ? "DISABLED" : "Enabled"); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
124 fd_log_debug(" - Relay app .... : %s\n", fd_g_config->cnf_flags.no_fwd ? "DISABLED" : "Enabled"); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
125 fd_log_debug(" - TCP .......... : %s\n", fd_g_config->cnf_flags.no_tcp ? "DISABLED" : "Enabled"); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
126 #ifdef DISABLE_SCTP |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
127 fd_log_debug(" - SCTP ......... : DISABLED (at compilation)\n"); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
128 #else /* DISABLE_SCTP */ |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
129 fd_log_debug(" - SCTP ......... : %s\n", fd_g_config->cnf_flags.no_sctp ? "DISABLED" : "Enabled"); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
130 #endif /* DISABLE_SCTP */ |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
131 fd_log_debug(" - Pref. proto .. : %s\n", fd_g_config->cnf_flags.pr_tcp ? "TCP" : "SCTP"); |
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
132 fd_log_debug(" - TLS method ... : %s\n", fd_g_config->cnf_flags.tls_alg ? "INBAND" : "Separate port"); |
18
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
133 |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
134 fd_log_debug(" TLS : - Certificate .. : %s\n", fd_g_config->cnf_sec_data.cert_file ?: "(NONE)"); |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
135 fd_log_debug(" - Private key .. : %s\n", fd_g_config->cnf_sec_data.key_file ?: "(NONE)"); |
142
dee0a871abcd
Added number of CA certificates for debug
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
106
diff
changeset
|
136 fd_log_debug(" - CA (trust) ... : %s (%d certs)\n", fd_g_config->cnf_sec_data.ca_file ?: "(none)", fd_g_config->cnf_sec_data.ca_file_nr); |
17
ab3c58d88be3
Added proper gcrypt initializer
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
10
diff
changeset
|
137 fd_log_debug(" - CRL .......... : %s\n", fd_g_config->cnf_sec_data.crl_file ?: "(none)"); |
18
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
138 fd_log_debug(" - Priority ..... : %s\n", fd_g_config->cnf_sec_data.prio_string ?: "(default: '" GNUTLS_DEFAULT_PRIORITY "')"); |
578
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
139 if (fd_g_config->cnf_sec_data.dh_file) |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
140 fd_log_debug(" - DH file ...... : %s\n", fd_g_config->cnf_sec_data.dh_file); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
141 else |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
142 fd_log_debug(" - DH bits ...... : %d\n", fd_g_config->cnf_sec_data.dh_bits ?: GNUTLS_DEFAULT_DHBITS); |
18
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
143 |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
144 fd_log_debug(" Origin-State-Id ........ : %u\n", fd_g_config->cnf_orstateid); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
145 } |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
146 |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
147 /* read contents of a file opened in "rb" mode and alloc this data into a gnutls_datum_t (must be freed afterwards) */ |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
148 int fd_conf_stream_to_gnutls_datum(FILE * pemfile, gnutls_datum_t *out) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
149 { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
150 size_t alloc = 0; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
151 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
152 CHECK_PARAMS( pemfile && out ); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
153 memset(out, 0, sizeof(gnutls_datum_t)); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
154 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
155 do { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
156 uint8_t * realloced = NULL; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
157 size_t read = 0; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
158 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
159 if (alloc < out->size + BUFSIZ + 1) { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
160 alloc += alloc / 2 + BUFSIZ + 1; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
161 CHECK_MALLOC_DO( realloced = realloc(out->data, alloc), |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
162 { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
163 free(out->data); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
164 return ENOMEM; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
165 } ) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
166 out->data = realloced; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
167 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
168 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
169 read = fread( out->data + out->size, 1, alloc - out->size - 1, pemfile ); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
170 out->size += read; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
171 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
172 if (ferror(pemfile)) { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
173 int err = errno; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
174 TRACE_DEBUG(INFO, "An error occurred while reading file: %s\n", strerror(err)); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
175 return err; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
176 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
177 } while (!feof(pemfile)); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
178 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
179 out->data[out->size] = '\0'; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
180 return 0; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
181 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
182 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
183 #ifdef GNUTLS_VERSION_300 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
184 /* inspired from GnuTLS manual */ |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
185 static int fd_conf_print_details_func (gnutls_x509_crt_t cert, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
186 gnutls_x509_crt_t issuer, gnutls_x509_crl_t crl, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
187 unsigned int verification_output) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
188 { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
189 char name[512]; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
190 char issuer_name[512]; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
191 size_t name_size; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
192 size_t issuer_name_size; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
193 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
194 if (!TRACE_BOOL(GNUTLS_DBG_LEVEL)) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
195 return 0; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
196 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
197 issuer_name_size = sizeof (issuer_name); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
198 gnutls_x509_crt_get_issuer_dn (cert, issuer_name, &issuer_name_size); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
199 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
200 name_size = sizeof (name); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
201 gnutls_x509_crt_get_dn (cert, name, &name_size); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
202 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
203 fd_log_debug("\tSubject: %s\n", name); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
204 fd_log_debug("\tIssuer: %s\n", issuer_name); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
205 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
206 if (issuer != NULL) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
207 { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
208 issuer_name_size = sizeof (issuer_name); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
209 gnutls_x509_crt_get_dn (issuer, issuer_name, &issuer_name_size); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
210 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
211 fd_log_debug("\tVerified against: %s\n", issuer_name); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
212 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
213 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
214 if (crl != NULL) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
215 { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
216 issuer_name_size = sizeof (issuer_name); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
217 gnutls_x509_crl_get_issuer_dn (crl, issuer_name, &issuer_name_size); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
218 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
219 fd_log_debug("\tVerified against CRL of: %s\n", issuer_name); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
220 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
221 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
222 fd_log_debug("\tVerification output: %x\n\n", verification_output); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
223 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
224 return 0; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
225 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
226 #endif /* GNUTLS_VERSION_300 */ |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
227 |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
228 /* Parse the configuration file (using the yacc parser) */ |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
229 int fd_conf_parse() |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
230 { |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
231 extern FILE * fddin; |
706
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
232 char * orig = NULL; |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
233 |
304
ad3c46016584
Added install directives for cmake; also allow default directory to seek for extensions and configuration files
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
258
diff
changeset
|
234 /* Attempt to find the configuration file */ |
ad3c46016584
Added install directives for cmake; also allow default directory to seek for extensions and configuration files
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
258
diff
changeset
|
235 if (!fd_g_config->cnf_file) |
ad3c46016584
Added install directives for cmake; also allow default directory to seek for extensions and configuration files
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
258
diff
changeset
|
236 fd_g_config->cnf_file = FD_DEFAULT_CONF_FILENAME; |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
237 |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
238 fddin = fopen(fd_g_config->cnf_file, "r"); |
304
ad3c46016584
Added install directives for cmake; also allow default directory to seek for extensions and configuration files
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
258
diff
changeset
|
239 if ((fddin == NULL) && (*fd_g_config->cnf_file != '/')) { |
ad3c46016584
Added install directives for cmake; also allow default directory to seek for extensions and configuration files
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
258
diff
changeset
|
240 /* We got a relative path, attempt to add the default directory prefix */ |
706
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
241 orig = fd_g_config->cnf_file; |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
242 CHECK_MALLOC( fd_g_config->cnf_file = malloc(strlen(orig) + strlen(DEFAULT_CONF_PATH) + 2) ); /* we will not free it, but not important */ |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
243 sprintf( fd_g_config->cnf_file, DEFAULT_CONF_PATH "/%s", orig ); |
304
ad3c46016584
Added install directives for cmake; also allow default directory to seek for extensions and configuration files
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
258
diff
changeset
|
244 fddin = fopen(fd_g_config->cnf_file, "r"); |
ad3c46016584
Added install directives for cmake; also allow default directory to seek for extensions and configuration files
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
258
diff
changeset
|
245 } |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
246 if (fddin == NULL) { |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
247 int ret = errno; |
706
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
248 if (orig) { |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
249 fprintf(stderr, "Unable to open configuration file for reading\n" |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
250 "Tried the following locations:\n" |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
251 " - %s\n" |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
252 " - %s\n" |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
253 "Error: %s\n", orig, fd_g_config->cnf_file, strerror(ret)); |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
254 } else { |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
255 fprintf(stderr, "Unable to open '%s' for reading: %s\n", fd_g_config->cnf_file, strerror(ret)); |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
256 } |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
257 return ret; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
258 } |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
259 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
260 /* call yacc parser */ |
304
ad3c46016584
Added install directives for cmake; also allow default directory to seek for extensions and configuration files
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
258
diff
changeset
|
261 TRACE_DEBUG (FULL, "Parsing configuration file: %s", fd_g_config->cnf_file); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
262 CHECK_FCT( fddparse(fd_g_config) ); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
263 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
264 /* close the file */ |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
265 fclose(fddin); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
266 |
18
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
267 /* Check that TLS private key was given */ |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
268 if (! fd_g_config->cnf_sec_data.key_file) { |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
269 fprintf(stderr, "Missing private key configuration for TLS. Please provide the TLS_cred configuration directive.\n"); |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
270 return EINVAL; |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
271 } |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
272 |
706
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
273 /* If the CA is not provided, let's use the same file (assuming self-signed certificate) */ |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
274 if (! fd_g_config->cnf_sec_data.ca_file) { |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
275 CHECK_MALLOC( fd_g_config->cnf_sec_data.ca_file = strdup(fd_g_config->cnf_sec_data.cert_file) ); |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
276 CHECK_GNUTLS_DO( fd_g_config->cnf_sec_data.ca_file_nr += gnutls_certificate_set_x509_trust_file( |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
277 fd_g_config->cnf_sec_data.credentials, |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
278 fd_g_config->cnf_sec_data.ca_file, |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
279 GNUTLS_X509_FMT_PEM), |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
280 { |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
281 TRACE_DEBUG(INFO, "Unable to use the local certificate as trusted security anchor (CA), please provide a valid TLS_CA='...' directive."); |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
282 return EINVAL; |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
283 } ); |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
284 } |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
285 |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
286 |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
287 /* Resolve hostname if not provided */ |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
288 if (fd_g_config->cnf_diamid == NULL) { |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
289 char buf[HOST_NAME_MAX + 1]; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
290 struct addrinfo hints, *info; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
291 int ret; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
292 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
293 /* local host name */ |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
294 CHECK_SYS(gethostname(buf, sizeof(buf))); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
295 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
296 /* get FQDN */ |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
297 memset(&hints, 0, sizeof hints); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
298 hints.ai_flags = AI_CANONNAME; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
299 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
300 ret = getaddrinfo(buf, NULL, &hints, &info); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
301 if (ret != 0) { |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
302 fprintf(stderr, "Error resolving local FQDN :\n" |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
303 " '%s' : %s\n" |
309
b1a7d6d5dec4
Fix directive names
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
304
diff
changeset
|
304 "Please provide Identity in configuration file.\n", |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
305 buf, gai_strerror(ret)); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
306 return EINVAL; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
307 } |
706
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
308 fd_g_config->cnf_diamid = info->ai_canonname; |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
309 CHECK_FCT( fd_os_validate_DiameterIdentity(&fd_g_config->cnf_diamid, &fd_g_config->cnf_diamid_len, 1) ); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
310 freeaddrinfo(info); |
706
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
311 } else { |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
312 CHECK_FCT( fd_os_validate_DiameterIdentity(&fd_g_config->cnf_diamid, &fd_g_config->cnf_diamid_len, 0) ); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
313 } |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
314 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
315 /* Handle the realm part */ |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
316 if (fd_g_config->cnf_diamrlm == NULL) { |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
317 char * start = NULL; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
318 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
319 /* Check the diameter identity is a fqdn */ |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
320 start = strchr(fd_g_config->cnf_diamid, '.'); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
321 if ((start == NULL) || (start[1] == '\0')) { |
309
b1a7d6d5dec4
Fix directive names
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
304
diff
changeset
|
322 fprintf(stderr, "Unable to extract realm from the Identity '%s'.\n" |
b1a7d6d5dec4
Fix directive names
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
304
diff
changeset
|
323 "Please fix your Identity setting or provide Realm.\n", |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
324 fd_g_config->cnf_diamid); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
325 return EINVAL; |
706
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
326 } |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
327 |
706
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
328 fd_g_config->cnf_diamrlm = start + 1; |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
329 CHECK_FCT( fd_os_validate_DiameterIdentity(&fd_g_config->cnf_diamrlm, &fd_g_config->cnf_diamrlm_len, 1) ); |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
330 } else { |
4ffbc9f1e922
Large UNTESTED commit with the following changes:
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
686
diff
changeset
|
331 CHECK_FCT( fd_os_validate_DiameterIdentity(&fd_g_config->cnf_diamrlm, &fd_g_config->cnf_diamrlm_len, 0) ); |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
332 } |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
333 |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
334 /* Validate some flags */ |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
335 if (fd_g_config->cnf_flags.no_ip4 && fd_g_config->cnf_flags.no_ip6) { |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
336 fprintf(stderr, "IP and IPv6 cannot be disabled at the same time.\n"); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
337 return EINVAL; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
338 } |
10
c5c99c73c2bf
Added some extensions and functions in the daemon
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
8
diff
changeset
|
339 if (fd_g_config->cnf_flags.no_tcp && fd_g_config->cnf_flags.no_sctp) { |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
340 fprintf(stderr, "TCP and SCTP cannot be disabled at the same time.\n"); |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
341 return EINVAL; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
342 } |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
343 |
22
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
344 /* Validate local endpoints */ |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
345 if ((!FD_IS_LIST_EMPTY(&fd_g_config->cnf_endpoints)) && (fd_g_config->cnf_flags.no_ip4 || fd_g_config->cnf_flags.no_ip6)) { |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
346 struct fd_list * li; |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
347 for ( li = fd_g_config->cnf_endpoints.next; li != &fd_g_config->cnf_endpoints; li = li->next) { |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
348 struct fd_endpoint * ep = (struct fd_endpoint *)li; |
23
db6c40b8b307
Added some code in cnxctx.c mainly
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
22
diff
changeset
|
349 if ( (fd_g_config->cnf_flags.no_ip4 && (ep->sa.sa_family == AF_INET)) |
db6c40b8b307
Added some code in cnxctx.c mainly
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
22
diff
changeset
|
350 ||(fd_g_config->cnf_flags.no_ip6 && (ep->sa.sa_family == AF_INET6)) ) { |
22
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
351 li = li->prev; |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
352 fd_list_unlink(&ep->chain); |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
353 if (TRACE_BOOL(INFO)) { |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
354 fd_log_debug("Info: Removing local address conflicting with the flags no_IP / no_IP6 : "); |
189 | 355 sSA_DUMP_NODE( &ep->sa, NI_NUMERICHOST ); |
22
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
356 fd_log_debug("\n"); |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
357 } |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
358 free(ep); |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
359 } |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
360 } |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
361 } |
0b3b46da2c12
Progress on server code
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
20
diff
changeset
|
362 |
18
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
363 /* Configure TLS default parameters */ |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
364 if (! fd_g_config->cnf_sec_data.prio_string) { |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
365 const char * err_pos = NULL; |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
366 CHECK_GNUTLS_DO( gnutls_priority_init( |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
367 &fd_g_config->cnf_sec_data.prio_cache, |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
368 GNUTLS_DEFAULT_PRIORITY, |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
369 &err_pos), |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
370 { TRACE_DEBUG(INFO, "Error in priority string at position : %s", err_pos); return EINVAL; } ); |
e7187583dcf8
Added CA helper script
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
17
diff
changeset
|
371 } |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
372 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
373 /* Verify that our certificate is valid -- otherwise remote peers will reject it */ |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
374 { |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
375 int ret = 0, i; |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
376 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
377 gnutls_datum_t certfile; |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
378 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
379 gnutls_x509_crt_t * certs = NULL; |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
380 unsigned int cert_max = 0; |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
381 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
382 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
383 /* Read the certificate file */ |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
384 FILE *stream = fopen (fd_g_config->cnf_sec_data.cert_file, "rb"); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
385 if (!stream) { |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
386 int err = errno; |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
387 TRACE_DEBUG(INFO, "An error occurred while opening '%s': %s\n", fd_g_config->cnf_sec_data.cert_file, strerror(err)); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
388 return err; |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
389 } |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
390 CHECK_FCT( fd_conf_stream_to_gnutls_datum(stream, &certfile) ); |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
391 fclose(stream); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
392 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
393 /* Import the certificate(s) */ |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
394 GNUTLS_TRACE( ret = gnutls_x509_crt_list_import(NULL, &cert_max, &certfile, GNUTLS_X509_FMT_PEM, GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED) ); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
395 if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER) { |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
396 CHECK_GNUTLS_DO(ret, return EINVAL); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
397 } |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
398 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
399 CHECK_MALLOC( certs = calloc(cert_max, sizeof(gnutls_x509_crt_t)) ); |
820
0eb64b3a3632
Fix compilation with gnutls < 3.x
Sebastien Decugis <sdecugis@freediameter.net>
parents:
808
diff
changeset
|
400 CHECK_GNUTLS_DO( gnutls_x509_crt_list_import(certs, &cert_max, &certfile, GNUTLS_X509_FMT_PEM, |
0eb64b3a3632
Fix compilation with gnutls < 3.x
Sebastien Decugis <sdecugis@freediameter.net>
parents:
808
diff
changeset
|
401 #ifdef GNUTLS_VERSION_300 |
0eb64b3a3632
Fix compilation with gnutls < 3.x
Sebastien Decugis <sdecugis@freediameter.net>
parents:
808
diff
changeset
|
402 GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED |
0eb64b3a3632
Fix compilation with gnutls < 3.x
Sebastien Decugis <sdecugis@freediameter.net>
parents:
808
diff
changeset
|
403 #else /* GNUTLS_VERSION_300 */ |
0eb64b3a3632
Fix compilation with gnutls < 3.x
Sebastien Decugis <sdecugis@freediameter.net>
parents:
808
diff
changeset
|
404 0 |
0eb64b3a3632
Fix compilation with gnutls < 3.x
Sebastien Decugis <sdecugis@freediameter.net>
parents:
808
diff
changeset
|
405 #endif /* GNUTLS_VERSION_300 */ |
0eb64b3a3632
Fix compilation with gnutls < 3.x
Sebastien Decugis <sdecugis@freediameter.net>
parents:
808
diff
changeset
|
406 ), |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
407 { |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
408 TRACE_DEBUG(INFO, "Failed to import the data from file '%s'", fd_g_config->cnf_sec_data.cert_file); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
409 free(certfile.data); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
410 return EINVAL; |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
411 } ); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
412 free(certfile.data); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
413 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
414 ASSERT(cert_max >= 1); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
415 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
416 /* Now, verify the list against the local CA and CRL */ |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
417 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
418 #ifdef GNUTLS_VERSION_300 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
419 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
420 /* We use the trust list for this purpose */ |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
421 { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
422 unsigned int output; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
423 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
424 gnutls_x509_trust_list_verify_named_crt ( |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
425 fd_g_config->cnf_sec_data.trustlist, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
426 certs[0], |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
427 fd_g_config->cnf_diamid, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
428 fd_g_config->cnf_diamid_len, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
429 0, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
430 &output, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
431 fd_conf_print_details_func); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
432 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
433 /* if this certificate is not explicitly trusted verify against CAs |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
434 */ |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
435 if (output != 0) |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
436 { |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
437 gnutls_x509_trust_list_verify_crt ( |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
438 fd_g_config->cnf_sec_data.trustlist, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
439 certs, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
440 cert_max, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
441 0, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
442 &output, |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
443 fd_conf_print_details_func); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
444 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
445 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
446 if (output & GNUTLS_CERT_INVALID) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
447 { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
448 fd_log_debug("TLS: Local certificate chain '%s' is invalid :\n", fd_g_config->cnf_sec_data.cert_file); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
449 if (output & GNUTLS_CERT_SIGNER_NOT_FOUND) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
450 fd_log_debug(" - The certificate hasn't got a known issuer.\n"); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
451 if (output & GNUTLS_CERT_SIGNER_NOT_CA) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
452 fd_log_debug(" - The certificate signer is not a CA, or uses version 1, or 3 without basic constraints.\n"); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
453 if (output & GNUTLS_CERT_NOT_ACTIVATED) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
454 fd_log_debug(" - The certificate is not yet activated.\n"); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
455 if (output & GNUTLS_CERT_EXPIRED) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
456 fd_log_debug(" - The certificate is expired.\n"); |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
457 return EINVAL; |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
458 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
459 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
460 /* Now check the subject matches our hostname */ |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
461 if (!gnutls_x509_crt_check_hostname (certs[0], fd_g_config->cnf_diamid)) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
462 { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
463 fd_log_debug("TLS: The certificate owner does not match the hostname '%s'\n", fd_g_config->cnf_diamid); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
464 return EINVAL; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
465 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
466 |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
467 } |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
468 |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
469 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
470 #else /* GNUTLS_VERSION_300 */ |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
471 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
472 /* GnuTLS 2.x way of checking certificates */ |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
473 { |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
474 gnutls_x509_crt_t * CA_list; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
475 int CA_list_length; |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
476 |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
477 gnutls_x509_crl_t * CRL_list; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
478 int CRL_list_length; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
479 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
480 unsigned int verify; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
481 time_t now; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
482 GNUTLS_TRACE( gnutls_certificate_get_x509_cas (fd_g_config->cnf_sec_data.credentials, &CA_list, (unsigned int *) &CA_list_length) ); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
483 GNUTLS_TRACE( gnutls_certificate_get_x509_crls (fd_g_config->cnf_sec_data.credentials, &CRL_list, (unsigned int *) &CRL_list_length) ); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
484 CHECK_GNUTLS_DO( gnutls_x509_crt_list_verify(certs, cert_max, CA_list, CA_list_length, CRL_list, CRL_list_length, 0, &verify), |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
485 { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
486 TRACE_DEBUG(INFO, "Failed to verify the local certificate '%s' against local credentials. Please check your certificate is valid.", fd_g_config->cnf_sec_data.cert_file); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
487 return EINVAL; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
488 } ); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
489 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
490 if (verify) { |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
491 fd_log_debug("TLS: Local certificate chain '%s' is invalid :\n", fd_g_config->cnf_sec_data.cert_file); |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
492 if (verify & GNUTLS_CERT_INVALID) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
493 fd_log_debug(" - The certificate is not trusted (unknown CA? expired?)\n"); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
494 if (verify & GNUTLS_CERT_REVOKED) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
495 fd_log_debug(" - The certificate has been revoked.\n"); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
496 if (verify & GNUTLS_CERT_SIGNER_NOT_FOUND) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
497 fd_log_debug(" - The certificate hasn't got a known issuer.\n"); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
498 if (verify & GNUTLS_CERT_SIGNER_NOT_CA) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
499 fd_log_debug(" - The certificate signer is not a CA, or uses version 1, or 3 without basic constraints.\n"); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
500 if (verify & GNUTLS_CERT_INSECURE_ALGORITHM) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
501 fd_log_debug(" - The certificate signature uses a weak algorithm.\n"); |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
502 return EINVAL; |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
503 } |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
504 |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
505 /* Check the local Identity is valid with the certificate */ |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
506 if (!gnutls_x509_crt_check_hostname (certs[0], fd_g_config->cnf_diamid)) { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
507 fd_log_debug("TLS: Local certificate '%s' is invalid :\n", fd_g_config->cnf_sec_data.cert_file); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
508 fd_log_debug(" - The certificate hostname does not match '%s'\n", fd_g_config->cnf_diamid); |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
509 return EINVAL; |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
510 } |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
511 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
512 /* Check validity of all the certificates in the chain */ |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
513 now = time(NULL); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
514 for (i = 0; i < cert_max; i++) |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
515 { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
516 time_t deadline; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
517 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
518 GNUTLS_TRACE( deadline = gnutls_x509_crt_get_expiration_time(certs[i]) ); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
519 if ((deadline != (time_t)-1) && (deadline < now)) { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
520 fd_log_debug("TLS: Local certificate chain '%s' is invalid :\n", fd_g_config->cnf_sec_data.cert_file); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
521 fd_log_debug(" - The certificate %d in the chain is expired\n", i); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
522 return EINVAL; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
523 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
524 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
525 GNUTLS_TRACE( deadline = gnutls_x509_crt_get_activation_time(certs[i]) ); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
526 if ((deadline != (time_t)-1) && (deadline > now)) { |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
527 fd_log_debug("TLS: Local certificate chain '%s' is invalid :\n", fd_g_config->cnf_sec_data.cert_file); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
528 fd_log_debug(" - The certificate %d in the chain is not yet activated\n", i); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
529 return EINVAL; |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
530 } |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
531 } |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
532 } |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
533 #endif /* GNUTLS_VERSION_300 */ |
542
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
534 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
535 /* Everything checked OK, free the certificate list */ |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
536 for (i = 0; i < cert_max; i++) |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
537 { |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
538 GNUTLS_TRACE( gnutls_x509_crt_deinit (certs[i]) ); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
539 } |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
540 free(certs); |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
541 } |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
542 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
543 |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
544 /* gnutls_certificate_set_verify_limits -- so far the default values are fine... */ |
0b6cee362f5d
Enforce validation of local certificate upon daemon start.
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
447
diff
changeset
|
545 |
807
09f8f0c4f4a4
Several changes to support GnuTLS 3.x in a more efficient way
Sebastien Decugis <sdecugis@freediameter.net>
parents:
805
diff
changeset
|
546 #ifdef GNUTLS_VERSION_300 |
09f8f0c4f4a4
Several changes to support GnuTLS 3.x in a more efficient way
Sebastien Decugis <sdecugis@freediameter.net>
parents:
805
diff
changeset
|
547 /* Use certificate verification during the handshake */ |
09f8f0c4f4a4
Several changes to support GnuTLS 3.x in a more efficient way
Sebastien Decugis <sdecugis@freediameter.net>
parents:
805
diff
changeset
|
548 gnutls_certificate_set_verify_function (fd_g_config->cnf_sec_data.credentials, fd_tls_verify_credentials_2); |
09f8f0c4f4a4
Several changes to support GnuTLS 3.x in a more efficient way
Sebastien Decugis <sdecugis@freediameter.net>
parents:
805
diff
changeset
|
549 #endif /* GNUTLS_VERSION_300 */ |
09f8f0c4f4a4
Several changes to support GnuTLS 3.x in a more efficient way
Sebastien Decugis <sdecugis@freediameter.net>
parents:
805
diff
changeset
|
550 |
578
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
551 /* DH */ |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
552 if (fd_g_config->cnf_sec_data.dh_file) { |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
553 gnutls_datum_t dhparams = { NULL, 0 }; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
554 size_t alloc = 0; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
555 FILE *stream = fopen (fd_g_config->cnf_sec_data.dh_file, "rb"); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
556 if (!stream) { |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
557 int err = errno; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
558 TRACE_DEBUG(INFO, "An error occurred while opening '%s': %s\n", fd_g_config->cnf_sec_data.dh_file, strerror(err)); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
559 return err; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
560 } |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
561 do { |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
562 uint8_t * realloced = NULL; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
563 size_t read = 0; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
564 |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
565 if (alloc < dhparams.size + BUFSIZ + 1) { |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
566 alloc += alloc / 2 + BUFSIZ + 1; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
567 CHECK_MALLOC_DO( realloced = realloc(dhparams.data, alloc), |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
568 { |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
569 free(dhparams.data); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
570 return ENOMEM; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
571 } ) |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
572 dhparams.data = realloced; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
573 } |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
574 |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
575 read = fread( dhparams.data + dhparams.size, 1, alloc - dhparams.size - 1, stream ); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
576 dhparams.size += read; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
577 |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
578 if (ferror(stream)) { |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
579 int err = errno; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
580 TRACE_DEBUG(INFO, "An error occurred while reading '%s': %s\n", fd_g_config->cnf_sec_data.dh_file, strerror(err)); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
581 return err; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
582 } |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
583 } while (!feof(stream)); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
584 dhparams.data[dhparams.size] = '\0'; |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
585 fclose(stream); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
586 CHECK_GNUTLS_DO( gnutls_dh_params_import_pkcs3( |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
587 fd_g_config->cnf_sec_data.dh_cache, |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
588 &dhparams, |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
589 GNUTLS_X509_FMT_PEM), |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
590 { TRACE_DEBUG(INFO, "Error in DH bits value : %d", fd_g_config->cnf_sec_data.dh_bits ?: GNUTLS_DEFAULT_DHBITS); return EINVAL; } ); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
591 free(dhparams.data); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
592 |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
593 } else { |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
594 TRACE_DEBUG(INFO, "Generating fresh Diffie-Hellman parameters of size %d (this takes some time)... ", fd_g_config->cnf_sec_data.dh_bits ?: GNUTLS_DEFAULT_DHBITS); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
595 CHECK_GNUTLS_DO( gnutls_dh_params_generate2( |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
596 fd_g_config->cnf_sec_data.dh_cache, |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
597 fd_g_config->cnf_sec_data.dh_bits ?: GNUTLS_DEFAULT_DHBITS), |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
598 { TRACE_DEBUG(INFO, "Error in DH bits value : %d", fd_g_config->cnf_sec_data.dh_bits ?: GNUTLS_DEFAULT_DHBITS); return EINVAL; } ); |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
599 } |
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
600 |
8
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
601 return 0; |
3e143f047f78
Backup for the week-end
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
diff
changeset
|
602 } |
447
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
603 |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
604 |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
605 /* Destroy contents of fd_g_config structure */ |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
606 int fd_conf_deinit() |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
607 { |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
608 TRACE_ENTRY(); |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
609 |
686
f83d9878bf66
Fixed in case of termination of several modules (before initialization completed)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
662
diff
changeset
|
610 if (!fd_g_config) |
f83d9878bf66
Fixed in case of termination of several modules (before initialization completed)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
662
diff
changeset
|
611 return 0; |
f83d9878bf66
Fixed in case of termination of several modules (before initialization completed)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
662
diff
changeset
|
612 |
447
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
613 /* Free the TLS parameters */ |
805
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
614 #ifdef GNUTLS_VERSION_300 |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
615 gnutls_x509_trust_list_deinit(fd_g_config->cnf_sec_data.trustlist, 1); |
fb5e0fd923ff
Updated verification of the local certificate following GnuTLS 3.x guideline
Sebastien Decugis <sdecugis@freediameter.net>
parents:
767
diff
changeset
|
616 #endif /* GNUTLS_VERSION_300 */ |
447
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
617 gnutls_priority_deinit(fd_g_config->cnf_sec_data.prio_cache); |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
618 gnutls_dh_params_deinit(fd_g_config->cnf_sec_data.dh_cache); |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
619 gnutls_certificate_free_credentials(fd_g_config->cnf_sec_data.credentials); |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
620 |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
621 free(fd_g_config->cnf_sec_data.cert_file); fd_g_config->cnf_sec_data.cert_file = NULL; |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
622 free(fd_g_config->cnf_sec_data.key_file); fd_g_config->cnf_sec_data.key_file = NULL; |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
623 free(fd_g_config->cnf_sec_data.ca_file); fd_g_config->cnf_sec_data.ca_file = NULL; |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
624 free(fd_g_config->cnf_sec_data.crl_file); fd_g_config->cnf_sec_data.crl_file = NULL; |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
625 free(fd_g_config->cnf_sec_data.prio_string); fd_g_config->cnf_sec_data.prio_string = NULL; |
578
7c9a00bfd115
Allow TLS Diffie-Hellmann parameters to be loaded from a file (ticket #17)
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
542
diff
changeset
|
626 free(fd_g_config->cnf_sec_data.dh_file); fd_g_config->cnf_sec_data.dh_file = NULL; |
447
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
627 |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
628 /* Destroy dictionary */ |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
629 CHECK_FCT_DO( fd_dict_fini(&fd_g_config->cnf_dict), ); |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
630 |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
631 /* Destroy the main event queue */ |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
632 CHECK_FCT_DO( fd_fifo_del(&fd_g_config->cnf_main_ev), ); |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
633 |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
634 /* Destroy the local endpoints and applications */ |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
635 CHECK_FCT_DO(fd_ep_filter(&fd_g_config->cnf_endpoints, 0 ), ); |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
636 CHECK_FCT_DO(fd_app_empty(&fd_g_config->cnf_apps ), ); |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
637 |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
638 /* Destroy the local identity */ |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
639 free(fd_g_config->cnf_diamid); fd_g_config->cnf_diamid = NULL; |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
640 free(fd_g_config->cnf_diamrlm); fd_g_config->cnf_diamrlm = NULL; |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
641 |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
642 return 0; |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
643 } |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
644 |
097bae83b07a
Forgot to cleanup the configuration on exit, spotted by valgrind
Sebastien Decugis <sdecugis@nict.go.jp>
parents:
403
diff
changeset
|
645 |