ssl_engine_pphrase.c

mod_ssl-2.8.31-1.3.41.tar.gz 好用的ssl工具

                        sleep((nPassPhraseRetry-BUILTIN_DIALOG_BACKOFF)*5);
                    continue;
                }

                /*
                 * Ok, anything else now means a fatal error.
                 */
                if (cpPassPhraseCur == NULL)
                    ssl_log(pServ, SSL_LOG_ERROR|SSL_ADD_SSLERR, "Init: Private key not found");
                    if (sc->nPassPhraseDialogType == SSL_PPTYPE_BUILTIN) {
                        fprintf(stdout, "Apache:mod_ssl:Error: Private key not found.\n");
                        fprintf(stdout, "**Stopped\n");
                    }
                else {
                    ssl_log(pServ, SSL_LOG_ERROR|SSL_ADD_SSLERR, "Init: Pass phrase incorrect");
                    if (sc->nPassPhraseDialogType == SSL_PPTYPE_BUILTIN) {
                        fprintf(stdout, "Apache:mod_ssl:Error: Pass phrase incorrect.\n");
                        fprintf(stdout, "**Stopped\n");
                    }
                }
                ssl_die();
            }

            if (pPrivateKey == NULL) {
                ssl_log(s, SSL_LOG_ERROR|SSL_ADD_SSLERR,
                        "Init: Unable to read server private key from file %s", szPath);
                ssl_die();
            }

            /*
             * check algorithm type of private key and make
             * sure only one private key per type is used.
             */
            at = ssl_util_algotypeof(NULL, pPrivateKey);
            an = ssl_util_algotypestr(at);
            if (algoKey & at) {
                ssl_log(s, SSL_LOG_ERROR|SSL_ADD_SSLERR,
                        "Init: Multiple %s server private keys not allowed", an);
                ssl_die();
            }
            algoKey |= at;

            /*
             * Log the type of reading
             */
            if (nPassPhraseDialogCur == 0)
                ssl_log(pServ, SSL_LOG_TRACE, 
                        "Init: (%s) unencrypted %s private key - pass phrase not required", 
                        cpVHostID, an);
            else {
                if (cpPassPhraseCur != NULL)
                    ssl_log(pServ, SSL_LOG_TRACE, 
                            "Init: (%s) encrypted %s private key - pass phrase requested", 
                            cpVHostID, an);
                else
                    ssl_log(pServ, SSL_LOG_TRACE, 
                            "Init: (%s) encrypted %s private key - pass phrase reused", 
                            cpVHostID, an);
            }

            /*
             * Ok, when we have one more pass phrase store it
             */
            if (cpPassPhraseCur != NULL) {
                cpp = (char **)ssl_ds_array_push(aPassPhrase);
                *cpp = cpPassPhraseCur;
                nPassPhrase++;
            }

            /*
             * Insert private key into the global module configuration
             * (we convert it to a stand-alone DER byte sequence
             * because the SSL library uses static variables inside a
             * RSA structure which do not survive DSO reloads!)
             */
            cp = ap_psprintf(mc->pPool, "%s:%s", cpVHostID, an);
            asn1 = (ssl_asn1_t *)ssl_ds_table_push(mc->tPrivateKey, cp);
            asn1->nData  = i2d_PrivateKey(pPrivateKey, NULL);
            asn1->cpData = ap_palloc(mc->pPool, asn1->nData);
            ucp = asn1->cpData; i2d_PrivateKey(pPrivateKey, &ucp); /* 2nd arg increments */

            /*
             * Free the private key structure
             */
            EVP_PKEY_free(pPrivateKey);
        }
    }

    /*
     * Let the user know when we're successful.
     */
    if (nPassPhraseDialog > 0) {
        sc = mySrvConfig(s);
        if (sc->nPassPhraseDialogType == SSL_PPTYPE_BUILTIN) {
            fprintf(stdout, "\n");
            fprintf(stdout, "Ok: Pass Phrase Dialog successful.\n");
        }
    }

    /*
     * Wipe out the used memory from the
     * pass phrase array and then deallocate it
     */
    if (!ssl_ds_array_isempty(aPassPhrase)) {
        ssl_ds_array_wipeout(aPassPhrase);
        ssl_ds_array_kill(aPassPhrase);
        ssl_log(s, SSL_LOG_INFO, "Init: Wiped out the queried pass phrases from memory");
    }

    return;
}

#if SSL_LIBRARY_VERSION < 0x00904000
int ssl_pphrase_Handle_CB(char *buf, int bufsize, int verify)
#else
int ssl_pphrase_Handle_CB(char *buf, int bufsize, int verify, void *nadda)
#endif
{
    SSLModConfigRec *mc = myModConfig();
    server_rec *s;
    pool *p;
    ssl_ds_array *aPassPhrase;
    SSLSrvConfigRec *sc;
    int *pnPassPhraseCur;
    char **cppPassPhraseCur;
    char *cpVHostID;
    char *cpAlgoType;
    int *pnPassPhraseDialog;
    int *pnPassPhraseDialogCur;
    BOOL *pbPassPhraseDialogOnce;
    int stderr_store;
    char **cpp;
    int len = -1;

    /*
     * Reconnect to the context of ssl_phrase_Handle()
     */
    s                      = myCtxVarGet(mc,  1, server_rec *);
    p                      = myCtxVarGet(mc,  2, pool *);
    aPassPhrase            = myCtxVarGet(mc,  3, ssl_ds_array *);
    pnPassPhraseCur        = myCtxVarGet(mc,  4, int *);
    cppPassPhraseCur       = myCtxVarGet(mc,  5, char **);
    cpVHostID              = myCtxVarGet(mc,  6, char *);
    cpAlgoType             = myCtxVarGet(mc,  7, char *);
    pnPassPhraseDialog     = myCtxVarGet(mc,  8, int *);
    pnPassPhraseDialogCur  = myCtxVarGet(mc,  9, int *);
    pbPassPhraseDialogOnce = myCtxVarGet(mc, 10, BOOL *);
    sc                     = mySrvConfig(s);

    (*pnPassPhraseDialog)++;
    (*pnPassPhraseDialogCur)++;

    /*
     * When remembered pass phrases are available use them...
     */
    if ((cpp = (char **)ssl_ds_array_get(aPassPhrase, *pnPassPhraseCur)) != NULL) {
        ap_cpystrn(buf, *cpp, bufsize);
        len = strlen(buf);
        return len;
    }

    /*
     * Builtin dialog
     */
    if (sc->nPassPhraseDialogType == SSL_PPTYPE_BUILTIN) {
        char *prompt;
        int i;
#ifdef WIN32
        FILE *con;
#endif

        ssl_log(s, SSL_LOG_INFO,
                "Init: Requesting pass phrase via builtin terminal dialog");

        /*
         * Reconnect STDERR to terminal (here STDOUT) because
         * at our init stage Apache already connected STDERR
         * to the general error logfile.
         */
#ifdef WIN32
        stderr_store = STDERR_FILENO_STORE;
#else
        if ((stderr_store = open("/dev/null", O_WRONLY)) == -1)
            stderr_store = STDERR_FILENO_STORE;
#endif
        dup2(STDERR_FILENO, stderr_store);
#ifdef WIN32
        if ((con = fopen("con", "w")) != NULL)
            dup2(fileno(con), STDERR_FILENO);
        else
            dup2(STDOUT_FILENO, STDERR_FILENO);
#else
        dup2(STDOUT_FILENO, STDERR_FILENO);
#endif

        /*
         * The first time display a header to inform the user about what
         * program he actually speaks to, which module is responsible for
         * this terminal dialog and why to the hell he has to enter
         * something...
         */
        if (*pnPassPhraseDialog == 1) {
            fprintf(stderr, "%s mod_ssl/%s (Pass Phrase Dialog)\n",
                    SERVER_BASEVERSION, MOD_SSL_VERSION);
            fprintf(stderr, "Some of your private key files are encrypted for security reasons.\n");
            fprintf(stderr, "In order to read them you have to provide us with the pass phrases.\n");
        }
        if (*pbPassPhraseDialogOnce) {
            *pbPassPhraseDialogOnce = FALSE;
            fprintf(stderr, "\n");
            fprintf(stderr, "Server %s (%s)\n", cpVHostID, cpAlgoType);
        }

        /*
         * Emulate the OpenSSL internal pass phrase dialog
         * (see crypto/pem/pem_lib.c:def_callback() for details)
         */
        prompt = "Enter pass phrase:";
        for (;;) {
            if ((i = EVP_read_pw_string(buf, bufsize, prompt, FALSE)) != 0) {
#if SSL_LIBRARY_VERSION >= 0x00908000
                PEMerr(PEM_F_PEM_DEF_CALLBACK, PEM_R_PROBLEMS_GETTING_PASSWORD);
#else
                PEMerr(PEM_F_DEF_CALLBACK, PEM_R_PROBLEMS_GETTING_PASSWORD);
#endif
                memset(buf, 0, (unsigned int)bufsize);
                return (-1);
            }
            len = strlen(buf);
            if (len < 1)
                fprintf(stderr, "Apache:mod_ssl:Error: Pass phrase empty (needs to be at least 1 character).\n");
            else
                break;
        }

        /*
         * Restore STDERR to Apache error logfile
         */
        dup2(stderr_store, STDERR_FILENO);
        close(stderr_store);
#ifdef WIN32
        if (con != NULL)
            fclose(con);
#endif
    }

    /*
     * Filter program
     */
    else if (sc->nPassPhraseDialogType == SSL_PPTYPE_FILTER) {
        char *cmd;
        char *result;

        ssl_log(s, SSL_LOG_INFO,
                "Init: Requesting pass phrase from dialog filter program (%s)",
                sc->szPassPhraseDialogPath);

        if (strchr(sc->szPassPhraseDialogPath, ' ') != NULL)
            cmd = ap_psprintf(p, "\"%s\" %s %s", sc->szPassPhraseDialogPath, cpVHostID, cpAlgoType);
        else
            cmd = ap_psprintf(p, "%s %s %s", sc->szPassPhraseDialogPath, cpVHostID, cpAlgoType);
        result = ssl_util_readfilter(s, p, cmd);
        ap_cpystrn(buf, result, bufsize);
        len = strlen(buf);
    }

    /*
     * Ok, we now have the pass phrase, so give it back
     */
    *cppPassPhraseCur = ap_pstrdup(p, buf);

    /*
     * And return it's length to OpenSSL...
     */
    return (len);
}