C++ OpenSSL_add_ssl_algorithms函数代码示例

void Init_mini_ssl(VALUE puma) {
    VALUE mod, eng;

    SSL_library_init();
    OpenSSL_add_ssl_algorithms();
    SSL_load_error_strings();
    ERR_load_crypto_strings();

    mod = rb_define_module_under(puma, "MiniSSL");
    eng = rb_define_class_under(mod, "Engine", rb_cObject);

    rb_define_singleton_method(mod, "check", noop, 0);

    eError = rb_define_class_under(mod, "SSLError", rb_eStandardError);

    rb_define_singleton_method(eng, "server", engine_init_server, 1);
    rb_define_singleton_method(eng, "client", engine_init_client, 0);

    rb_define_method(eng, "inject", engine_inject, 1);
    rb_define_method(eng, "read",  engine_read, 0);

    rb_define_method(eng, "write",  engine_write, 1);
    rb_define_method(eng, "extract", engine_extract, 0);

    rb_define_method(eng, "peercert", engine_peercert, 0);
}

static std::unordered_map<uint16_t, std::string> getOpenSSLCipherNames() {
  std::unordered_map<uint16_t, std::string> ret;
  SSL_CTX* ctx = nullptr;
  SSL* ssl = nullptr;

  const SSL_METHOD* meth = SSLv23_server_method();
  OpenSSL_add_ssl_algorithms();

  if ((ctx = SSL_CTX_new(meth)) == nullptr) {
    return ret;
  }
  SCOPE_EXIT {
    SSL_CTX_free(ctx);
  };

  if ((ssl = SSL_new(ctx)) == nullptr) {
    return ret;
  }
  SCOPE_EXIT {
    SSL_free(ssl);
  };

  STACK_OF(SSL_CIPHER)* sk = SSL_get_ciphers(ssl);
  for (int i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
    const SSL_CIPHER* c = sk_SSL_CIPHER_value(sk, i);
    unsigned long id = SSL_CIPHER_get_id(c);
    // OpenSSL 1.0.2 and prior does weird things such as stuff the SSL/TLS
    // version into the top 16 bits. Let's ignore those for now. This is
    // BoringSSL compatible (their id can be cast as uint16_t)
    uint16_t cipherCode = id & 0xffffL;
    ret[cipherCode] = SSL_CIPHER_get_name(c);
  }
  return ret;
}

int git_openssl_stream_global_init(void)
{
#ifdef GIT_OPENSSL
	long ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;

	/* Older OpenSSL and MacOS OpenSSL doesn't have this */
#ifdef SSL_OP_NO_COMPRESSION
	ssl_opts |= SSL_OP_NO_COMPRESSION;
#endif

	SSL_load_error_strings();
	OpenSSL_add_ssl_algorithms();
	/*
	 * Load SSLv{2,3} and TLSv1 so that we can talk with servers
	 * which use the SSL hellos, which are often used for
	 * compatibility. We then disable SSL so we only allow OpenSSL
	 * to speak TLSv1 to perform the encryption itself.
	 */
	git__ssl_ctx = SSL_CTX_new(SSLv23_method());
	SSL_CTX_set_options(git__ssl_ctx, ssl_opts);
	SSL_CTX_set_mode(git__ssl_ctx, SSL_MODE_AUTO_RETRY);
	SSL_CTX_set_verify(git__ssl_ctx, SSL_VERIFY_NONE, NULL);
	if (!SSL_CTX_set_default_verify_paths(git__ssl_ctx)) {
		SSL_CTX_free(git__ssl_ctx);
		git__ssl_ctx = NULL;
		return -1;
	}
#endif

	git__on_shutdown(shutdown_ssl);

	return 0;
}

BOOL CSSLTcpSocket::CreateSSLTcpSocketForClient()
{
	SSL_load_error_strings(); /*为打印调试信息作准备*/ 
	OpenSSL_add_ssl_algorithms(); /*初始化*/ 

	m_meth = (SSL_METHOD *)TLSv1_client_method(); /*采用什么协议(SSLv2/SSLv3/TLSv1)在此指定,TLSv1_server_method,SSLv23_server_method()*/ 

	m_ctx = SSL_CTX_new (m_meth);

	//设置为要求强制校验对方（客户端）证书SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT
	SSL_CTX_set_verify(m_ctx,SSL_VERIFY_NONE,NULL); /*验证与否SSL_VERIFY_PEER*/ 
	//SSL_CTX_load_verify_locations(ctx,CACERT,NULL); /*若验证,则放置CA证书*/


	//RAND_seed

// 	if (!SSL_CTX_check_private_key(m_ctx)) {
// 		printf("密钥证书不匹配！\n");
// 	}

// 	SSL_CTX_set_cipher_list(m_ctx,"DES-CBC3-SHA"); 
// 	SSL_CTX_set_mode(m_ctx, SSL_MODE_AUTO_RETRY);

	CreateTcpSocket();
	
	m_ssl = SSL_new (m_ctx);
	SSL_set_fd (m_ssl, m_TcpSock);

	return FALSE;
}

static int apps_startup()
{
#ifdef SIGPIPE
    signal(SIGPIPE, SIG_IGN);
#endif
    CRYPTO_malloc_init();
    ERR_load_crypto_strings();
    ERR_load_SSL_strings();

    OPENSSL_load_builtin_modules();
#ifndef OPENSSL_NO_ENGINE
    ENGINE_load_builtin_engines();
#endif
    if (!app_load_modules(NULL)) {
        ERR_print_errors(bio_err);
        BIO_printf(bio_err, "Error loading default configuration\n");
        return 0;
    }

    OpenSSL_add_all_algorithms();
    OpenSSL_add_ssl_algorithms();
    setup_ui_method();
    /*SSL_library_init();*/
    return 1;
}

static int OPENSSL_init_ssl(int opts, void *settings)
{
	GIT_UNUSED(opts);
	GIT_UNUSED(settings);
	SSL_load_error_strings();
	OpenSSL_add_ssl_algorithms();
	return 0;
}

static void ssl_ensure_initialized(){
  static bool initialized = false;
  if(initialized) return;
  SSL_library_init();
  OpenSSL_add_ssl_algorithms();
  SSL_load_error_strings();
  initialized = true;
}

int git_openssl_stream_global_init(void)
{
#ifdef GIT_OPENSSL
	long ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
	const char *ciphers = git_libgit2__ssl_ciphers();

	/* Older OpenSSL and MacOS OpenSSL doesn't have this */
#ifdef SSL_OP_NO_COMPRESSION
	ssl_opts |= SSL_OP_NO_COMPRESSION;
#endif

#if OPENSSL_VERSION_NUMBER < 0x10100000L || \
    (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20700000L)
	SSL_load_error_strings();
	OpenSSL_add_ssl_algorithms();
#else
	OPENSSL_init_ssl(0, NULL);
#endif

	/*
	 * Load SSLv{2,3} and TLSv1 so that we can talk with servers
	 * which use the SSL hellos, which are often used for
	 * compatibility. We then disable SSL so we only allow OpenSSL
	 * to speak TLSv1 to perform the encryption itself.
	 */
	git__ssl_ctx = SSL_CTX_new(SSLv23_method());
	SSL_CTX_set_options(git__ssl_ctx, ssl_opts);
	SSL_CTX_set_mode(git__ssl_ctx, SSL_MODE_AUTO_RETRY);
	SSL_CTX_set_verify(git__ssl_ctx, SSL_VERIFY_NONE, NULL);
	if (!SSL_CTX_set_default_verify_paths(git__ssl_ctx)) {
		SSL_CTX_free(git__ssl_ctx);
		git__ssl_ctx = NULL;
		return -1;
	}

	if (!ciphers) {
		ciphers = GIT_SSL_DEFAULT_CIPHERS;
	}

	if(!SSL_CTX_set_cipher_list(git__ssl_ctx, ciphers)) {
		SSL_CTX_free(git__ssl_ctx);
		git__ssl_ctx = NULL;
		return -1;
	}

	if (init_bio_method() < 0) {
		SSL_CTX_free(git__ssl_ctx);
		git__ssl_ctx = NULL;
		return -1;
	}

#endif

	git__on_shutdown(shutdown_ssl);

	return 0;
}

/* Initialize the SSL library internals for use by the messaging bus. */
bool BusSSL_Init(struct bus *b) {
    if (!SSL_library_init()) { return false; }
    SSL_load_error_strings();
    ERR_load_BIO_strings();
    OpenSSL_add_ssl_algorithms();

    SSL_CTX *ctx = NULL;
    if (!init_client_SSL_CTX(&ctx)) { return false; }
    b->ssl_ctx = ctx;

    return true;
}

extern	void
InitNET(void)
{
	bindtextdomain(PACKAGE, LOCALEDIR);
#ifdef	USE_SSL
	ssl_error_message[0] = '\0';
	ssl_warning_message[0] = '\0';
	OpenSSL_add_ssl_algorithms();
	OpenSSL_add_all_algorithms();	
	ERR_load_crypto_strings();
	SSL_load_error_strings();	
#endif
}

static void init_ssl(void)
{
#ifdef GIT_SSL
	SSL_load_error_strings();
	OpenSSL_add_ssl_algorithms();
	/*
	 * Load SSLv{2,3} and TLSv1 so that we can talk with servers
	 * which use the SSL hellos, which are often used for
	 * compatibility. We then disable SSL so we only allow OpenSSL
	 * to speak TLSv1 to perform the encryption itself.
	 */
	git__ssl_ctx = SSL_CTX_new(SSLv23_method());
	SSL_CTX_set_options(git__ssl_ctx,
			    SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3
	/* Older OpenSSL and MacOS OpenSSL doesn't have this */
# ifdef SSL_OP_NO_COMPRESSION
			    | SSL_OP_NO_COMPRESSION
# endif
		);
	SSL_CTX_set_mode(git__ssl_ctx, SSL_MODE_AUTO_RETRY);
	SSL_CTX_set_verify(git__ssl_ctx, SSL_VERIFY_NONE, NULL);
	if (!SSL_CTX_set_default_verify_paths(git__ssl_ctx)) {
		SSL_CTX_free(git__ssl_ctx);
		git__ssl_ctx = NULL;
	}

# ifdef GIT_THREADS
	{
		int num_locks, i;

		num_locks = CRYPTO_num_locks();
		openssl_locks = git__calloc(num_locks, sizeof(git_mutex));
		if (openssl_locks == NULL) {
			SSL_CTX_free(git__ssl_ctx);
			git__ssl_ctx = NULL;
		}

		for (i = 0; i < num_locks; i++) {
			if (git_mutex_init(&openssl_locks[i]) != 0) {
				SSL_CTX_free(git__ssl_ctx);
				git__ssl_ctx = NULL;
			}
		}

		CRYPTO_set_locking_callback(openssl_locking_function);
	}

	git__on_shutdown(shutdown_ssl);
# endif
#endif
}

P_ST_TLS_STRUCT st_tls_create_ctx(P_ST_TLS_STRUCT p_st_tls)
{
    P_SSL_CTX p_ctx = NULL;

    OpenSSL_add_ssl_algorithms();
    SSL_load_error_strings();
    SSL_library_init();     //SSL_library_init() always returns "1"

    tls_rand_seed();

    if ( p_st_tls->work_status == WORK_SERVER )
    {
        st_print("Initialize with TLSv1_server_method() \n");
        RET_NULL_IF_TRUE_S(!(p_ctx = SSL_CTX_new(TLSv1_server_method()))); 
    }
    else if ( p_st_tls->work_status == WORK_CLIENT )
    {
        st_print("Initialize with TLSv1_client_method() \n");
        RET_NULL_IF_TRUE_S(!(p_ctx = SSL_CTX_new(TLSv1_client_method())));
    }
    else
    {
        st_print("Initialize with TLSv1_method() \n");
        RET_NULL_IF_TRUE_S(!(p_ctx = SSL_CTX_new(TLSv1_method())));
    }


    //SSL_CTX_set_default_passwd_cb(p_ctx, no_passphrase_callback);
    SSL_CTX_set_mode(p_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);

    if ( strlen(p_st_tls->ca_file) )
    {
        RET_NULL_IF_TRUE_S( !SSL_CTX_load_verify_locations(p_ctx, p_st_tls->ca_file, NULL));
    }
    else
    {
        st_print("No CAfile Verify!\n");
    }

    RET_NULL_IF_TRUE_S( !SSL_CTX_use_PrivateKey_file(p_ctx, p_st_tls->key_file, SSL_FILETYPE_PEM)); 

    RET_NULL_IF_TRUE_S( !SSL_CTX_use_certificate_chain_file(p_ctx, p_st_tls->cert_file));

    // 判定私钥是否正确  
    RET_NULL_IF_TRUE_S( !SSL_CTX_check_private_key(p_ctx));

    p_st_tls->p_ctx = p_ctx;

    return p_st_tls;
}

void DDS_SP_init_library (void)
{
	if (!dds_openssl_init_global)
		return;

	DDS_Security_set_library_lock ();
	OpenSSL_add_ssl_algorithms ();

#ifdef DDS_DEBUG
	SSL_load_error_strings ();
#endif
	
	dds_openssl_init_global = 0;
}

/**
 * @desc Initialize OpenSSL lib
 * @throw Char *
 */
void IOSocketSSL::initSSL(const bool force_server_method = false) {

	TRACE_CALL();

	SSL_load_error_strings();
	ERR_load_BIO_strings();
	OpenSSL_add_all_algorithms();
	OpenSSL_add_ssl_algorithms();

	switch (socket_t) {
		case IOSOCKET_LISTEN_T:
			ctx = SSL_CTX_new(SSLv3_server_method());
			break;

		case IOSOCKET_CONNECT_T:
			if (force_server_method)
				ctx = SSL_CTX_new(SSLv3_server_method());
			else
				ctx = SSL_CTX_new(SSLv3_client_method());
			break;

		default:
			/* Shouln't happen, mother class constructor should have thrown
			 * an exception earlier */
			throw("Unknown socket type");
			break;
	}

	/**
	 * Should use a loop on ERR_get_error()
	 * to retrieve the whole error process
	 */
	if (ctx == NULL)
		throw(new_SSL_error("initializing ssl context"));

	if (SSL_CTX_use_certificate_file(ctx, cert_file, SSL_FILETYPE_PEM) != 1)
		throw(new_SSL_error("loading cert file"));

	if (SSL_CTX_use_PrivateKey_file(ctx, key_file, SSL_FILETYPE_PEM) != 1)
		throw(new_SSL_error("loading private key file"));

	if (SSL_CTX_check_private_key(ctx) != 1)
		throw(new_SSL_error("verifying private key"));

	/* Don't bother with renego */
	SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);

	init_ssl = true;
}

static void apps_startup()
{
#ifdef SIGPIPE
    signal(SIGPIPE, SIG_IGN);
#endif
    CRYPTO_malloc_init();
    ERR_load_crypto_strings();
    ERR_load_SSL_strings();
    OpenSSL_add_all_algorithms();
    OpenSSL_add_ssl_algorithms();
    OPENSSL_load_builtin_modules();
    setup_ui_method();
    /*SSL_library_init();*/
#ifndef OPENSSL_NO_ENGINE
    ENGINE_load_builtin_engines();
#endif
}