C++ SSL_CTX_use_PrivateKey函数代码示例

int
ssl_ctx_use_private_key(SSL_CTX *ctx, char *buf, off_t len)
{
	int		 ret;
	BIO		*in;
	EVP_PKEY	*pkey;

	ret = 0;

	if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
		SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
		return 0;
	}

	pkey = PEM_read_bio_PrivateKey(in, NULL,
	    ctx->default_passwd_callback,
	    ctx->default_passwd_callback_userdata);

	if (pkey == NULL) {
		SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_PEM_LIB);
		goto end;
	}
	ret = SSL_CTX_use_PrivateKey(ctx, pkey);
	EVP_PKEY_free(pkey);
end:
	if (in != NULL)
		BIO_free(in);
	return ret;
}

int
ssl_ctx_fake_private_key(SSL_CTX *ctx, const void *data, size_t datalen,
    char *buf, off_t len, X509 **x509ptr, EVP_PKEY **pkeyptr)
{
	int		 ret = 0;
	EVP_PKEY	*pkey = NULL;
	X509		*x509 = NULL;

	if (!ssl_load_pkey(data, datalen, buf, len, &x509, &pkey))
		return (0);

	/*
	 * Use the public key as the "private" key - the secret key
	 * parameters are hidden in an extra process that will be
	 * contacted by the RSA engine.  The SSL/TLS library needs at
	 * least the public key parameters in the current process.
	 */
	ret = SSL_CTX_use_PrivateKey(ctx, pkey);
	if (!ret)
		SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_SSL_LIB);

	if (pkeyptr != NULL)
		*pkeyptr = pkey;
	else if (pkey != NULL)
		EVP_PKEY_free(pkey);

	if (x509ptr != NULL)
		*x509ptr = x509;
	else if (x509 != NULL)
		X509_free(x509);

	return (ret);
}

  // memory is only valid for duration of callback; must be copied if queueing
  // is required
  DtlsSocketContext::DtlsSocketContext() {
      started = false;
      mSocket = NULL;
      receiver = NULL;
      DtlsSocketContext::Init();

      ELOG_DEBUG("Creating Dtls factory, Openssl v %s", OPENSSL_VERSION_TEXT);

      mContext = SSL_CTX_new(DTLSv1_method());
      assert(mContext);

      int r = SSL_CTX_use_certificate(mContext, mCert);
      assert(r == 1);

      r = SSL_CTX_use_PrivateKey(mContext, privkey);
      assert(r == 1);

      SSL_CTX_set_cipher_list(mContext, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");

      SSL_CTX_set_info_callback(mContext, SSLInfoCallback);

      SSL_CTX_set_verify(mContext, SSL_VERIFY_PEER |SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
        SSLVerifyCallback);

      // SSL_CTX_set_session_cache_mode(mContext, SSL_SESS_CACHE_OFF);
      // SSL_CTX_set_options(mContext, SSL_OP_NO_TICKET);
      // Set SRTP profiles
      r = SSL_CTX_set_tlsext_use_srtp(mContext, DefaultSrtpProfile);
      assert(r == 0);

      SSL_CTX_set_verify_depth(mContext, 2);
      SSL_CTX_set_read_ahead(mContext, 1);

      ELOG_DEBUG("DtlsSocketContext %p created", this);
    }

void SSLContext::loadPrivateKeyFromBufferPEM(folly::StringPiece pkey) {
  if (pkey.data() == nullptr) {
    throw std::invalid_argument("loadPrivateKey: <pkey> is nullptr");
  }

  ssl::BioUniquePtr bio(BIO_new(BIO_s_mem()));
  if (bio == nullptr) {
    throw std::runtime_error("BIO_new: " + getErrors());
  }

  int written = BIO_write(bio.get(), pkey.data(), pkey.size());
  if (written <= 0 || static_cast<unsigned>(written) != pkey.size()) {
    throw std::runtime_error("BIO_write: " + getErrors());
  }

  ssl::EvpPkeyUniquePtr key(
      PEM_read_bio_PrivateKey(bio.get(), nullptr, nullptr, nullptr));
  if (key == nullptr) {
    throw std::runtime_error("PEM_read_bio_PrivateKey: " + getErrors());
  }

  if (SSL_CTX_use_PrivateKey(ctx_, key.get()) == 0) {
    throw std::runtime_error("SSL_CTX_use_PrivateKey: " + getErrors());
  }
}

/**
 * @brief load private key into the SSL context
 */
int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx,
                                const unsigned char *d, long len)
{
    int ret;
    EVP_PKEY *pk;

    pk = d2i_PrivateKey(0, NULL, &d, len);
    if (!pk) {
        SSL_DEBUG(SSL_PKEY_ERROR_LEVEL, "d2i_PrivateKey() return NULL");
        goto failed1;
    }

    ret = SSL_CTX_use_PrivateKey(ctx, pk);
    if (!ret) {
        SSL_DEBUG(SSL_PKEY_ERROR_LEVEL, "SSL_CTX_use_PrivateKey() return %d", ret);
        goto failed2;
    }

    return 1;

failed2:
    EVP_PKEY_free(pk);
failed1:
    return 0;
}

void ContextImpl::setIdentity(const Certificate& cert)
{
    if( ! cert.impl()->pkey() )
        throw InvalidCertificate("invalid certificate");

    if(_pkey)
        EVP_PKEY_free(_pkey);
    _pkey = 0;

    if(_x509)
        X509_free(_x509);
    _x509 = 0;

    _x509 = copyX509( cert.impl()->x509() );
    _pkey = copyPrivateKey( cert.impl()->pkey() );

    if( ! SSL_CTX_use_certificate(_ctx, _x509) )
    {
        throw InvalidCertificate("invalid certificate");
    }

    if( ! SSL_CTX_use_PrivateKey( _ctx, _pkey ) )
    {
        throw InvalidCertificate("invalid certificate");
    }
    
    // openssl will not check the private key of this context against the 
    // certifictate. TO do so call SSL_CTX_check_private_key(_ctx)
}

int CSSLClient::SSL_CTX_use_PrivateKey_file_pass(SSL_CTX *ctx,const char *pFileName,char *pPass)
{
	EVP_PKEY     *pkey = NULL;
	BIO          *pBIO = NULL;

	pBIO = BIO_new(BIO_s_file());
	BIO_read_filename(pBIO, pFileName);

	pkey = PEM_read_bio_PrivateKey(pBIO, NULL, NULL, pPass);

	if(pkey == NULL)
	{
		printf("PEM_read_bio_PrivateKey err");
		return -1;
	}

	if (SSL_CTX_use_PrivateKey(ctx,pkey) <= 0)
	{
		printf("SSL_CTX_use_PrivateKey err\n");
		return -1;
	}

	BIO_free(pBIO);

	return 1;

}

bool VSslServer::setKeyCrtStuff(VError& error, SSL_CTX* ctx, EVP_PKEY* key, X509* crt)
{
  LOG_ASSERT(key != NULL);
  LOG_ASSERT(crt != NULL);

  int res = SSL_CTX_use_certificate(ctx, crt);
  if (res <= 0)
  {
    error = VSslError(QString("SSL_CTX_use_certificate return %1").arg(res), VSslError::IN_SSL_CTX_USE_CERTIFICATE);
    return false;
  }

  res = SSL_CTX_use_PrivateKey(ctx, key);
  if (res <= 0)
  {
    error = VSslError(QString("SSL_CTX_use_PrivateKey return %1").arg(res), VSslError::SSL_CTX_USER_PRIVATEKEY);
    return false;
  }

  res = SSL_CTX_check_private_key(ctx);
  if (!res)
  {
    error = VSslError(QString("SSL_CTX_check_private_key return %1").arg(res), VSslError::SSL_CTX_CHECK_PRIVATEKEY);
    return false;
  }

  return true;
}

bool
SSLContext::Init(X509 *pCert, EVP_PKEY *pPrivatekey){
	int nLockCt = CRYPTO_num_locks();
	InitializeCryptoLocks(nLockCt);

#ifdef _DEBUG
    CRYPTO_malloc_debug_init();
    CRYPTO_dbg_set_options	(V_CRYPTO_MDEBUG_ALL);
    CRYPTO_mem_ctrl			(CRYPTO_MEM_CHECK_ON);
#endif
	
	CRYPTO_set_locking_callback			(&ssl_lock_callback);
    CRYPTO_set_dynlock_create_callback	(&ssl_lock_dyn_create_callback);
	CRYPTO_set_dynlock_lock_callback	(&ssl_lock_dyn_callback);
    CRYPTO_set_dynlock_destroy_callback	(&ssl_lock_dyn_destroy_callback);

    SSL_load_error_strings	();
    SSL_library_init		();

	// Initialize and verify SSL context. {{
	const SSL_METHOD* meth = SSLv23_method();
	m_pssl_ctx = SSL_CTX_new(meth);
	SSL_CTX_set_verify(m_pssl_ctx, SSL_VERIFY_NONE, nullptr);
	// }}

#ifdef _SERVER
	SSL_CTX_set_options(m_pssl_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE); 
#endif

	if( pCert )
		SSL_CTX_use_certificate	(m_pssl_ctx, pCert);
	if( pPrivatekey )
		SSL_CTX_use_PrivateKey	(m_pssl_ctx, pPrivatekey);
	return true;
	}

int SSL_CTX_use_PrivateKey_file_pass (SSL_CTX * ctx, char *filename, char *pass)
{
    EVP_PKEY *pkey = NULL;

    BIO *key = NULL;

    key = BIO_new (BIO_s_file ());
    BIO_read_filename (key, filename);
    pkey = PEM_read_bio_PrivateKey (key, NULL, NULL, pass);
    if (pkey == NULL)

    {
        printf ("PEM_read_bio_PrivateKey err");
        return -1;
    }

    //加载客户端私钥
    if (SSL_CTX_use_PrivateKey (ctx, pkey) <= 0)

    {
        printf ("SSL_CTX_use_PrivateKey err\n");
        return -1;
    }
    BIO_free (key);
    return 1;
}

int
set_cert_key_stuff(SSL_CTX * ctx, X509 * cert, EVP_PKEY * key)
{
	if (cert == NULL)
		return 1;
	if (SSL_CTX_use_certificate(ctx, cert) <= 0) {
		BIO_printf(bio_err, "error setting certificate\n");
		ERR_print_errors(bio_err);
		return 0;
	}
	if (SSL_CTX_use_PrivateKey(ctx, key) <= 0) {
		BIO_printf(bio_err, "error setting private key\n");
		ERR_print_errors(bio_err);
		return 0;
	}
	/*
	 * Now we know that a key and cert have been set against the SSL
	 * context
	 */
	if (!SSL_CTX_check_private_key(ctx)) {
		BIO_printf(bio_err,
		    "Private key does not match the certificate public key\n");
		return 0;
	}
	return 1;
}

static CURLcode sslctxfun( CURL * curl, void * sslctx, void * parm ) {

	sslctxparm * p = (sslctxparm *) parm;
	SSL_CTX * ctx = (SSL_CTX *) sslctx ;

	if ( !SSL_CTX_use_certificate( ctx,p->usercert ) ) {
		BIO_printf( p->errorbio, "SSL_CTX_use_certificate problem\n" ); goto err;
	}
	if ( !SSL_CTX_use_PrivateKey( ctx,p->pkey ) ) {
		BIO_printf( p->errorbio, "SSL_CTX_use_PrivateKey\n" ); goto err;
	}

	if ( !SSL_CTX_check_private_key( ctx ) ) {
		BIO_printf( p->errorbio, "SSL_CTX_check_private_key\n" ); goto err;
	}

	SSL_CTX_set_quiet_shutdown( ctx,1 );
	SSL_CTX_set_cipher_list( ctx,"RC4-MD5" );
	SSL_CTX_set_mode( ctx, SSL_MODE_AUTO_RETRY );

	X509_STORE_add_cert( ctx->cert_store,sk_X509_value( p->ca,sk_X509_num( p->ca ) - 1 ) );

	SSL_CTX_set_verify_depth( ctx,2 );

	SSL_CTX_set_verify( ctx,SSL_VERIFY_PEER,NULL );

	SSL_CTX_set_cert_verify_callback( ctx, ssl_app_verify_callback, parm );


	return CURLE_OK ;
err:
	ERR_print_errors( p->errorbio );
	return CURLE_SSL_CERTPROBLEM;

}

static int
tls_sc_set_key(lua_State *L) {
  tls_sc_t *ctx;
  EVP_PKEY* key;
  BIO *bio;
  const char *passpharse = NULL;
  const char *keystr = NULL;
  size_t klen = 0;
  size_t plen = 0;

  ctx = getSC(L);

  keystr = luaL_checklstring(L, 2, &klen);
  passpharse = luaL_optlstring(L, 3, NULL, &plen);

  bio = str2bio(keystr, klen);
  if (!bio) {
    return luaL_error(L, "tls_sc_set_key: Failed to convert Key into a BIO");
  }

  ERR_clear_error();

  /* If the 3rd arg is NULL, the 4th arg is treated as a const char* istead of void* */
  key = PEM_read_bio_PrivateKey(bio, NULL, NULL, (void*)passpharse);

  if (!key) {
    return tls_fatal_error(L);
  }

  SSL_CTX_use_PrivateKey(ctx->ctx, key);
  EVP_PKEY_free(key);
  BIO_free(bio);

  return 0;
}

static int
use_inline_PrivateKey_file (SSL_CTX *ctx, const char *key_string)
{
  BIO *in = NULL;
  EVP_PKEY *pkey = NULL;
  int ret = 0;

  in = BIO_new_mem_buf ((char *)key_string, -1);
  if (!in)
    goto end;

  pkey = PEM_read_bio_PrivateKey (in,
				  NULL,
				  ctx->default_passwd_callback,
				  ctx->default_passwd_callback_userdata);
  if (!pkey)
    goto end;

  ret = SSL_CTX_use_PrivateKey (ctx, pkey);

 end:
  if (pkey)
    EVP_PKEY_free (pkey);
  if (in)
    BIO_free (in);
  return ret;
}

int
useCertFile(SSL_CTX* ctx, const char* path, const char* passphrase, const char* cacertfile)
{
    FILE *p12_file;
    PKCS12 *p12_cert = NULL;
    EVP_PKEY *pkey;
    X509 *x509_cert;
    
    p12_file = fopen(path, "r");
    if (!p12_file)
    {
        timestamp_f(stderr);
        perror(path);
        return -1;
    }

    d2i_PKCS12_fp(p12_file, &p12_cert);
    fclose(p12_file);

    if (!PKCS12_parse(p12_cert, passphrase, &pkey, &x509_cert, NULL))
    {
        int error = ERR_get_error();
        timestamp_f(stderr);
        fprintf(stderr, "failed to parse p12 file; error %d\n", error);
        PKCS12_free(p12_cert);
        return -1;
    }
    PKCS12_free(p12_cert);

    if (!SSL_CTX_use_certificate(ctx, x509_cert))
    {
        int error = ERR_get_error();
        timestamp_f(stderr);
        fprintf(stderr, "failed to set cert for SSL context; error %d\n", error);
        X509_free(x509_cert);
        EVP_PKEY_free(pkey);
        return -1;
    }
    X509_free(x509_cert);

    if (!SSL_CTX_use_PrivateKey(ctx, pkey))
    {
        int error = ERR_get_error();
        timestamp_f(stderr);
        fprintf(stderr, "failed to set private key for SSL context; error %d\n", error);
        EVP_PKEY_free(pkey);
        return -1;
    }
    EVP_PKEY_free(pkey);

    if (cacertfile && *cacertfile && !SSL_CTX_load_verify_locations(ctx, cacertfile, NULL))
    {
        timestamp_f(stderr);
        fprintf(stderr, "failed to load root cert for verification from %s\n", cacertfile);
        return -1;
    }

    return 0;
}