C++ SSL_CTX_use_RSAPrivateKey函数代码示例

int
tls_ctx_use_external_private_key (struct tls_root_ctx *ctx, X509 *cert)
{
  RSA *rsa = NULL;
  RSA *pub_rsa;
  RSA_METHOD *rsa_meth;

  ASSERT (NULL != ctx);
  ASSERT (NULL != cert);

  /* allocate custom RSA method object */
  ALLOC_OBJ_CLEAR (rsa_meth, RSA_METHOD);
  rsa_meth->name = "OpenVPN external private key RSA Method";
  rsa_meth->rsa_pub_enc = rsa_pub_enc;
  rsa_meth->rsa_pub_dec = rsa_pub_dec;
  rsa_meth->rsa_priv_enc = rsa_priv_enc;
  rsa_meth->rsa_priv_dec = rsa_priv_dec;
  rsa_meth->init = NULL;
  rsa_meth->finish = rsa_finish;
  rsa_meth->flags = RSA_METHOD_FLAG_NO_CHECK;
  rsa_meth->app_data = NULL;

  /* allocate RSA object */
  rsa = RSA_new();
  if (rsa == NULL)
    {
      SSLerr(SSL_F_SSL_USE_PRIVATEKEY, ERR_R_MALLOC_FAILURE);
      goto err;
    }

  /* get the public key */
  ASSERT(cert->cert_info->key->pkey); /* NULL before SSL_CTX_use_certificate() is called */
  pub_rsa = cert->cert_info->key->pkey->pkey.rsa;

  /* initialize RSA object */
  rsa->n = BN_dup(pub_rsa->n);
  rsa->flags |= RSA_FLAG_EXT_PKEY;
  if (!RSA_set_method(rsa, rsa_meth))
    goto err;

  /* bind our custom RSA object to ssl_ctx */
  if (!SSL_CTX_use_RSAPrivateKey(ctx->ctx, rsa))
    goto err;

  RSA_free(rsa); /* doesn't necessarily free, just decrements refcount */
  return 1;

 err:
  if (rsa)
    RSA_free(rsa);
  else
    {
      if (rsa_meth)
	free(rsa_meth);
    }
  msg (M_SSLERR, "Cannot enable SSL external private key capability");
  return 0;
}

void Context::usePrivateKey(const Poco::Crypto::RSAKey& key)
{
	int errCode = SSL_CTX_use_RSAPrivateKey(_pSSLContext, key.impl()->getRSA());
	if (errCode != 1)
	{
		std::string msg = Utility::getLastError();
		throw SSLContextException("Cannot set private key for Context", msg);
	}
}

int EdSSLContext::setSSLCertMem(void* crt, int crtlen, void* key, int keylen)
{
	X509* xcert = d2i_X509(NULL, (const unsigned char**)&crt, crtlen);
	SSL_CTX_use_certificate(mCtx, xcert);

	RSA *pkey = d2i_RSAPrivateKey(NULL, (const unsigned char**)&key, keylen);
	SSL_CTX_use_RSAPrivateKey(mCtx, pkey);
	return 0;
}

void SSLContext::usePrivateKey(const crypto::RSAKey& key)
{
    int errCode = SSL_CTX_use_RSAPrivateKey(_sslContext, const_cast<RSA*>(&key));
    if (errCode != 1)
    {
        std::string msg = getLastError();
        throw std::runtime_error("SSL Error: Cannot set private key for Context: " + msg);
    }
}

int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const uint8_t *der,
                                   size_t der_len) {
  RSA *rsa = RSA_private_key_from_bytes(der, der_len);
  if (rsa == NULL) {
    OPENSSL_PUT_ERROR(SSL, ERR_R_ASN1_LIB);
    return 0;
  }

  int ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
  RSA_free(rsa);
  return ret;
}

CSSLServerApplication::CSSLServerApplication() : CSSLApplication()
{
	const SSL_METHOD* method;

	SSLMode = MODE_SSL_SERVER;
	NeedDataOp = OP_CLIENT_READ;

	// Create new context from method.
	method = SSLv23_server_method();
	ctx = SSL_CTX_new(method);

	//	These are for load certificate data from memory
	X509 *cert = NULL;
	RSA *rsa = NULL;
	BIO *cbio, *kbio;

	cbio = BIO_new_mem_buf((void*)cert_data, -1);
	cert = PEM_read_bio_X509(cbio, NULL, 0, NULL);
	ASSERT(cert != NULL);
	if (SSL_CTX_use_certificate(ctx, cert) <= 0)
	{
		ERR_print_errors_fp(stdout);
		exit(1);
	}

	kbio = BIO_new_mem_buf((void*)pkey_data, -1);
	rsa = PEM_read_bio_RSAPrivateKey(kbio, NULL, 0, NULL);
	ASSERT(rsa != NULL);
	if (SSL_CTX_use_RSAPrivateKey(ctx, rsa) <= 0)
	{
		ERR_print_errors_fp(stdout);
		exit(1);
	}

// 		for read from file, use this
// 		if (SSL_CTX_use_certificate_file(ctx, "Z:\\Develop\\opensslbin\\server.pem", SSL_FILETYPE_PEM) <= 0)
// 		{
// 			ERR_print_errors_fp(stdout);
// 			exit(1);
// 		}
// 		if (SSL_CTX_use_PrivateKey_file(ctx, "Z:\\Develop\\opensslbin\\ca-nocap.key", SSL_FILETYPE_PEM) <= 0)
// 		{
// 			ERR_print_errors_fp(stdout);
// 			exit(1);
// 		}

	if (!SSL_CTX_check_private_key(ctx))
		cerr << "Private key is invalid." << endl;
	else
		cout << "Private key is OK" << endl;

	return;
}

wi_boolean_t wi_socket_tls_set_private_key(wi_socket_tls_t *tls, wi_rsa_t *rsa) {
	tls->private_key = false;
	
	if(SSL_CTX_use_RSAPrivateKey(tls->ssl_ctx, wi_rsa_rsa(rsa)) != 1) {
		wi_error_set_openssl_error();

		return false;
	}
	
	tls->private_key = true;
	
	return true;
}

int
SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len)
{
	int ret;
	RSA *rsa;

	if ((rsa = d2i_RSAPrivateKey(NULL, &d, (long)len)) == NULL) {
		SSLerrorx(ERR_R_ASN1_LIB);
		return (0);
	}

	ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
	RSA_free(rsa);
	return (ret);
}

int SSL_CTX_use_RSAPrivateKey_file (SSL_CTX * ctx, const char *file, int type)
{
    int j, ret = 0;

    BIO *in;

    RSA *rsa = NULL;

    in = BIO_new (BIO_s_file_internal ());
    if (in == NULL)
    {
        SSLerr (SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
        goto end;
    }

    if (BIO_read_filename (in, file) <= 0)
    {
        SSLerr (SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB);
        goto end;
    }
    if (type == SSL_FILETYPE_ASN1)
    {
        j = ERR_R_ASN1_LIB;
        rsa = d2i_RSAPrivateKey_bio (in, NULL);
    }
    else if (type == SSL_FILETYPE_PEM)
    {
        j = ERR_R_PEM_LIB;
        rsa = PEM_read_bio_RSAPrivateKey (in, NULL,
                                          ctx->default_passwd_callback, ctx->default_passwd_callback_userdata);
    }
    else
    {
        SSLerr (SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
        goto end;
    }
    if (rsa == NULL)
    {
        SSLerr (SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, j);
        goto end;
    }
    ret = SSL_CTX_use_RSAPrivateKey (ctx, rsa);
    RSA_free (rsa);
  end:
    if (in != NULL)
        BIO_free (in);
    return (ret);
}

int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len)
	{
	int ret;
	const unsigned char *p;
	RSA *rsa;

	p=d;
	if ((rsa=d2i_RSAPrivateKey(NULL,&p,(long)len)) == NULL)
		{
		SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1,ERR_R_ASN1_LIB);
		return(0);
		}

	ret=SSL_CTX_use_RSAPrivateKey(ctx,rsa);
	RSA_free(rsa);
	return(ret);
	}

  static void
  tls_load_from_memory(SSL_CTX* ctx,
                       fs::Buffer cert_buffer,
                       fs::Buffer key_buffer)
  {
    auto* cbio = BIO_new_mem_buf(cert_buffer.data(), cert_buffer.size());
    auto* cert = PEM_read_bio_X509(cbio, NULL, 0, NULL);
    assert(cert != NULL);
    SSL_CTX_use_certificate(ctx, cert);
    BIO_free(cbio);

    auto* kbio = BIO_new_mem_buf(key_buffer.data(), key_buffer.size());
    auto* key = PEM_read_bio_RSAPrivateKey(kbio, NULL, 0, NULL);
    assert(key != NULL);
    SSL_CTX_use_RSAPrivateKey(ctx, key);
    BIO_free(kbio);
  }

void ThreadedSSLSocketInitiator::onInitialize(const SessionSettings &s) throw(
    RuntimeError)
{
  if (m_sslInit)
    return;

  ssl_init();

  std::string errStr;

  /* set up the application context */
  if ((m_ctx = createSSLContext(false, m_settings, errStr)) == 0)
  {
    throw RuntimeError(errStr);
  }

  if (m_cert && m_key)
  {
    if (SSL_CTX_use_certificate(m_ctx, m_cert) < 1)
    {
      ssl_term();
      throw RuntimeError("Failed to set certificate");
    }

    if (SSL_CTX_use_RSAPrivateKey(m_ctx, m_key) <= 0)
    {
      ssl_term();
      throw RuntimeError("Failed to set key");
    }
  }
  else if (!loadSSLCert(m_ctx, false, m_settings, getLog(), ThreadedSSLSocketInitiator::passwordHandleCB, errStr))
  {
    ssl_term();
    throw RuntimeError(errStr);
  }

  int verifyLevel;
  if (!loadCAInfo(m_ctx, false, m_settings, getLog(), errStr, verifyLevel))
  {
    ssl_term();
    throw RuntimeError(errStr);
  }

  m_sslInit = true;
}

int
amqp_ssl_socket_set_key_buffer(amqp_socket_t *base,
                               const char *cert,
                               const void *key,
                               size_t n)
{
  int status = AMQP_STATUS_OK;
  BIO *buf = NULL;
  RSA *rsa = NULL;
  struct amqp_ssl_socket_t *self;
  if (base->klass != &amqp_ssl_socket_class) {
    amqp_abort("<%p> is not of type amqp_ssl_socket_t", base);
  }
  if (n > INT_MAX) {
    return AMQP_STATUS_INVALID_PARAMETER;
  }
  self = (struct amqp_ssl_socket_t *)base;
  status = SSL_CTX_use_certificate_chain_file(self->ctx, cert);
  if (1 != status) {
    return AMQP_STATUS_SSL_ERROR;
  }
  buf = BIO_new_mem_buf((void *)key, (int)n);
  if (!buf) {
    goto error;
  }
  rsa = PEM_read_bio_RSAPrivateKey(buf, NULL, password_cb, NULL);
  if (!rsa) {
    goto error;
  }
  status = SSL_CTX_use_RSAPrivateKey(self->ctx, rsa);
  if (1 != status) {
    goto error;
  }
exit:
  BIO_vfree(buf);
  RSA_free(rsa);
  return status;
error:
  status = AMQP_STATUS_SSL_ERROR;
  goto exit;
}

static int setKeyFile(SSL_CTX *ctx, cchar *keyFile)
{
    RSA     *key;
    BIO     *bio;
    char    *buf;
    int     rc;

    assert(ctx);
    assert(keyFile);

    key = 0;
    bio = 0;
    buf = 0;
    rc = -1;

    if (ctx == NULL || keyFile == NULL) {
        ;

    } else if ((buf = mprReadPathContents(keyFile, NULL)) == 0) {
        mprLog("error openssl", 0, "Unable to read certificate %s", keyFile);

    } else if ((bio = BIO_new_mem_buf(buf, -1)) == 0) {
        mprLog("error openssl", 0, "Unable to allocate memory for key %s", keyFile);

    } else if ((key = PEM_read_bio_RSAPrivateKey(bio, NULL, 0, NULL)) == 0) {
        mprLog("error openssl", 0, "Unable to parse key %s", keyFile);

    } else if (SSL_CTX_use_RSAPrivateKey(ctx, key) != 1) {
        mprLog("error openssl", 0, "Unable to use key %s", keyFile);

    } else {
        rc = 0;
    }
    if (bio) {
        BIO_free(bio);
    }
    if (key) {
        RSA_free(key);
    }
    return rc;
}

int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type) {
  int reason_code, ret = 0;
  BIO *in;
  RSA *rsa = NULL;

  in = BIO_new(BIO_s_file());
  if (in == NULL) {
    OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
    goto end;
  }

  if (BIO_read_filename(in, file) <= 0) {
    OPENSSL_PUT_ERROR(SSL, ERR_R_SYS_LIB);
    goto end;
  }

  if (type == SSL_FILETYPE_ASN1) {
    reason_code = ERR_R_ASN1_LIB;
    rsa = d2i_RSAPrivateKey_bio(in, NULL);
  } else if (type == SSL_FILETYPE_PEM) {
    reason_code = ERR_R_PEM_LIB;
    rsa = PEM_read_bio_RSAPrivateKey(in, NULL, ctx->default_passwd_callback,
                                     ctx->default_passwd_callback_userdata);
  } else {
    OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SSL_FILETYPE);
    goto end;
  }

  if (rsa == NULL) {
    OPENSSL_PUT_ERROR(SSL, reason_code);
    goto end;
  }
  ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
  RSA_free(rsa);

end:
  BIO_free(in);
  return ret;
}