C++ SSL_get_cipher函数代码示例

int encrypt_connect_server()
{
    //return -1;
    /* SSL initialization*/
    SSL_library_init();
    OpenSSL_add_all_algorithms();
    SSL_load_error_strings();
    ctx = SSL_CTX_new(TLSv1_client_method());
    if (ctx == NULL)
    {
        ERR_print_errors_fp(stdout);
        exit(1);
    }
    /* creat a new SSL based on ctx */
    ssl = SSL_new(ctx);
    // connect ssl to TCP SOCKET
    SSL_set_fd(ssl, sockfd);
    /* create ssl connection */
    if (SSL_connect(ssl) == -1 || strcmp("(NONE)",SSL_get_cipher(ssl)) == 0)
    {
        ERR_print_errors_fp(stderr);
        return -1;
    }
    DEBUG_printf("Connected with %s encryption\n", SSL_get_cipher(ssl));
    ShowCerts(ssl);
    return 1;
}

datum_t
ssl_cipher(PG_FUNC_ARGS)
{
	if (proc_port->ssl == NULL)
		RET_NULL();
	RET_TEXT_P(cstring_to_text(SSL_get_cipher(proc_port->ssl)));
}

bool SSLSocket::waitAccepted(uint64_t millis) {
	if(!ssl) {
		if(!Socket::waitAccepted(millis)) {
			return false;
		}
		ssl.reset(SSL_new(ctx));
		if(!ssl)
			checkSSL(-1);

		checkSSL(SSL_set_fd(ssl, sock));
	}

	if(SSL_is_init_finished(ssl)) {
		return true;
	}

	while(true) {
		int ret = SSL_accept(ssl);
		if(ret == 1) {
			dcdebug("Connected to SSL client using %s\n", SSL_get_cipher(ssl));
#ifndef HEADER_OPENSSLV_H
			finished = true;
#endif
			return true;
		}
		if(!waitWant(ret, millis)) {
			return false;
		}
	}
}

std::string TLSSocket::Cipher() const
{
  if (!session) return "NONE";
  const char* cipher = SSL_get_cipher(session);
  if (!cipher) return "NONE";
  return cipher;
}

bool SSLSocket::waitAccepted(uint64_t millis) {
	if(!ssl) {
		if(!Socket::waitAccepted(millis)) {
			return false;
		}
		ssl.reset(SSL_new(ctx));
		if(!ssl)
			checkSSL(-1);

		if(!verifyData) {
			SSL_set_verify(ssl, SSL_VERIFY_NONE, NULL);
		} else SSL_set_ex_data(ssl, CryptoManager::idxVerifyData, verifyData.get());

		checkSSL(SSL_set_fd(ssl, static_cast<int>(getSock())));
	}

	if(SSL_is_init_finished(ssl)) {
		return true;
	}

	while(true) {
		int ret = SSL_accept(ssl);
		if(ret == 1) {
			dcdebug("Connected to SSL client using %s\n", SSL_get_cipher(ssl));
			return true;
		}
		if(!waitWant(ret, millis)) {
			return false;
		}
	}
}

int      kn_sock_sslconnect(//engine_t e,
		                  handle_t h,
		                  kn_sockaddr *remote,
		                  kn_sockaddr *local){
	if(h->type != KN_SOCKET && ((kn_socket*)h)->type != SOCK_STREAM)
		return 0;
	kn_socket *s = (kn_socket*)h;
	if(h->status != SOCKET_NONE) return -1;
	//if(s->e) return -1;
	SSL_CTX *ctx = SSL_CTX_new(SSLv23_client_method());
	if (ctx == NULL) {
	    ERR_print_errors_fp(stdout);
	    return -1;
	}
    	((kn_stream_socket*)s)->ctx = ctx;		
	s->addr_remote = *remote;
	int ret = stream_socket_connect((kn_stream_socket*)s,local,remote);
	if(ret == 1){
		((kn_stream_socket*)s)->ssl = SSL_new(ctx);
		SSL_set_fd(((kn_stream_socket*)s)->ssl,h->fd);
		if (SSL_connect(((kn_stream_socket*)s)->ssl) == -1){
		        ERR_print_errors_fp(stderr);
		        ret = -1;
		}
		else {
		        kn_set_noblock(h->fd,0);
		        h->status = SOCKET_ESTABLISH;
		        printf("Connected with %s encryption/n", SSL_get_cipher(((kn_stream_socket*)s)->ssl));
		        ShowCerts(((kn_stream_socket*)s)->ssl);
		}		
	}else{
		ret = -1;
	}	
	return ret;	
}

int 
openhost(char *host, int port)
{
	struct hostent *hp;
	register int s;
	struct sockaddr_in sin;
	int     err;
	X509   *server_cert;
	char   *str;

	if ((hp = gethostbyname(host)) == NULL) {
		printf("ERR: gethostbyname\n");
		return (-1);
	}
	if ((s = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
		perror("socket");
		return (-1);
	}
	sin.sin_family = AF_INET;
	sin.sin_port = htons(port);
	bcopy(hp->h_addr, &sin.sin_addr, hp->h_length);

	alarm(30);
	if (connect(s, (struct sockaddr *) &sin, sizeof(sin)) < 0)
		return (-1);
	alarm(0);

	SSLeay_add_ssl_algorithms();
	SSL_load_error_strings();
	/* ctx = SSL_CTX_new (SSLv23_method());                     CHK_NULL(ctx);
	 */
	ctx = SSL_CTX_new(SSLv2_method());
	CHK_NULL(ctx);

	ssl = SSL_new(ctx);
	CHK_NULL(ssl);
	SSL_set_fd(ssl, s);
	err = SSL_connect(ssl);
	CHK_SSL(err);

	printf("SSL connection using %s\n", SSL_get_cipher(ssl));

	server_cert = SSL_get_peer_certificate(ssl);
	CHK_NULL(server_cert);
	printf("Server certificate:\n");

	str = X509_NAME_oneline(X509_get_subject_name(server_cert), NULL, 0);
	CHK_NULL(str);
	printf("\t subject: %s\n", str);
	Free(str);

	str = X509_NAME_oneline(X509_get_issuer_name(server_cert), NULL, 0);
	CHK_NULL(str);
	printf("\t issuer: %s\n", str);
	Free(str);

	X509_free(server_cert);

	return (s);
}

int
tls_get_conninfo(struct tls *ctx) {
	const char * tmp;

	tls_free_conninfo(ctx->conninfo);

	if (ctx->ssl_peer_cert != NULL) {
		if (tls_get_peer_cert_hash(ctx, &ctx->conninfo->hash) == -1)
			goto err;
		if (tls_get_peer_cert_subject(ctx, &ctx->conninfo->subject)
		    == -1)
			goto err;
		if (tls_get_peer_cert_issuer(ctx, &ctx->conninfo->issuer) == -1)
			goto err;
		if (tls_get_peer_cert_times(ctx, &ctx->conninfo->notbefore,
		    &ctx->conninfo->notafter) == -1)
			goto err;
	}
	if ((tmp = SSL_get_version(ctx->ssl_conn)) == NULL)
		goto err;
	ctx->conninfo->version = strdup(tmp);
	if (ctx->conninfo->version == NULL)
		goto err;
	if ((tmp = SSL_get_cipher(ctx->ssl_conn)) == NULL)
		goto err;
	ctx->conninfo->cipher = strdup(tmp);
	if (ctx->conninfo->cipher == NULL)
		goto err;
	return (0);
err:
	tls_free_conninfo(ctx->conninfo);
	return (-1);
}

/*
 * printSSLInfo
 *
 * Prints information about the current SSL connection, if SSL is in use
 */
static void
printSSLInfo(void)
{
#ifdef USE_SSL
	int			sslbits = -1;
	SSL		   *ssl;

	ssl = PQgetssl(pset.db);
	if (!ssl)
		return;					/* no SSL */

	SSL_get_cipher_bits(ssl, &sslbits);
	printf(_("SSL connection (cipher: %s, bits: %i)\n"),
		   SSL_get_cipher(ssl), sslbits);
#else

	/*
	 * If psql is compiled without SSL but is using a libpq with SSL, we
	 * cannot figure out the specifics about the connection. But we know it's
	 * SSL secured.
	 */
	if (PQgetssl(pset.db))
		printf(_("SSL connection (unknown cipher)\n"));
#endif
}

bool SSLSocket::waitAccepted(uint32_t millis) {
    if(!ssl) {
        if(!Socket::waitAccepted(millis)) {
            return false;
        }
        ssl.reset(SSL_new(ctx));
        if(!ssl)
            checkSSL(-1);

        checkSSL(SSL_set_fd(ssl, getSock()));
    }

    if(SSL_is_init_finished(ssl)) {
        return true;
    }

    while(true) {
        int ret = SSL_accept(ssl);
        if(ret == 1) {
            dcdebug("Connected to SSL client using %s\n", SSL_get_cipher(ssl));
            return true;
        }
        if(!waitWant(ret, millis)) {
            return false;
        }
    }
}

Datum
ssl_cipher(PG_FUNCTION_ARGS)
{
	if (MyProcPort->ssl == NULL)
		PG_RETURN_NULL();
	PG_RETURN_TEXT_P(cstring_to_text(SSL_get_cipher(MyProcPort->ssl)));
}

static int ssl_connect(int sd)
{
	char buf[256];
	X509 *cert;

	SSL_set_fd(ssl, sd);
	if (-1 == SSL_connect(ssl))
		return -1;

	DBG("SSL connection using %s", SSL_get_cipher(ssl));

	/* Get server's certificate (note: beware of dynamic allocation) - opt */
	cert = SSL_get_peer_certificate(ssl);
	if (!cert)
		return -1;

	/* Logging some cert details. Please note: X509_NAME_oneline doesn't
	   work when giving NULL instead of a buffer. */
	X509_NAME_oneline(X509_get_subject_name(cert), buf, sizeof(buf));
	DBG("SSL server cert subject: %s", buf);
	X509_NAME_oneline(X509_get_issuer_name(cert), buf, sizeof(buf));
	DBG("SSL server cert issuer: %s", buf);

	/* We could do all sorts of certificate verification stuff here before
	   deallocating the certificate. */
	X509_free(cert);

	return 0;
}

THREAD_RETURN YASSL_API server_test(void* args)
{
#ifdef _WIN32
    WSADATA wsd;
    WSAStartup(0x0002, &wsd);
#endif

    SOCKET_T sockfd   = 0;
    SOCKET_T clientfd = 0;
    int      argc     = 0;
    char**   argv     = 0;

    set_args(argc, argv, *static_cast<func_args*>(args));
    tcp_accept(sockfd, clientfd, *static_cast<func_args*>(args));

    tcp_close(sockfd);

    SSL_METHOD* method = TLSv1_server_method();
    SSL_CTX*    ctx = SSL_CTX_new(method);

    //SSL_CTX_set_cipher_list(ctx, "RC4-SHA:RC4-MD5");
    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, 0);
    set_serverCerts(ctx);
    DH* dh = set_tmpDH(ctx);

    SSL* ssl = SSL_new(ctx);
    SSL_set_fd(ssl, clientfd);

#ifdef NON_BLOCKING
    NonBlockingSSL_Accept(ssl, ctx, clientfd);
#else
    if (SSL_accept(ssl) != SSL_SUCCESS)
        ServerError(ctx, ssl, clientfd, "SSL_accept failed");
#endif
     
    showPeer(ssl);
    printf("Using Cipher Suite: %s\n", SSL_get_cipher(ssl));

    char command[1024];
    int input = SSL_read(ssl, command, sizeof(command));
    if (input > 0) {
        command[input] = 0;
        printf("First client command: %s\n", command);
    }

    char msg[] = "I hear you, fa shizzle!";
    if (SSL_write(ssl, msg, sizeof(msg)) != sizeof(msg))
        ServerError(ctx, ssl, clientfd, "SSL_write failed");

    DH_free(dh);
    SSL_CTX_free(ctx);
    SSL_shutdown(ssl);
    SSL_free(ssl);

    tcp_close(clientfd);

    ((func_args*)args)->return_code = 0;
    return 0;
}

void
be_tls_get_cipher(Port *port, char *ptr, size_t len)
{
	if (port->ssl)
		strlcpy(ptr, SSL_get_cipher(port->ssl), len);
	else
		ptr[0] = '\0';
}

const char *
be_tls_get_cipher(Port *port)
{
	if (port->ssl)
		return SSL_get_cipher(port->ssl);
	else
		return NULL;
}