C++ TLSv1_server_method函数代码示例

wi_boolean_t wi_socket_context_set_ssl_type(wi_socket_context_t *context, wi_socket_ssl_type_t type) {
#ifdef WI_SSL
	SSL_METHOD		*method = NULL;
	
	switch(type) {
		case WI_SOCKET_SSL_CLIENT:
			method = TLSv1_client_method();
			break;

		case WI_SOCKET_SSL_SERVER:
			method = TLSv1_server_method();
			break;
	}
	
	context->ssl_ctx = SSL_CTX_new(method);
	
	if(!context->ssl_ctx)
		wi_error_set_ssl_error();
	
	return (context->ssl_ctx != NULL);
#else
	wi_error_set_lib_error(WI_ERROR_SOCKET_NOSSL);
	
	return false;
#endif
}

const SSL_METHOD * hb_ssl_method_id_to_ptr( int n )
{
   const SSL_METHOD * p;

   switch( n )
   {
#if OPENSSL_VERSION_NUMBER < 0x10000000L
      case HB_SSL_CTX_NEW_METHOD_SSLV2:         p = SSLv2_method();         break;
      case HB_SSL_CTX_NEW_METHOD_SSLV2_SERVER:  p = SSLv2_server_method();  break;
      case HB_SSL_CTX_NEW_METHOD_SSLV2_CLIENT:  p = SSLv2_client_method();  break;
#endif
      case HB_SSL_CTX_NEW_METHOD_SSLV3:         p = SSLv3_method();         break;
      case HB_SSL_CTX_NEW_METHOD_SSLV3_SERVER:  p = SSLv3_server_method();  break;
      case HB_SSL_CTX_NEW_METHOD_SSLV3_CLIENT:  p = SSLv3_client_method();  break;
      case HB_SSL_CTX_NEW_METHOD_TLSV1:         p = TLSv1_method();         break;
      case HB_SSL_CTX_NEW_METHOD_TLSV1_SERVER:  p = TLSv1_server_method();  break;
      case HB_SSL_CTX_NEW_METHOD_TLSV1_CLIENT:  p = TLSv1_client_method();  break;
      case HB_SSL_CTX_NEW_METHOD_SSLV23:        p = SSLv23_method();        break;
      case HB_SSL_CTX_NEW_METHOD_SSLV23_SERVER: p = SSLv23_server_method(); break;
      case HB_SSL_CTX_NEW_METHOD_SSLV23_CLIENT: p = SSLv23_client_method(); break;
      default: p = SSLv23_method();
   }

   return p;
}

/* Init library and load specified certificate.
 * Establishes a SSL_ctx, to act as a template for
 * each connection */
static SSL_CTX * init_openssl() {
    SSL_library_init();
    SSL_load_error_strings();
    SSL_CTX *ctx = NULL;

    if (OPTIONS.ETYPE == ENC_TLS)
        ctx = SSL_CTX_new(TLSv1_server_method());
    else if (OPTIONS.ETYPE == ENC_SSL)
        ctx = SSL_CTX_new(SSLv23_server_method());
    else
        assert(OPTIONS.ETYPE == ENC_TLS || OPTIONS.ETYPE == ENC_SSL);
    
    SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_ALL |
                        SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
    
    if (SSL_CTX_use_certificate_file(ctx, OPTIONS.CERT_FILE, SSL_FILETYPE_PEM) <= 0)
        ERR_print_errors_fp(stderr);
    if (SSL_CTX_use_RSAPrivateKey_file(ctx, OPTIONS.CERT_FILE, SSL_FILETYPE_PEM) <= 0)
        ERR_print_errors_fp(stderr);
    
    if (OPTIONS.CIPHER_SUITE)
        if (SSL_CTX_set_cipher_list(ctx, OPTIONS.CIPHER_SUITE) != 1)
            ERR_print_errors_fp(stderr);            

    return ctx;
}

SSL_METHOD *sycTLSv1_server_method(void) {
   SSL_METHOD *result;
   Debug("TLSv1_server_method()");
   result = TLSv1_server_method();
   Debug1("TLSv1_server_method() -> %p", result);
   return result;
}

void SSLContext::createSSLContext()
{
    switch (_usage)
    {
    case CLIENT_USE:
        _sslContext = SSL_CTX_new(SSLv23_client_method());
        break;
    case SERVER_USE:
        _sslContext = SSL_CTX_new(SSLv23_server_method());
        break;
    case TLSV1_CLIENT_USE:
        _sslContext = SSL_CTX_new(TLSv1_client_method());
        break;
    case TLSV1_SERVER_USE:
        _sslContext = SSL_CTX_new(TLSv1_server_method());
        break;
    default:
        throw std::runtime_error("SSL Exception: Invalid usage");
    }
    if (!_sslContext)  {
        unsigned long err = ERR_get_error();
        throw std::runtime_error("SSL Exception: Cannot create SSL_CTX object: " + std::string(ERR_error_string(err, 0)));
    }

    SSL_CTX_set_default_passwd_cb(_sslContext, &SSLManager::privateKeyPassphraseCallback);
    clearErrorStack();
    SSL_CTX_set_options(_sslContext, SSL_OP_ALL);
}

MSC_BOOL msc_secure_socket_library_init(MSC_LIBRARY_MODE mode)
{
	if (g_ssl_ctx) return MSC_TRUE;

	SSL_library_init();
	SSL_load_error_strings();

	if (mode == MSC_LIBRARY_CLIENT)
	{
		g_ssl_ctx = SSL_CTX_new(TLSv1_client_method());
	}
	else
	{
		g_ssl_ctx = SSL_CTX_new(TLSv1_server_method());
	}

	if (!g_ssl_ctx)
	{
		fprintf(stderr, "Error initializing OpenSSL\n");
		ERR_print_errors_fp(stderr);
		return MSC_FALSE;
	}

	return MSC_TRUE;
}

wi_socket_tls_t * wi_socket_tls_init_with_type(wi_socket_tls_t *tls, wi_socket_tls_type_t type) {
	SSL_METHOD		*method;
	
	switch(type) {
		default:
		case WI_SOCKET_TLS_CLIENT:
			method = TLSv1_client_method();
			break;

		case WI_SOCKET_TLS_SERVER:
			method = TLSv1_server_method();
			break;
	}
	
	tls->ssl_ctx = SSL_CTX_new(method);
	
	if(!tls->ssl_ctx) {
		wi_error_set_openssl_error();
		
		wi_release(NULL);
		
		return NULL;
	}
	
	SSL_CTX_set_mode(tls->ssl_ctx, SSL_MODE_AUTO_RETRY);
	SSL_CTX_set_quiet_shutdown(tls->ssl_ctx, 1);
	
	return tls;
}

BOOL CSSLTcpSocket::CreateSSLTcpSocketForServer( LPCSTR pszCertFile , LPCSTR pszKeyFile )
{
	SSL_load_error_strings(); /*为打印调试信息作准备*/ 
	OpenSSL_add_ssl_algorithms(); /*初始化*/ 

	m_meth = (SSL_METHOD *)TLSv1_server_method(); /*采用什么协议(SSLv2/SSLv3/TLSv1)在此指定,TLSv1_server_method,SSLv23_server_method()*/ 

	m_ctx = SSL_CTX_new (m_meth);

	//设置为要求强制校验对方（客户端）证书SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT
	SSL_CTX_set_verify(m_ctx,SSL_VERIFY_NONE,NULL); /*验证与否SSL_VERIFY_PEER*/ 
	//SSL_CTX_load_verify_locations(ctx,CACERT,NULL); /*若验证,则放置CA证书*/

	if (SSL_CTX_use_certificate_file(m_ctx, pszCertFile, SSL_FILETYPE_PEM) <= 0) 
	{
		printf("加载证书失败!\n");
		
	}

	if (SSL_CTX_use_PrivateKey_file(m_ctx, pszKeyFile, SSL_FILETYPE_PEM) <= 0)
	{
		printf("加载私钥失败!\n");
		
	}

	if (!SSL_CTX_check_private_key(m_ctx)) {
		printf("密钥证书不匹配！\n");
	}

	SSL_CTX_set_cipher_list(m_ctx,"DES-CBC3-SHA"); 
	SSL_CTX_set_mode(m_ctx, SSL_MODE_AUTO_RETRY);

	return CreateTcpSocket();
}

/*
 * initialize ssl methods
 */
static void
init_ssl_methods(void)
{
	LM_DBG("entered\n");

#ifndef OPENSSL_NO_SSL2
	ssl_methods[TLS_USE_SSLv2_cli - 1] = (SSL_METHOD*)SSLv2_client_method();
	ssl_methods[TLS_USE_SSLv2_srv - 1] = (SSL_METHOD*)SSLv2_server_method();
	ssl_methods[TLS_USE_SSLv2 - 1] = (SSL_METHOD*)SSLv2_method();
#endif

	ssl_methods[TLS_USE_SSLv3_cli - 1] = (SSL_METHOD*)SSLv3_client_method();
	ssl_methods[TLS_USE_SSLv3_srv - 1] = (SSL_METHOD*)SSLv3_server_method();
	ssl_methods[TLS_USE_SSLv3 - 1] = (SSL_METHOD*)SSLv3_method();

	ssl_methods[TLS_USE_TLSv1_cli - 1] = (SSL_METHOD*)TLSv1_client_method();
	ssl_methods[TLS_USE_TLSv1_srv - 1] = (SSL_METHOD*)TLSv1_server_method();
	ssl_methods[TLS_USE_TLSv1 - 1] = (SSL_METHOD*)TLSv1_method();

	ssl_methods[TLS_USE_SSLv23_cli - 1] = (SSL_METHOD*)SSLv23_client_method();
	ssl_methods[TLS_USE_SSLv23_srv - 1] = (SSL_METHOD*)SSLv23_server_method();
	ssl_methods[TLS_USE_SSLv23 - 1] = (SSL_METHOD*)SSLv23_method();

#if OPENSSL_VERSION_NUMBER >= 0x10001000L
	ssl_methods[TLS_USE_TLSv1_2_cli - 1] = (SSL_METHOD*)TLSv1_2_client_method();
	ssl_methods[TLS_USE_TLSv1_2_srv - 1] = (SSL_METHOD*)TLSv1_2_server_method();
	ssl_methods[TLS_USE_TLSv1_2 - 1] = (SSL_METHOD*)TLSv1_2_method();
#endif

}

static SSL_METHOD *tls1_get_server_method(int ver)
	{
	if (ver == TLS1_VERSION)
		return(TLSv1_server_method());
	else
		return(NULL);
	}

static int nixio_tls_ctx(lua_State * L) {
    const char *method = luaL_optlstring(L, 1, "client", NULL);

    luaL_getmetatable(L, NIXIO_TLS_CTX_META);
    SSL_CTX **ctx = lua_newuserdata(L, sizeof(SSL_CTX *));
    if (!ctx) {
        return luaL_error(L, "out of memory");
    }

    /* create userdata */
    lua_pushvalue(L, -2);
    lua_setmetatable(L, -2);

    if (!strcmp(method, "client")) {
        *ctx = SSL_CTX_new(TLSv1_client_method());
    } else if (!strcmp(method, "server")) {
        *ctx = SSL_CTX_new(TLSv1_server_method());
    } else {
        return luaL_argerror(L, 1, "supported values: client, server");
    }

    if (!(*ctx)) {
        return luaL_error(L, "unable to create TLS context");
    }

    return 1;
}

ws_ctx_t *ws_socket_ssl(int socket, char * certfile, char * keyfile) {
   int ret;
   char msg[1024];
   char * use_keyfile;
   ws_ctx_t *ctx;
   ctx = ws_socket(socket);

   if (keyfile && (keyfile[0] != '\0')) {
      // Separate key file
      use_keyfile = keyfile;
   } else {
      // Combined key and cert file
      use_keyfile = certfile;
   }

   // Initialize the library
   if (! ssl_initialized) {
      SSL_library_init();
      OpenSSL_add_all_algorithms();
      SSL_load_error_strings();
      ssl_initialized = 1;

   }

   ctx->ssl_ctx = SSL_CTX_new(TLSv1_server_method());
   if (ctx->ssl_ctx == NULL) {
      ERR_print_errors_fp(stderr);
      fatal("Failed to configure SSL context");
   }

   if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, use_keyfile,
      SSL_FILETYPE_PEM) <= 0) {
         sprintf(msg, "Unable to load private key file %s\n", use_keyfile);
         fatal(msg);
   }

   if (SSL_CTX_use_certificate_file(ctx->ssl_ctx, certfile,
      SSL_FILETYPE_PEM) <= 0) {
         sprintf(msg, "Unable to load certificate file %s\n", certfile);
         fatal(msg);
   }

   //    if (SSL_CTX_set_cipher_list(ctx->ssl_ctx, "DEFAULT") != 1) {
   //        sprintf(msg, "Unable to set cipher\n");
   //        fatal(msg);
   //    }

   // Associate socket and ssl object
   ctx->ssl = SSL_new(ctx->ssl_ctx);
   SSL_set_fd(ctx->ssl, socket);

   ret = SSL_accept(ctx->ssl);
   if (ret < 0) {
      ERR_print_errors_fp(stderr);
      return NULL;
   }

   return ctx;
}

bool SSLSocket::setupCrypto(SSLSocket *session /* = NULL */) {
  if (m_handle) {
    raise_warning("SSL/TLS already set-up for this stream");
    return false;
  }

  /* need to do slightly different things, based on client/server method,
   * so lets remember which method was selected */
#if OPENSSL_VERSION_NUMBER < 0x00909000L
  SSL_METHOD *smethod;
#else
  const SSL_METHOD *smethod;
#endif
  switch (m_method) {
  case ClientSSLv23: m_client = true;  smethod = SSLv23_client_method(); break;
  case ClientSSLv3:  m_client = true;  smethod = SSLv3_client_method();  break;
  case ClientTLS:    m_client = true;  smethod = TLSv1_client_method();  break;
  case ServerSSLv23: m_client = false; smethod = SSLv23_server_method(); break;
  case ServerSSLv3:  m_client = false; smethod = SSLv3_server_method();  break;

  /* SSLv2 protocol might be disabled in the OpenSSL library */
#ifndef OPENSSL_NO_SSL2
  case ClientSSLv2:  m_client = true;  smethod = SSLv2_client_method();  break;
  case ServerSSLv2:  m_client = false; smethod = SSLv2_server_method();  break;
#else
  case ClientSSLv2:
  case ServerSSLv2:
    raise_warning("OpenSSL library does not support SSL2 protocol");
    return false;
  break;
#endif

  case ServerTLS:    m_client = false; smethod = TLSv1_server_method();  break;
  default:
    return false;
  }

  SSL_CTX *ctx = SSL_CTX_new(smethod);
  if (ctx == nullptr) {
    raise_warning("failed to create an SSL context");
    return false;
  }

  SSL_CTX_set_options(ctx, SSL_OP_ALL);
  m_handle = createSSL(ctx);
  if (m_handle == nullptr) {
    raise_warning("failed to create an SSL handle");
    SSL_CTX_free(ctx);
    return false;
  }

  if (!SSL_set_fd(m_handle, m_fd)) {
    handleError(0, true);
  }
  if (session) {
    SSL_copy_session_id(m_handle, session->m_handle);
  }
  return true;
}

THREAD_RETURN YASSL_API server_test(void* args)
{
#ifdef _WIN32
    WSADATA wsd;
    WSAStartup(0x0002, &wsd);
#endif

    SOCKET_T sockfd   = 0;
    SOCKET_T clientfd = 0;
    int      argc     = 0;
    char**   argv     = 0;

    set_args(argc, argv, *static_cast<func_args*>(args));
    tcp_accept(sockfd, clientfd, *static_cast<func_args*>(args));

    tcp_close(sockfd);

    SSL_METHOD* method = TLSv1_server_method();
    SSL_CTX*    ctx = SSL_CTX_new(method);

    //SSL_CTX_set_cipher_list(ctx, "RC4-SHA:RC4-MD5");
    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, 0);
    set_serverCerts(ctx);
    DH* dh = set_tmpDH(ctx);

    SSL* ssl = SSL_new(ctx);
    SSL_set_fd(ssl, clientfd);

#ifdef NON_BLOCKING
    NonBlockingSSL_Accept(ssl, ctx, clientfd);
#else
    if (SSL_accept(ssl) != SSL_SUCCESS)
        ServerError(ctx, ssl, clientfd, "SSL_accept failed");
#endif
     
    showPeer(ssl);
    printf("Using Cipher Suite: %s\n", SSL_get_cipher(ssl));

    char command[1024];
    int input = SSL_read(ssl, command, sizeof(command));
    if (input > 0) {
        command[input] = 0;
        printf("First client command: %s\n", command);
    }

    char msg[] = "I hear you, fa shizzle!";
    if (SSL_write(ssl, msg, sizeof(msg)) != sizeof(msg))
        ServerError(ctx, ssl, clientfd, "SSL_write failed");

    DH_free(dh);
    SSL_CTX_free(ctx);
    SSL_shutdown(ssl);
    SSL_free(ssl);

    tcp_close(clientfd);

    ((func_args*)args)->return_code = 0;
    return 0;
}

  bool OpenSSLServer::setType()
  {
    m_ctx = SSL_CTX_new( TLSv1_server_method() );
    if( !m_ctx )
      return false;

    return true;
  }