--- loncom/lonssl.pm	2017/02/28 05:42:06	1.15
+++ loncom/lonssl.pm	2018/12/14 02:05:38	1.24
@@ -1,5 +1,5 @@
 #
-# $Id: lonssl.pm,v 1.15 2017/02/28 05:42:06 raeburn Exp $
+# $Id: lonssl.pm,v 1.24 2018/12/14 02:05:38 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -112,10 +112,18 @@ sub SetFdBlocking {
 #               Socket	IO::Socket::INET   Original ordinary socket.
 #               CACert	string	           Full path name to the certificate 
 #                                          authority certificate file.
-#                MyCert	string	           Full path name to the certificate 
+#               MyCert	string	           Full path name to the certificate 
 #                                          issued to this host.
-#                KeyFile string    	   Full pathname to the host's private 
+#               KeyFile string    	   Full pathname to the host's private 
 #                                          key file for the certificate.
+#               peer    string             lonid of remote LON-CAPA server
+#               peerdef string             default lonHostID of remote server
+#               CRLFile                    Full path name to the certificate
+#                                          revocation list file for the cluster
+#                                          to which server belongs (optional)
+#               serverversion              LON-CAPA version running on remote
+#                                          server.
+
 # Returns
 #	-	Reference to an SSL socket on success
 #       -	undef on failure.  Reason for failure can be interrogated from 
@@ -127,10 +135,13 @@ sub PromoteClientSocket {
     my ($PlaintextSocket,
 	$CACert,
 	$MyCert,
-	$KeyFile)          = @_;
-    
-    
-    Debug("Client promotion using key: $KeyFile, Cert: $MyCert, CA: $CACert\n");
+	$KeyFile,
+        $peer,
+        $peerdef,
+        $CRLFile,
+        $serverversion) = @_;
+
+    Debug("Client promotion using key: $KeyFile, Cert: $MyCert, CA: $CACert, CRL: $CRLFile, Remote Host: $peer, RemoteDefHost: $peerdef, RemoteLCVersion: $serverversion\n");
 
     # To create the ssl socket we need to duplicate the existing
     # socket.  Otherwise closing the ssl socket will close the plaintext socket
@@ -146,20 +157,43 @@ sub PromoteClientSocket {
     # mode of SSL_VERIFY_NONE should be explicitly set for client, if 
     # verification is not to be used, and SSL_verify_mode is not set.
     # Starting with rev. 1.95, the default became SSL_VERIFY_PEER which
-    # prevents connections to lond.
-    # Set SSL_verify_mode to Net::SSLeay::VERIFY_NONE() instead of to
-    # SSL_VERIFY_NONE for compatibility with IO::Socket::SSL rev. 1.01
+    # prevents an SSL connection to lond unless SSL_verifycn_name is set
+    # to the lonHostID of the remote host, (and the remote certificate has
+    # the remote lonHostID as CN, and has been signed by the LON-CAPA CA.
+    # Set SSL_verify_mode to Net::SSLeay::VERIFY_PEER() instead of to
+    # SSL_VERIFY_PEER for compatibility with IO::Socket::SSL rev. 1.01
     # used by CentOS/RHEL/Scientific Linux 5).
-    
-    my $client = IO::Socket::SSL->new_from_fd($dupfno,
-					      SSL_use_cert => 1,
-					      SSL_key_file  => $KeyFile,
-					      SSL_cert_file => $MyCert,
-					      SSL_ca_file   => $CACert,
-					      SSL_verify_mode => Net::SSLeay::VERIFY_NONE());
-    
+
+    my $verify_cn = $peerdef;
+    if ($verify_cn eq '') {
+        $verify_cn = $peer;
+    }
+
+    my %sslargs = (SSL_use_cert      => 1,
+                   SSL_key_file      => $KeyFile,
+                   SSL_cert_file     => $MyCert,
+                   SSL_ca_file       => $CACert);
+    my ($major,$minor) = split(/\./,$serverversion);
+    if (($major < 2) || ($major == 2 && $minor < 12)) {
+        $sslargs{SSL_verify_mode} = Net::SSLeay::VERIFY_NONE();
+    } else {
+        $sslargs{SSL_verifycn_scheme} = 'http',
+        $sslargs{SSL_verifycn_name} = $verify_cn,
+        $sslargs{SSL_verify_mode} = Net::SSLeay::VERIFY_PEER();
+        if (($CRLFile ne '') && (-e $CRLFile)) {
+            $sslargs{SSL_check_crl} = 1;
+            $sslargs{SSL_crl_file} = $CRLFile;
+        }
+    }
+# Uncomment next two $IO::Socket::SSL::DEBUG lines, for debugging
+#    $IO::Socket::SSL::DEBUG = 0; # Set to integer >0 and <4
+#                                 # to write debugging to lonc_errors
+    my $client = IO::Socket::SSL->new_from_fd($dupfno,%sslargs);
+#    $IO::Socket::SSL::DEBUG = 0; # Do not change
     if(!$client) {
-	$lasterror = IO::Socket::SSL::errstr();
+        if ($IO::Socket::SSL::SSL_ERROR == -1) {
+	    $lasterror = -1;
+        }
 	return undef;
     }
     return $client;		# Undef if the client negotiation fails.
@@ -168,7 +202,7 @@ sub PromoteClientSocket {
 #----------------------------------------------------------------------
 # Name	PromoteServerSocket
 # Description	Given an ordinary IO::Socket::INET Creates an SSL socket 
-#               for a server that is connected to the same client.l
+#               for a server that is connected to the same client.
 # Parameters	Name	Type	           Description
 #               Socket	IO::Socket::INET   Original ordinary socket.
 #               CACert	string	           Full path name to the certificate 
@@ -177,6 +211,12 @@ sub PromoteClientSocket {
 #                                          issued to this host.
 #                KeyFile string    	   Full pathname to the host's private 
 #                                          key file for the certificate.
+#               peer   string              lonHostID of remote LON-CAPA client
+#               CRLFile                    Full path name to the certificate
+#                                          revocation list file for the cluster
+#                                          to which server belongs (optional)
+#               clientversion              LON-CAPA version running on remote
+#                                          client
 # Returns
 #	-	Reference to an SSL socket on success
 #       -	undef on failure.  Reason for failure can be interrogated from 
@@ -188,9 +228,10 @@ sub PromoteServerSocket {
     my ($PlaintextSocket,
 	$CACert,
 	$MyCert,
-	$KeyFile)          = @_;
-
-
+	$KeyFile,
+        $peer,
+        $CRLFile,
+        $clientversion) = @_;
 
     # To create the ssl socket we need to duplicate the existing
     # socket.  Otherwise closing the ssl socket will close the plaintext socket
@@ -204,14 +245,32 @@ sub PromoteServerSocket {
 	Debug("dup failed: $!\n");
     }
     Debug(" Fileno = $dupfno\n");
-    my $client = IO::Socket::SSL->new_from_fd($dupfno,
-					      SSL_server    => 1, # Server role.
-					      SSL_use_cert  => 1,
-					      SSL_key_file  => $KeyFile,
-					      SSL_cert_file => $MyCert,
-					      SSL_ca_file   => $CACert);
+    my %sslargs = (SSL_server        => 1, # Server role.
+                   SSL_use_cert      => 1,
+                   SSL_key_file      => $KeyFile,
+                   SSL_cert_file     => $MyCert,
+                   SSL_ca_file       => $CACert);
+    my ($major,$minor) = split(/\./,$clientversion);
+    if (($major < 2) || ($major == 2 && $minor < 12)) {
+        $sslargs{SSL_verify_mode} = Net::SSLeay::VERIFY_NONE();
+    } else {
+        $sslargs{SSL_verifycn_scheme} = 'http'; 
+        $sslargs{SSL_verifycn_name} = $peer;
+        $sslargs{SSL_verify_mode} = Net::SSLeay::VERIFY_PEER();
+        if (($CRLFile ne '') && (-e $CRLFile)) {
+            $sslargs{SSL_check_crl} = 1;
+            $sslargs{SSL_crl_file} = $CRLFile;
+        }
+    }
+# Uncomment next two $IO::Socket::SSL::DEBUG lines, for debugging
+#    $IO::Socket::SSL::DEBUG = 0; # Set to integer >0 and <4
+#                                 # to write debugging to lond_errors
+    my $client = IO::Socket::SSL->new_from_fd($dupfno,%sslargs);
+#    $IO::Socket::SSL::DEBUG = 0; # Do not change
     if(!$client) {
-	$lasterror = IO::Socket::SSL::errstr();
+        if ($IO::Socket::SSL::SSL_ERROR == -1) {
+            $lasterror = -1;
+        }
 	return undef;
     }
     return $client;
@@ -333,14 +392,63 @@ sub KeyFile {
     return $KeyFilename;
 }
 
+sub CRLFile {
+
+    # I need some perl variables from the configuration file for this:
+
+    my $CertificateDir   = $perlvar->{lonCertificateDirectory};
+    my $CRLFilename      = $perlvar->{lonnetCertRevocationList};
+
+    # Ensure the variables exist:
+
+    if((!$CertificateDir) || (!$CRLFilename)) {
+        $lasterror = "Missing parameter dir: $CertificateDir "
+                    ."CRL file: $CRLFilename";
+        return undef;
+    }
+
+    # Build the actual filename and ensure that it not only exists but
+    # is also readable:
+
+    $CRLFilename    = $CertificateDir.$pathsep.$CRLFilename;
+    if(! (-r $CRLFilename)) {
+        $lasterror = "Unreadable key file $CRLFilename";
+        return undef;
+    }
+
+    return $CRLFilename;
+}
+
+sub BadCertDir {
+    my $SocketDir = $perlvar->{lonSockDir};
+    if (-d "$SocketDir/nosslverify/") {
+        return "$SocketDir/nosslverify"
+    }
+}
+
+sub has_badcert_file {
+    my ($client) = @_;
+    my $SocketDir = $perlvar->{lonSockDir};
+    if (-e "$SocketDir/nosslverify/$client") {
+        return 1;
+    }
+    return;
+}
+
 sub Read_Connect_Config {
-    my ($secureconf,$perlvarref) = @_;
+    my ($secureconf,$perlvarref,$crlcheckedref) = @_;
     return unless (ref($secureconf) eq 'HASH');
 
     unless (ref($perlvarref) eq 'HASH') {
         $perlvarref = $perlvar;
     }
-    
+
+    # Clear hash of clients in lond for which Certificate Revocation List checked
+    if (ref($crlcheckedref) eq 'HASH') {
+        foreach my $key (keys(%{$crlcheckedref})) {
+            delete($crlcheckedref->{$key});
+        }
+    }
     # Clean out the old table first.
     foreach my $key (keys(%{$secureconf})) {
         delete($secureconf->{$key});
@@ -348,7 +456,7 @@ sub Read_Connect_Config {
 
     my $result;
     my $tablename = $perlvarref->{'lonTabDir'}."/connectionrules.tab";
-    if (open(my $fh,"<$tablename")) {
+    if (open(my $fh,'<',$tablename)) {
         while (my $line = <$fh>) {
             chomp($line);
             my ($name,$value) = split(/=/,$line);
@@ -371,7 +479,7 @@ sub Read_Host_Types {
     unless (ref($perlvarref) eq 'HASH') {
         $perlvarref = $perlvar;
     }
-   
+
     # Clean out the old table first.
     foreach my $key (keys(%{$hosttypes})) {
         delete($hosttypes->{$key});
@@ -379,7 +487,7 @@ sub Read_Host_Types {
 
     my $result;
     my $tablename = $perlvarref->{'lonTabDir'}."/hosttypes.tab";
-    if (open(my $fh,"<$tablename")) {
+    if (open(my $fh,'<',$tablename)) {
         while (my $line = <$fh>) {
             chomp($line);
             my ($name,$value) = split(/:/,$line);