[BACK]Return to lonssl.pm CVS log [TXT] [DIR] Up to [LON-CAPA] / loncom

Diff for /loncom/lonssl.pm between versions 1.8 and 1.18

version 1.8, 2004/06/17 09:27:38 version 1.18, 2018/08/09 13:27:55
Line 37  use strict; Line 37  use strict;
   
 use IO::Socket::INET;  use IO::Socket::INET;
 use IO::Socket::SSL;  use IO::Socket::SSL;
   use Net::SSLeay;
   
 use Fcntl;  use Fcntl;
 use POSIX;  use POSIX;
Line 52  my $perlvar;   #  this refers to the apa Line 53  my $perlvar;   #  this refers to the apa
   
 my $pathsep = "/"; # We're on unix after all.  my $pathsep = "/"; # We're on unix after all.
   
   my $DEBUG = 0; # Set to non zero to enable debug output.
   
   
 # Initialization code:  # Initialization code:
   
Line 61  $perlvar = LONCAPA::Configuration::read_ Line 64  $perlvar = LONCAPA::Configuration::read_
 my $lasterror="";  my $lasterror="";
   
   
   
 sub LastError {  sub LastError {
     return $lasterror;      return $lasterror;
 }  }
   
   sub Debug {
       my $msg  = shift;
       if ($DEBUG) {
    print STDERR $msg;
       }
   }
   
 #-------------------------------------------------------------------------  #-------------------------------------------------------------------------
 # Name SetFdBlocking -   # Name SetFdBlocking - 
 #      Turn blocking mode on on the file handle.  This is required for  #      Turn blocking mode on on the file handle.  This is required for
Line 76  sub LastError { Line 87  sub LastError {
 #      prior flag settings.  #      prior flag settings.
 #  #
 sub SetFdBlocking {  sub SetFdBlocking {
     print STDERR "SetFdBlocking called \n";      Debug("SetFdBlocking called \n");
     my $Handle = shift;      my $Handle = shift;
   
   
   
     my $flags  = fcntl($Handle, F_GETFL, 0);      my $flags  = fcntl($Handle, F_GETFL, 0);
     if(!$flags) {      if(!$flags) {
  print STDERR "SetBLocking fcntl get faild $!\n";   Debug("SetBLocking fcntl get faild $!\n");
     }      }
     my $newflags  = $flags & (~ O_NONBLOCK); # Turn off O_NONBLOCK...      my $newflags  = $flags & (~ O_NONBLOCK); # Turn off O_NONBLOCK...
     if(!fcntl($Handle, F_SETFL, $newflags)) {      if(!fcntl($Handle, F_SETFL, $newflags)) {
  print STDERR "Can't set non block mode  $!\n";   Debug("Can't set non block mode  $!\n");
     }      }
     return $flags;      return $flags;
 }  }
Line 105  sub SetFdBlocking { Line 116  sub SetFdBlocking {
 #                                          issued to this host.  #                                          issued to this host.
 #                KeyFile string       Full pathname to the host's private   #                KeyFile string       Full pathname to the host's private 
 #                                          key file for the certificate.  #                                          key file for the certificate.
   #               peer    string             lonHostID of remote LON-CAPA server
   #               CRLFile                    Full path name to the certificate
   #                                          revocation list file for the cluster
   #                                          to which server belongs (optional)
   
 # Returns  # Returns
 # - Reference to an SSL socket on success  # - Reference to an SSL socket on success
 #       - undef on failure.  Reason for failure can be interrogated from   #       - undef on failure.  Reason for failure can be interrogated from 
Line 116  sub PromoteClientSocket { Line 132  sub PromoteClientSocket {
     my ($PlaintextSocket,      my ($PlaintextSocket,
  $CACert,   $CACert,
  $MyCert,   $MyCert,
  $KeyFile)          = @_;   $KeyFile,
               $peer,
               $CRLFile) = @_;
     print STDERR "Client promotion using key: $KeyFile, Cert: $MyCert, CA: $CACert\n";  
       Debug("Client promotion using key: $KeyFile, Cert: $MyCert, CA: $CACert, CRL: $CRLFile, Remote Host: $peer\n");
   
     # To create the ssl socket we need to duplicate the existing      # To create the ssl socket we need to duplicate the existing
     # socket.  Otherwise closing the ssl socket will close the plaintext socket      # socket.  Otherwise closing the ssl socket will close the plaintext socket
Line 129  sub PromoteClientSocket { Line 146  sub PromoteClientSocket {
   
     my $oldflags = SetFdBlocking($PlaintextSocket);      my $oldflags = SetFdBlocking($PlaintextSocket);
     my $dupfno   = fcntl($PlaintextSocket, F_DUPFD, 0);      my $dupfno   = fcntl($PlaintextSocket, F_DUPFD, 0);
     print STDERR "Client promotion got dup = $dupfno\n";      Debug("Client promotion got dup = $dupfno\n");
   
           # Starting with IO::Socket::SSL rev. 1.79, carp warns that a verify 
     my $client = IO::Socket::SSL->new_from_fd($dupfno,      # mode of SSL_VERIFY_NONE should be explicitly set for client, if 
       SSL_user_cert => 1,      # verification is not to be used, and SSL_verify_mode is not set.
       SSL_key_file  => $KeyFile,      # Starting with rev. 1.95, the default became SSL_VERIFY_PEER which
       SSL_cert_file => $MyCert,      # prevents an SSL connection to lond unless SSL_verifycn_name is set
       SSL_ca_fie    => $CACert);      # to the lonHostID of the remote host, (and the remote certificate has
           # the remote lonHostID as CN, and has been signed by the LON-CAPA CA.
       # Set SSL_verify_mode to Net::SSLeay::VERIFY_PEER() instead of to
       # SSL_VERIFY_PEER for compatibility with IO::Socket::SSL rev. 1.01
       # used by CentOS/RHEL/Scientific Linux 5).
       
       my %sslargs = (SSL_use_cert      => 1,
                      SSL_key_file      => $KeyFile,
                      SSL_cert_file     => $MyCert,
                      SSL_ca_file       => $CACert,
                      SSL_verifycn_name => $peer,
                      SSL_verify_mode   => Net::SSLeay::VERIFY_PEER());
       if (($CRLFile ne '') && (-e $CRLFile)) {
           $sslargs{SSL_check_crl} = 1;
           $sslargs{SSL_crl_file} = $CRLFile;
       }
       my $client = IO::Socket::SSL->new_from_fd($dupfno,%sslargs);
     if(!$client) {      if(!$client) {
  $lasterror = IO::Socket::SSL::errstr();          if ($IO::Socket::SSL::SSL_ERROR == -1) {
       $lasterror = -1;
           }
  return undef;   return undef;
     }      }
     return $client; # Undef if the client negotiation fails.      return $client; # Undef if the client negotiation fails.
Line 148  sub PromoteClientSocket { Line 182  sub PromoteClientSocket {
 #----------------------------------------------------------------------  #----------------------------------------------------------------------
 # Name PromoteServerSocket  # Name PromoteServerSocket
 # Description Given an ordinary IO::Socket::INET Creates an SSL socket   # Description Given an ordinary IO::Socket::INET Creates an SSL socket 
 #               for a server that is connected to the same client.l  #               for a server that is connected to the same client.
 # Parameters Name Type           Description  # Parameters Name Type           Description
 #               Socket IO::Socket::INET   Original ordinary socket.  #               Socket IO::Socket::INET   Original ordinary socket.
 #               CACert string           Full path name to the certificate   #               CACert string           Full path name to the certificate 
Line 157  sub PromoteClientSocket { Line 191  sub PromoteClientSocket {
 #                                          issued to this host.  #                                          issued to this host.
 #                KeyFile string       Full pathname to the host's private   #                KeyFile string       Full pathname to the host's private 
 #                                          key file for the certificate.  #                                          key file for the certificate.
   #               peer   string              lonHostID of remote LON-CAPA client
   #               CRLFile                    Full path name to the certificate
   #                                          revocation list file for the cluster
   #                                          to which server belongs (optional)
   #               clientversion              LON-CAPA version running on remote
   #                                          client
 # Returns  # Returns
 # - Reference to an SSL socket on success  # - Reference to an SSL socket on success
 #       - undef on failure.  Reason for failure can be interrogated from   #       - undef on failure.  Reason for failure can be interrogated from 
Line 168  sub PromoteServerSocket { Line 208  sub PromoteServerSocket {
     my ($PlaintextSocket,      my ($PlaintextSocket,
  $CACert,   $CACert,
  $MyCert,   $MyCert,
  $KeyFile)          = @_;   $KeyFile,
           $peer,
           $CRLFile,
           $clientversion) = @_;
   
     # To create the ssl socket we need to duplicate the existing      # To create the ssl socket we need to duplicate the existing
     # socket.  Otherwise closing the ssl socket will close the plaintext socket      # socket.  Otherwise closing the ssl socket will close the plaintext socket
     # too:      # too:
   
     print STDERR "Server promotion: Key = $KeyFile, Cert $MyCert CA $CACert\n";      Debug("Server promotion: Key = $KeyFile, Cert $MyCert CA $CACert\n");
     
     my $oldflags = SetFdBlocking($PlaintextSocket);      my $oldflags = SetFdBlocking($PlaintextSocket);
     my $dupfno   = fcntl($PlaintextSocket, F_DUPFD, 0);      my $dupfno   = fcntl($PlaintextSocket, F_DUPFD, 0);
     if (!$dupfno) {      if (!$dupfno) {
  print STDERR "dup failed: $!\n";   Debug("dup failed: $!\n");
     }      }
     print STDERR " Fileno = $dupfno\n";      Debug(" Fileno = $dupfno\n");
     my $client = IO::Socket::SSL->new_from_fd($dupfno,      my %sslargs = (SSL_server        => 1, # Server role.
       SSL_server    => 1, # Server role.                     SSL_use_cert      => 1,
       SSL_user_cert => 1,                     SSL_key_file      => $KeyFile,
       SSL_key_file  => $KeyFile,                     SSL_cert_file     => $MyCert,
       SSL_cert_file => $MyCert,                     SSL_ca_file       => $CACert);
       SSL_ca_fie    => $CACert);      my ($major,$minor) = split(/\./,$clientversion);
       if (($major < 2) || ($major == 2 && $minor < 12)) {
           $sslargs{SSL_verify_mode} = Net::SSLeay::VERIFY_NONE();
       } else {
           $sslargs{SSL_verifycn_name} = $peer;
           $sslargs{SSL_verify_mode} = Net::SSLeay::VERIFY_PEER();
           if (($CRLFile ne '') && (-e $CRLFile)) {
               $sslargs{SSL_check_crl} = 1;
               $sslargs{SSL_crl_file} = $CRLFile; 
           }
       }
       my $client = IO::Socket::SSL->new_from_fd($dupfno,%sslargs);
     if(!$client) {      if(!$client) {
  $lasterror = IO::Socket::SSL::errstr();          if ($IO::Socket::SSL::SSL_ERROR == -1) {
               $lasterror = -1;
           }
  return undef;   return undef;
     }      }
     return $client;      return $client;
Line 263  sub CertificateFile { Line 317  sub CertificateFile {
     #   Build the actual filenames and check for their existence and      #   Build the actual filenames and check for their existence and
     #   readability.      #   readability.
           
     my $CaFilename   = $CertificateDir.$pathsep.$CaFilename;      $CaFilename   = $CertificateDir.$pathsep.$CaFilename;
     my $CertFilename = $CertificateDir.$pathsep.$CertFilename;      $CertFilename = $CertificateDir.$pathsep.$CertFilename;
           
     if((! -r $CaFilename) || (! -r $CertFilename)) {      if((! -r $CaFilename) || (! -r $CertFilename)) {
  $lasterror = "CA file $CaFilename or Cert File: $CertFilename "   $lasterror = "CA file $CaFilename or Cert File: $CertFilename "
Line 304  sub KeyFile { Line 358  sub KeyFile {
     # Build the actual filename and ensure that it not only exists but      # Build the actual filename and ensure that it not only exists but
     # is also readable:      # is also readable:
           
     my $KeyFilename    = $CertificateDir.$pathsep.$KeyFilename;      $KeyFilename    = $CertificateDir.$pathsep.$KeyFilename;
     if(! (-r $KeyFilename)) {      if(! (-r $KeyFilename)) {
  $lasterror = "Unreadable key file $KeyFilename";   $lasterror = "Unreadable key file $KeyFilename";
  return undef;   return undef;
Line 313  sub KeyFile { Line 367  sub KeyFile {
     return $KeyFilename;      return $KeyFilename;
 }  }
   
   sub CRLFile {
   
       # I need some perl variables from the configuration file for this:
   
       my $CertificateDir   = $perlvar->{lonCertificateDirectory};
       my $CRLFilename      = $perlvar->{lonnetCertRevocationList};
   
       # Ensure the variables exist:
   
       if((!$CertificateDir) || (!$CRLFilename)) {
           $lasterror = "Missing parameter dir: $CertificateDir "
                       ."CRL file: $CRLFilename";
           return undef;
       }
   
       # Build the actual filename and ensure that it not only exists but
       # is also readable:
   
       $CRLFilename    = $CertificateDir.$pathsep.$CRLFilename;
       if(! (-r $CRLFilename)) {
           $lasterror = "Unreadable key file $CRLFilename";
           return undef;
       }
   
       return $CRLFilename;
   }
   
   sub BadCertDir {
       my $SocketDir = $perlvar->{lonSockDir};
       if (-d "$SocketDir/nosslverify/") {
           return "$SocketDir/nosslverify"
       }
   }
   
   sub has_badcert_file {
       my ($client) = @_;
       my $SocketDir = $perlvar->{lonSockDir};
       if (-e "$SocketDir/nosslverify/$client") {
           return 1;
       }
       return;
   }
   
   sub Read_Connect_Config {
       my ($secureconf,$checkedcrl,$perlvarref) = @_;
       return unless ((ref($secureconf) eq 'HASH') && (ref($checkedcrl) eq 'HASH'));
   
       unless (ref($perlvarref) eq 'HASH') {
           $perlvarref = $perlvar;
       }
   
       # Clear hash of clients for which Certificate Revocation List checked 
       foreach my $key (keys(%{$checkedcrl})) {
           delete($checkedcrl->{$key});
       }
       # Clean out the old table first.
       foreach my $key (keys(%{$secureconf})) {
           delete($secureconf->{$key});
       }
   
       my $result;
       my $tablename = $perlvarref->{'lonTabDir'}."/connectionrules.tab";
       if (open(my $fh,"<$tablename")) {
           while (my $line = <$fh>) {
               chomp($line);
               my ($name,$value) = split(/=/,$line);
               if ($value =~ /^(?:no|yes|req)$/) {
                   if ($name =~ /^conn(to|from)_(dom|intdom|other)$/) {
                       $secureconf->{'conn'.$1}{$2} = $value;
                   }
               }
           }
           close($fh);
           return 'ok';
       }
       return;
   }
   
   sub Read_Host_Types {
       my ($hosttypes,$perlvarref) = @_;
       return unless (ref($hosttypes) eq 'HASH');
   
       unless (ref($perlvarref) eq 'HASH') {
           $perlvarref = $perlvar;
       }
      
       # Clean out the old table first.
       foreach my $key (keys(%{$hosttypes})) {
           delete($hosttypes->{$key});
       }
   
       my $result;
       my $tablename = $perlvarref->{'lonTabDir'}."/hosttypes.tab";
       if (open(my $fh,"<$tablename")) {
           while (my $line = <$fh>) {
               chomp($line);
               my ($name,$value) = split(/:/,$line);
               if (($name ne '') && ($value =~ /^(dom|intdom|other)$/)) { 
                   $hosttypes->{$name} = $value;
               }
           }
           close($fh);
           return 'ok';
       }
       return;
   }
   
 1;  1;
Removed from v.1.8  
changed lines
  Added in v.1.18

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>