From 8d12e0d8f4e66087e759334e7924f88291e317fb Mon Sep 17 00:00:00 2001 From: yhirose Date: Tue, 11 Jun 2019 21:18:45 -0400 Subject: [PATCH] Simplified code --- .gitignore | 3 ++- httplib.h | 56 ++++++++++++++++++++++++---------------------------- test/test.cc | 8 ++++---- 3 files changed, 32 insertions(+), 35 deletions(-) diff --git a/.gitignore b/.gitignore index e91bf78..c6ce9cb 100644 --- a/.gitignore +++ b/.gitignore @@ -10,6 +10,7 @@ test/test test/test.xcodeproj/xcuser* test/test.xcodeproj/*/xcuser* test/*.pem +test/*.srl *.swp @@ -23,4 +24,4 @@ Release ipch *.dSYM .* -!/.travis.yml \ No newline at end of file +!/.travis.yml diff --git a/httplib.h b/httplib.h index 1175498..9993b6b 100644 --- a/httplib.h +++ b/httplib.h @@ -377,7 +377,8 @@ private: class SSLServer : public Server { public: SSLServer(const char *cert_path, const char *private_key_path, - const char *client_CA_cert_path, const char *trusted_cert_path); + const char *client_ca_cert_file_path = nullptr, + const char *client_ca_cert_dir_path = nullptr); virtual ~SSLServer(); @@ -388,8 +389,6 @@ private: SSL_CTX *ctx_; std::mutex ctx_mutex_; - const char *client_CA_cert_path_; - const char *trusted_cert_path_; }; class SSLClient : public Client { @@ -402,7 +401,8 @@ public: virtual bool is_valid() const; - void set_ca_cert_path(const char *ca_cert_path); + void set_ca_cert_path(const char *ca_ceert_file_path, + const char *ca_cert_dir_path = nullptr); void enable_server_certificate_verification(bool enabled); long get_openssl_verify_result() const; @@ -420,7 +420,8 @@ private: SSL_CTX *ctx_; std::mutex ctx_mutex_; std::vector host_components_; - std::string ca_cert_path_; + std::string ca_cert_file_path_; + std::string ca_cert_dir_path_; bool server_certificate_verification_ = false; long verify_result_ = 0; }; @@ -2239,9 +2240,7 @@ read_and_close_socket_ssl(socket_t sock, size_t keep_alive_max_count, // TODO: OpenSSL 1.0.2 occasionally crashes... // The upcoming 1.1.0 is going to be thread safe. SSL_CTX *ctx, std::mutex &ctx_mutex, - U SSL_connect_or_accept, V setup, T callback, - const char *client_CA_cert_path = nullptr, - const char *trusted_cert_path = nullptr) { + U SSL_connect_or_accept, V setup, T callback) { SSL *ssl = nullptr; { std::lock_guard guard(ctx_mutex); @@ -2267,16 +2266,6 @@ read_and_close_socket_ssl(socket_t sock, size_t keep_alive_max_count, return false; } - if (client_CA_cert_path) { - STACK_OF(X509_NAME) * list; - // list of client CAs to request from client - list = SSL_load_client_CA_file(client_CA_cert_path); - SSL_set_client_CA_list(ssl, list); - // certificate chain to verify received client certificate against - // please run c_rehash in the cert folder first - SSL_CTX_load_verify_locations(ctx, client_CA_cert_path, trusted_cert_path); - } - bool ret = false; if (SSL_connect_or_accept(ssl) == 1) { @@ -2360,10 +2349,8 @@ inline std::string SSLSocketStream::get_remote_addr() const { // SSL HTTP server implementation inline SSLServer::SSLServer(const char *cert_path, const char *private_key_path, - const char *client_CA_cert_path = nullptr, - const char *trusted_cert_path = nullptr) - : client_CA_cert_path_(client_CA_cert_path), - trusted_cert_path_(trusted_cert_path) { + const char *client_ca_cert_file_path, + const char *client_ca_cert_dir_path) { ctx_ = SSL_CTX_new(SSLv23_server_method()); if (ctx_) { @@ -2381,7 +2368,15 @@ inline SSLServer::SSLServer(const char *cert_path, const char *private_key_path, 1) { SSL_CTX_free(ctx_); ctx_ = nullptr; - } else if (client_CA_cert_path_) { + } else if (client_ca_cert_file_path || client_ca_cert_dir_path) { + // if (client_ca_cert_file_path) { + // auto list = SSL_load_client_CA_file(client_ca_cert_file_path); + // SSL_CTX_set_client_CA_list(ctx_, list); + // } + + SSL_CTX_load_verify_locations(ctx_, client_ca_cert_file_path, + client_ca_cert_dir_path); + SSL_CTX_set_verify( ctx_, SSL_VERIFY_PEER | @@ -2403,8 +2398,7 @@ inline bool SSLServer::read_and_close_socket(socket_t sock) { [](SSL * /*ssl*/) { return true; }, [this](Stream &strm, bool last_connection, bool &connection_close) { return process_request(strm, last_connection, connection_close); - }, - client_CA_cert_path_, trusted_cert_path_); + }); } // SSL HTTP client implementation @@ -2435,8 +2429,10 @@ inline SSLClient::~SSLClient() { inline bool SSLClient::is_valid() const { return ctx_; } -inline void SSLClient::set_ca_cert_path(const char *ca_cert_path) { - ca_cert_path_ = ca_cert_path; +inline void SSLClient::set_ca_cert_path(const char *ca_cert_file_path, + const char *ca_cert_dir_path) { + if (ca_cert_file_path) { ca_cert_file_path_ = ca_cert_file_path; } + if (ca_cert_dir_path) { ca_cert_dir_path_ = ca_cert_dir_path; } } inline void SSLClient::enable_server_certificate_verification(bool enabled) { @@ -2454,11 +2450,11 @@ inline bool SSLClient::read_and_close_socket(socket_t sock, Request &req, detail::read_and_close_socket_ssl( sock, 0, ctx_, ctx_mutex_, [&](SSL *ssl) { - if (ca_cert_path_.empty()) { + if (ca_cert_file_path_.empty()) { SSL_CTX_set_verify(ctx_, SSL_VERIFY_NONE, nullptr); } else { - if (!SSL_CTX_load_verify_locations(ctx_, ca_cert_path_.c_str(), - nullptr)) { + if (!SSL_CTX_load_verify_locations( + ctx_, ca_cert_file_path_.c_str(), nullptr)) { return false; } SSL_CTX_set_verify(ctx_, SSL_VERIFY_PEER, nullptr); diff --git a/test/test.cc b/test/test.cc index fe279a3..f6f5eb4 100644 --- a/test/test.cc +++ b/test/test.cc @@ -6,9 +6,9 @@ #define SERVER_PRIVATE_KEY_FILE "./key.pem" #define CA_CERT_FILE "./ca-bundle.crt" #define CLIENT_CA_CERT_FILE "./rootCA.cert.pem" +#define CLIENT_CA_CERT_DIR "." #define CLIENT_CERT_FILE "./client.cert.pem" #define CLIENT_PRIVATE_KEY_FILE "./client.key.pem" -#define TRUST_CERT_DIR "." #ifdef _WIN32 #include @@ -1381,7 +1381,7 @@ TEST(SSLClientTest, WildcardHostNameMatch) { TEST(SSLClientServerTest, ClientCertPresent) { SSLServer svr(SERVER_CERT_FILE, SERVER_PRIVATE_KEY_FILE, CLIENT_CA_CERT_FILE, - TRUST_CERT_DIR); + CLIENT_CA_CERT_DIR); ASSERT_TRUE(svr.is_valid()); svr.Get("/test", [&](const Request &, Response &res) { @@ -1402,7 +1402,7 @@ TEST(SSLClientServerTest, ClientCertPresent) { TEST(SSLClientServerTest, ClientCertMissing) { SSLServer svr(SERVER_CERT_FILE, SERVER_PRIVATE_KEY_FILE, CLIENT_CA_CERT_FILE, - TRUST_CERT_DIR); + CLIENT_CA_CERT_DIR); ASSERT_TRUE(svr.is_valid()); svr.Get("/test", [&](const Request &, Response &res) { @@ -1444,7 +1444,7 @@ TEST(SSLClientServerTest, TrustDirOptional) { /* Cannot test this case as there is no external access to SSL object to check SSL_get_peer_certificate() == NULL TEST(SSLClientServerTest, ClientCAPathRequired) { SSLServer svr(SERVER_CERT_FILE, SERVER_PRIVATE_KEY_FILE, -nullptr, TRUST_CERT_DIR); +nullptr, CLIENT_CA_CERT_DIR); } */ #endif