[Boost-commit] svn:boost r84325 - in trunk/boost/asio/ssl: . impl

Subject: [Boost-commit] svn:boost r84325 - in trunk/boost/asio/ssl: . impl
From: chris_at_[hidden]
Date: 2013-05-17 07:04:13

Author: chris_kohlhoff
Date: 2013-05-17 07:04:11 EDT (Fri, 17 May 2013)
New Revision: 84325
URL: http://svn.boost.org/trac/boost/changeset/84325

Log:
Allow loading of SSL certificate and key data from memory buffers.

Added new buffer-based interfaces:
add_certificate_authority, use_certificate, use_certificate_chain,
use_private_key, use_rsa_private_key, use_tmp_dh.

Thanks go to Nick Jones <nick dot fa dot jones at gmail dot com>, on
whose work this commit is based.

Text files modified: 
   trunk/boost/asio/ssl/context.hpp      |   198 ++++++++++++++++++++++                  
   trunk/boost/asio/ssl/impl/context.ipp |   356 +++++++++++++++++++++++++++++++++++++-- 
   2 files changed, 534 insertions(+), 20 deletions(-)

Modified: trunk/boost/asio/ssl/context.hpp
==============================================================================
--- trunk/boost/asio/ssl/context.hpp	(original)
+++ trunk/boost/asio/ssl/context.hpp	2013-05-17 07:04:11 EDT (Fri, 17 May 2013)
@@ -22,6 +22,7 @@
 # include <boost/asio/ssl/context_service.hpp>
 #else // defined(BOOST_ASIO_ENABLE_OLD_SSL)
 # include <string>
+# include <boost/asio/buffer.hpp>
 # include <boost/asio/io_service.hpp>
 # include <boost/asio/ssl/context_base.hpp>
 # include <boost/asio/ssl/detail/openssl_types.hpp>
@@ -268,6 +269,35 @@
   BOOST_ASIO_DECL boost::system::error_code load_verify_file(
       const std::string& filename, boost::system::error_code& ec);
 
+  /// Add certification authority for performing verification.
+  /**
+   * This function is used to add one trusted certification authority
+   * from a memory buffer.
+   *
+   * @param ca The buffer containing the certification authority certificate.
+   * The certificate must use the PEM format.
+   *
+   * @throws boost::system::system_error Thrown on failure.
+   *
+   * @note Calls @c SSL_CTX_get_cert_store and @c X509_STORE_add_cert.
+   */
+  BOOST_ASIO_DECL void add_certificate_authority(const const_buffer& ca);
+
+  /// Add certification authority for performing verification.
+  /**
+   * This function is used to add one trusted certification authority
+   * from a memory buffer.
+   *
+   * @param ca The buffer containing the certification authority certificate.
+   * The certificate must use the PEM format.
+   *
+   * @param ec Set to indicate what error occurred, if any.
+   *
+   * @note Calls @c SSL_CTX_get_cert_store and @c X509_STORE_add_cert.
+   */
+  BOOST_ASIO_DECL boost::system::error_code add_certificate_authority(
+      const const_buffer& ca, boost::system::error_code& ec);
+
   /// Configures the context to use the default directories for finding
   /// certification authority certificates.
   /**
@@ -328,6 +358,37 @@
   BOOST_ASIO_DECL boost::system::error_code add_verify_path(
       const std::string& path, boost::system::error_code& ec);
 
+  /// Use a certificate from a memory buffer.
+  /**
+   * This function is used to load a certificate into the context from a buffer.
+   *
+   * @param certificate The buffer containing the certificate.
+   *
+   * @param format The certificate format (ASN.1 or PEM).
+   *
+   * @throws boost::system::system_error Thrown on failure.
+   *
+   * @note Calls @c SSL_CTX_use_certificate or SSL_CTX_use_certificate_ASN1.
+   */
+  BOOST_ASIO_DECL void use_certificate(
+      const const_buffer& certificate, file_format format);
+
+  /// Use a certificate from a memory buffer.
+  /**
+   * This function is used to load a certificate into the context from a buffer.
+   *
+   * @param certificate The buffer containing the certificate.
+   *
+   * @param format The certificate format (ASN.1 or PEM).
+   *
+   * @param ec Set to indicate what error occurred, if any.
+   *
+   * @note Calls @c SSL_CTX_use_certificate or SSL_CTX_use_certificate_ASN1.
+   */
+  BOOST_ASIO_DECL boost::system::error_code use_certificate(
+      const const_buffer& certificate, file_format format,
+      boost::system::error_code& ec);
+
   /// Use a certificate from a file.
   /**
    * This function is used to load a certificate into the context from a file.
@@ -359,6 +420,35 @@
       const std::string& filename, file_format format,
       boost::system::error_code& ec);
 
+  /// Use a certificate chain from a memory buffer.
+  /**
+   * This function is used to load a certificate chain into the context from a
+   * buffer.
+   *
+   * @param chain The buffer containing the certificate chain. The certificate
+   * chain must use the PEM format.
+   *
+   * @throws boost::system::system_error Thrown on failure.
+   *
+   * @note Calls @c SSL_CTX_use_certificate and SSL_CTX_add_extra_chain_cert.
+   */
+  BOOST_ASIO_DECL void use_certificate_chain(const const_buffer& chain);
+
+  /// Use a certificate chain from a memory buffer.
+  /**
+   * This function is used to load a certificate chain into the context from a
+   * buffer.
+   *
+   * @param chain The buffer containing the certificate chain. The certificate
+   * chain must use the PEM format.
+   *
+   * @param ec Set to indicate what error occurred, if any.
+   *
+   * @note Calls @c SSL_CTX_use_certificate and SSL_CTX_add_extra_chain_cert.
+   */
+  BOOST_ASIO_DECL boost::system::error_code use_certificate_chain(
+      const const_buffer& chain, boost::system::error_code& ec);
+
   /// Use a certificate chain from a file.
   /**
    * This function is used to load a certificate chain into the context from a
@@ -388,6 +478,37 @@
   BOOST_ASIO_DECL boost::system::error_code use_certificate_chain_file(
       const std::string& filename, boost::system::error_code& ec);
 
+  /// Use a private key from a memory buffer.
+  /**
+   * This function is used to load a private key into the context from a buffer.
+   *
+   * @param private_key The buffer containing the private key.
+   *
+   * @param format The private key format (ASN.1 or PEM).
+   *
+   * @throws boost::system::system_error Thrown on failure.
+   *
+   * @note Calls @c SSL_CTX_use_PrivateKey or SSL_CTX_use_PrivateKey_ASN1.
+   */
+  BOOST_ASIO_DECL void use_private_key(
+      const const_buffer& private_key, file_format format);
+
+  /// Use a private key from a memory buffer.
+  /**
+   * This function is used to load a private key into the context from a buffer.
+   *
+   * @param private_key The buffer containing the private key.
+   *
+   * @param format The private key format (ASN.1 or PEM).
+   *
+   * @param ec Set to indicate what error occurred, if any.
+   *
+   * @note Calls @c SSL_CTX_use_PrivateKey or SSL_CTX_use_PrivateKey_ASN1.
+   */
+  BOOST_ASIO_DECL boost::system::error_code use_private_key(
+      const const_buffer& private_key, file_format format,
+      boost::system::error_code& ec);
+
   /// Use a private key from a file.
   /**
    * This function is used to load a private key into the context from a file.
@@ -419,6 +540,39 @@
       const std::string& filename, file_format format,
       boost::system::error_code& ec);
 
+  /// Use an RSA private key from a memory buffer.
+  /**
+   * This function is used to load an RSA private key into the context from a
+   * buffer.
+   *
+   * @param private_key The buffer containing the RSA private key.
+   *
+   * @param format The private key format (ASN.1 or PEM).
+   *
+   * @throws boost::system::system_error Thrown on failure.
+   *
+   * @note Calls @c SSL_CTX_use_RSAPrivateKey or SSL_CTX_use_RSAPrivateKey_ASN1.
+   */
+  BOOST_ASIO_DECL void use_rsa_private_key(
+      const const_buffer& private_key, file_format format);
+
+  /// Use an RSA private key from a memory buffer.
+  /**
+   * This function is used to load an RSA private key into the context from a
+   * buffer.
+   *
+   * @param private_key The buffer containing the RSA private key.
+   *
+   * @param format The private key format (ASN.1 or PEM).
+   *
+   * @param ec Set to indicate what error occurred, if any.
+   *
+   * @note Calls @c SSL_CTX_use_RSAPrivateKey or SSL_CTX_use_RSAPrivateKey_ASN1.
+   */
+  BOOST_ASIO_DECL boost::system::error_code use_rsa_private_key(
+      const const_buffer& private_key, file_format format,
+      boost::system::error_code& ec);
+
   /// Use an RSA private key from a file.
   /**
    * This function is used to load an RSA private key into the context from a
@@ -452,6 +606,37 @@
       const std::string& filename, file_format format,
       boost::system::error_code& ec);
 
+  /// Use the specified memory buffer to obtain the temporary Diffie-Hellman
+  /// parameters.
+  /**
+   * This function is used to load Diffie-Hellman parameters into the context
+   * from a buffer.
+   *
+   * @param dh The memory buffer containing the Diffie-Hellman parameters. The
+   * buffer must use the PEM format.
+   *
+   * @throws boost::system::system_error Thrown on failure.
+   *
+   * @note Calls @c SSL_CTX_set_tmp_dh.
+   */
+  BOOST_ASIO_DECL void use_tmp_dh(const const_buffer& dh);
+
+  /// Use the specified memory buffer to obtain the temporary Diffie-Hellman
+  /// parameters.
+  /**
+   * This function is used to load Diffie-Hellman parameters into the context
+   * from a buffer.
+   *
+   * @param dh The memory buffer containing the Diffie-Hellman parameters. The
+   * buffer must use the PEM format.
+   *
+   * @param ec Set to indicate what error occurred, if any.
+   *
+   * @note Calls @c SSL_CTX_set_tmp_dh.
+   */
+  BOOST_ASIO_DECL boost::system::error_code use_tmp_dh(
+      const const_buffer& dh, boost::system::error_code& ec);
+
   /// Use the specified file to obtain the temporary Diffie-Hellman parameters.
   /**
    * This function is used to load Diffie-Hellman parameters into the context
@@ -523,6 +708,12 @@
       boost::system::error_code& ec);
 
 private:
+  struct bio_cleanup;
+  struct x509_cleanup;
+  struct evp_pkey_cleanup;
+  struct rsa_cleanup;
+  struct dh_cleanup;
+
   // Helper function used to set a peer certificate verification callback.
   BOOST_ASIO_DECL boost::system::error_code do_set_verify_callback(
       detail::verify_callback_base* callback, boost::system::error_code& ec);
@@ -539,6 +730,13 @@
   BOOST_ASIO_DECL static int password_callback_function(
       char* buf, int size, int purpose, void* data);
 
+  // Helper function to set the temporary Diffie-Hellman parameters from a BIO.
+  BOOST_ASIO_DECL boost::system::error_code do_use_tmp_dh(
+      BIO* bio, boost::system::error_code& ec);
+
+  // Helper function to make a BIO from a memory buffer.
+  BOOST_ASIO_DECL BIO* make_buffer_bio(const const_buffer& b);
+
   // The underlying native implementation.
   native_handle_type handle_;
 

Modified: trunk/boost/asio/ssl/impl/context.ipp
==============================================================================
--- trunk/boost/asio/ssl/impl/context.ipp	(original)
+++ trunk/boost/asio/ssl/impl/context.ipp	2013-05-17 07:04:11 EDT (Fri, 17 May 2013)
@@ -34,6 +34,36 @@
 
 #if !defined(BOOST_ASIO_ENABLE_OLD_SSL)
 
+struct context::bio_cleanup
+{
+  BIO* p;
+  ~bio_cleanup() { if (p) ::BIO_free(p); }
+};
+
+struct context::x509_cleanup
+{
+  X509* p;
+  ~x509_cleanup() { if (p) ::X509_free(p); }
+};
+
+struct context::evp_pkey_cleanup
+{
+  EVP_PKEY* p;
+  ~evp_pkey_cleanup() { if (p) ::EVP_PKEY_free(p); }
+};
+
+struct context::rsa_cleanup
+{
+  RSA* p;
+  ~rsa_cleanup() { if (p) ::RSA_free(p); }
+};
+
+struct context::dh_cleanup
+{
+  DH* p;
+  ~dh_cleanup() { if (p) ::DH_free(p); }
+};
+
 context::context(context::method m)
   : handle_(0)
 {
@@ -264,6 +294,41 @@
   return ec;
 }
 
+void context::add_certificate_authority(const const_buffer& ca)
+{
+  boost::system::error_code ec;
+  add_certificate_authority(ca, ec);
+  boost::asio::detail::throw_error(ec, "add_certificate_authority");
+}
+
+boost::system::error_code context::add_certificate_authority(
+    const const_buffer& ca, boost::system::error_code& ec)
+{
+  ::ERR_clear_error();
+
+  bio_cleanup bio = { make_buffer_bio(ca) };
+  if (bio.p)
+  {
+    x509_cleanup cert = { ::PEM_read_bio_X509(bio.p, 0, 0, 0) };
+    if (cert.p)
+    {
+      if (X509_STORE* store = ::SSL_CTX_get_cert_store(handle_))
+      {
+        if (::X509_STORE_add_cert(store, cert.p) == 1)
+        {
+          ec = boost::system::error_code();
+          return ec;
+        }
+      }
+    }
+  }
+
+  ec = boost::system::error_code(
+      static_cast<int>(::ERR_get_error()),
+      boost::asio::error::get_ssl_category());
+  return ec;
+}
+
 void context::set_default_verify_paths()
 {
   boost::system::error_code ec;
@@ -308,6 +373,57 @@
   return ec;
 }
 
+void context::use_certificate(
+    const const_buffer& certificate, file_format format)
+{
+  boost::system::error_code ec;
+  use_certificate(certificate, format, ec);
+  boost::asio::detail::throw_error(ec, "use_certificate");
+}
+
+boost::system::error_code context::use_certificate(
+    const const_buffer& certificate, file_format format,
+    boost::system::error_code& ec)
+{
+  ::ERR_clear_error();
+
+  if (format == context_base::asn1)
+  {
+    if (::SSL_CTX_use_certificate_ASN1(handle_, buffer_size(certificate),
+          buffer_cast<const unsigned char*>(certificate)) == 1)
+    {
+      ec = boost::system::error_code();
+      return ec;
+    }
+  }
+  else if (format == context_base::pem)
+  {
+    bio_cleanup bio = { make_buffer_bio(certificate) };
+    if (bio.p)
+    {
+      x509_cleanup cert = { ::PEM_read_bio_X509(bio.p, 0, 0, 0) };
+      if (cert.p)
+      {
+        if (::SSL_CTX_use_certificate(handle_, cert.p) == 1)
+        {
+          ec = boost::system::error_code();
+          return ec;
+        }
+      }
+    }
+  }
+  else
+  {
+    ec = boost::asio::error::invalid_argument;
+    return ec;
+  }
+
+  ec = boost::system::error_code(
+      static_cast<int>(::ERR_get_error()),
+      boost::asio::error::get_ssl_category());
+  return ec;
+}
+
 void context::use_certificate_file(
     const std::string& filename, file_format format)
 {
@@ -348,6 +464,76 @@
   return ec;
 }
 
+void context::use_certificate_chain(const const_buffer& chain)
+{
+  boost::system::error_code ec;
+  use_certificate_chain(chain, ec);
+  boost::asio::detail::throw_error(ec, "use_certificate_chain");
+}
+
+boost::system::error_code context::use_certificate_chain(
+    const const_buffer& chain, boost::system::error_code& ec)
+{
+  ::ERR_clear_error();
+
+  bio_cleanup bio = { make_buffer_bio(chain) };
+  if (bio.p)
+  {
+    x509_cleanup cert = {
+      ::PEM_read_bio_X509_AUX(bio.p, 0,
+          handle_->default_passwd_callback,
+          handle_->default_passwd_callback_userdata) };
+    if (!cert.p)
+    {
+      ec = boost::system::error_code(ERR_R_PEM_LIB,
+          boost::asio::error::get_ssl_category());
+      return ec;
+    }
+
+    int result = ::SSL_CTX_use_certificate(handle_, cert.p);
+    if (result == 0 || ::ERR_peek_error() != 0)
+    {
+      ec = boost::system::error_code(
+          static_cast<int>(::ERR_get_error()),
+          boost::asio::error::get_ssl_category());
+      return ec;
+    }
+
+    if (handle_->extra_certs)
+    {
+      ::sk_X509_pop_free(handle_->extra_certs, X509_free);
+      handle_->extra_certs = 0;
+    }
+
+    while (X509* cacert = ::PEM_read_bio_X509(bio.p, 0,
+          handle_->default_passwd_callback,
+          handle_->default_passwd_callback_userdata))
+    {
+      if (!::SSL_CTX_add_extra_chain_cert(handle_, cacert))
+      {
+        ec = boost::system::error_code(
+            static_cast<int>(::ERR_get_error()),
+            boost::asio::error::get_ssl_category());
+        return ec;
+      }
+    }
+  
+    result = ::ERR_peek_last_error();
+    if ((ERR_GET_LIB(result) == ERR_LIB_PEM)
+        && (ERR_GET_REASON(result) == PEM_R_NO_START_LINE))
+    {
+      ::ERR_clear_error();
+      ec = boost::system::error_code();
+      return ec;
+    }
+  }
+
+  ec = boost::system::error_code(
+      static_cast<int>(::ERR_get_error()),
+      boost::asio::error::get_ssl_category());
+  return ec;
+}
+
 void context::use_certificate_chain_file(const std::string& filename)
 {
   boost::system::error_code ec;
@@ -370,6 +556,55 @@
   return ec;
 }
 
+void context::use_private_key(
+    const const_buffer& private_key, context::file_format format)
+{
+  boost::system::error_code ec;
+  use_private_key(private_key, format, ec);
+  boost::asio::detail::throw_error(ec, "use_private_key");
+}
+
+boost::system::error_code context::use_private_key(
+    const const_buffer& private_key, context::file_format format,
+    boost::system::error_code& ec)
+{
+  ::ERR_clear_error();
+
+  bio_cleanup bio = { make_buffer_bio(private_key) };
+  if (bio.p)
+  {
+    evp_pkey_cleanup evp_private_key = { 0 };
+    switch (format)
+    {
+    case context_base::asn1:
+      evp_private_key.p = ::d2i_PrivateKey_bio(bio.p, 0);
+      break;
+    case context_base::pem:
+      evp_private_key.p = ::PEM_read_bio_PrivateKey(bio.p, 0, 0, 0);
+      break;
+    default:
+      {
+        ec = boost::asio::error::invalid_argument;
+        return ec;
+      }
+    }
+
+    if (evp_private_key.p)
+    {
+      if (::SSL_CTX_use_PrivateKey(handle_, evp_private_key.p) == 1)
+      {
+        ec = boost::system::error_code();
+        return ec;
+      }
+    }
+  }
+
+  ec = boost::system::error_code(
+      static_cast<int>(::ERR_get_error()),
+      boost::asio::error::get_ssl_category());
+  return ec;
+}
+
 void context::use_private_key_file(
     const std::string& filename, context::file_format format)
 {
@@ -378,6 +613,55 @@
   boost::asio::detail::throw_error(ec, "use_private_key_file");
 }
 
+void context::use_rsa_private_key(
+    const const_buffer& private_key, context::file_format format)
+{
+  boost::system::error_code ec;
+  use_rsa_private_key(private_key, format, ec);
+  boost::asio::detail::throw_error(ec, "use_rsa_private_key");
+}
+
+boost::system::error_code context::use_rsa_private_key(
+    const const_buffer& private_key, context::file_format format,
+    boost::system::error_code& ec)
+{
+  ::ERR_clear_error();
+
+  bio_cleanup bio = { make_buffer_bio(private_key) };
+  if (bio.p)
+  {
+    rsa_cleanup rsa_private_key = { 0 };
+    switch (format)
+    {
+    case context_base::asn1:
+      rsa_private_key.p = ::d2i_RSAPrivateKey_bio(bio.p, 0);
+      break;
+    case context_base::pem:
+      rsa_private_key.p = ::PEM_read_bio_RSAPrivateKey(bio.p, 0, 0, 0);
+      break;
+    default:
+      {
+        ec = boost::asio::error::invalid_argument;
+        return ec;
+      }
+    }
+
+    if (rsa_private_key.p)
+    {
+      if (::SSL_CTX_use_RSAPrivateKey(handle_, rsa_private_key.p) == 1)
+      {
+        ec = boost::system::error_code();
+        return ec;
+      }
+    }
+  }
+
+  ec = boost::system::error_code(
+      static_cast<int>(::ERR_get_error()),
+      boost::asio::error::get_ssl_category());
+  return ec;
+}
+
 boost::system::error_code context::use_private_key_file(
     const std::string& filename, context::file_format format,
     boost::system::error_code& ec)
@@ -451,6 +735,28 @@
   return ec;
 }
 
+void context::use_tmp_dh(const const_buffer& dh)
+{
+  boost::system::error_code ec;
+  use_tmp_dh(dh, ec);
+  boost::asio::detail::throw_error(ec, "use_tmp_dh");
+}
+
+boost::system::error_code context::use_tmp_dh(
+    const const_buffer& dh, boost::system::error_code& ec)
+{
+  bio_cleanup bio = { make_buffer_bio(dh) };
+  if (bio.p)
+  {
+    return do_use_tmp_dh(bio.p, ec);
+  }
+
+  ec = boost::system::error_code(
+      static_cast<int>(::ERR_get_error()),
+      boost::asio::error::get_ssl_category());
+  return ec;
+}
+
 void context::use_tmp_dh_file(const std::string& filename)
 {
   boost::system::error_code ec;
@@ -461,33 +767,36 @@
 boost::system::error_code context::use_tmp_dh_file(
     const std::string& filename, boost::system::error_code& ec)
 {
-  ::BIO* bio = ::BIO_new_file(filename.c_str(), "r");
-  if (!bio)
+  bio_cleanup bio = { ::BIO_new_file(filename.c_str(), "r") };
+  if (bio.p)
   {
-    ec = boost::asio::error::invalid_argument;
-    return ec;
+    return do_use_tmp_dh(bio.p, ec);
   }
 
-  ::DH* dh = ::PEM_read_bio_DHparams(bio, 0, 0, 0);
-  if (!dh)
-  {
-    ::BIO_free(bio);
-    ec = boost::asio::error::invalid_argument;
-    return ec;
-  }
+  ec = boost::system::error_code(
+      static_cast<int>(::ERR_get_error()),
+      boost::asio::error::get_ssl_category());
+  return ec;
+}
 
-  ::BIO_free(bio);
-  long result = ::SSL_CTX_set_tmp_dh(handle_, dh);
-  ::DH_free(dh);
-  if (result != 1)
+boost::system::error_code context::do_use_tmp_dh(
+    BIO* bio, boost::system::error_code& ec)
+{
+  ::ERR_clear_error();
+
+  dh_cleanup dh = { ::PEM_read_bio_DHparams(bio, 0, 0, 0) };
+  if (dh.p)
   {
-    ec = boost::system::error_code(
-        static_cast<int>(::ERR_get_error()),
-        boost::asio::error::get_ssl_category());
-    return ec;
+    if (::SSL_CTX_set_tmp_dh(handle_, dh.p) == 1)
+    {
+      ec = boost::system::error_code();
+      return ec;
+    }
   }
 
-  ec = boost::system::error_code();
+  ec = boost::system::error_code(
+      static_cast<int>(::ERR_get_error()),
+      boost::asio::error::get_ssl_category());
   return ec;
 }
 
@@ -577,6 +886,13 @@
   return 0;
 }
 
+BIO* context::make_buffer_bio(const const_buffer& b)
+{
+  return ::BIO_new_mem_buf(
+      const_cast<void*>(buffer_cast<const void*>(b)),
+      buffer_size(b));
+}
+
 #endif // !defined(BOOST_ASIO_ENABLE_OLD_SSL)
 
 } // namespace ssl