tango-tfe/platform/src/key_keeper.cpp

#include <key_keeper.h>
#include <string.h>
#include <ssl_utils.h>

struct key_keeper
{

};
struct key_keeper_private
{
	struct keyring head;
	pthread_mutex_t mutex;
	size_t references;
};

#if 0
/*
 * Certificate, including private key and keyring chain.
 */

cert_t *
cert_new(void)
{
	cert_t *c;

	if (!(c = (cert_t *)malloc(sizeof(cert_t))))
		return NULL;
	memset(c, 0, sizeof(cert_t));
	if (pthread_mutex_init(&c->mutex, NULL)) {
		free(c);
		return NULL;
	}
	c->references = 1;
	return c;
}

/*
 * Passed OpenSSL objects are owned by cert_t; refcount will not be
 * incremented, stack will not be duplicated.
 */
cert_t *
cert_new3(EVP_PKEY *key, X509 *crt, STACK_OF(X509) *chain)
{
	cert_t *c;

	if (!(c = (cert_t *)malloc(sizeof(cert_t))))
		return NULL;
	if (pthread_mutex_init(&c->mutex, NULL)) {
		free(c);
		return NULL;
	}
	c->key = key;
	c->crt = crt;
	c->chain = chain;
	c->references = 1;
	return c;
}

/*
 * Passed OpenSSL objects are copied by cert_t; crt/key refcount will be
 * incremented, stack will be duplicated.
 */
cert_t *
cert_new3_copy(EVP_PKEY *key, X509 *crt, STACK_OF(X509) *chain)
{
	cert_t *c;

	if (!(c = (cert_t *)malloc(sizeof(cert_t))))
		return NULL;
	if (pthread_mutex_init(&c->mutex, NULL)) {
		free(c);
		return NULL;
	}
	c->key = key;
	ssl_key_refcount_inc(c->key);
	c->crt = crt;
	ssl_x509_refcount_inc(c->crt);
	c->chain = sk_X509_dup(chain);
	for (int i = 0; i < sk_X509_num(c->chain); i++) {
		ssl_x509_refcount_inc(sk_X509_value(c->chain, i));
	}
	c->references = 1;
	return c;
}

/*
 * Load cert_t from file.
 */
cert_t *
cert_new_load(const char *filename)
{
	cert_t *c;

	if (!(c = (cert_t *)malloc(sizeof(cert_t))))
		return NULL;
	memset(c, 0, sizeof(cert_t));
	if (pthread_mutex_init(&c->mutex, NULL)) {
		free(c);
		return NULL;
	}

	if (ssl_x509chain_load(&c->crt, &c->chain, filename) == -1) {
		free(c);
		return NULL;
	}
	c->key = ssl_key_load(filename);
	if (!c->key) {
		X509_free(c->crt);
		if (c->chain) {
			sk_X509_pop_free(c->chain, X509_free);
		}
		free(c);
		return NULL;
	}
	c->references = 1;
	return c;
}

/*
 * Increment reference count.
 */
void
cert_refcount_inc(cert_t *c)
{
	pthread_mutex_lock(&c->mutex);
	c->references++;
	pthread_mutex_unlock(&c->mutex);
}

/*
 * Thread-safe setter functions; they copy the value (refcounts are inc'd).
 */
void
cert_set_key(cert_t *c, EVP_PKEY *key)
{
	pthread_mutex_lock(&c->mutex);
	if (c->key) {
		EVP_PKEY_free(c->key);
	}
	c->key = key;
	if (c->key) {
		ssl_key_refcount_inc(c->key);
	}
	pthread_mutex_unlock(&c->mutex);
}
void
cert_set_crt(cert_t *c, X509 *crt)
{
	pthread_mutex_lock(&c->mutex);
	if (c->crt) {
		X509_free(c->crt);
	}
	c->crt = crt;
	if (c->crt) {
		ssl_x509_refcount_inc(c->crt);
	}
	pthread_mutex_unlock(&c->mutex);
}
void
cert_set_chain(cert_t *c, STACK_OF(X509) *chain)
{
	pthread_mutex_lock(&c->mutex);
	if (c->chain) {
		sk_X509_pop_free(c->chain, X509_free);
	}
	if (chain) {
		c->chain = sk_X509_dup(chain);
		for (int i = 0; i < sk_X509_num(c->chain); i++) {
			ssl_x509_refcount_inc(sk_X509_value(c->chain, i));
		}
	} else {
		c->chain = NULL;
	}
	pthread_mutex_unlock(&c->mutex);
}

/*
 * Free keyring including internal objects.
 */
void
cert_free(cert_t *c)
{
	pthread_mutex_lock(&c->mutex);
	c->references--;
	if (c->references) {
		pthread_mutex_unlock(&c->mutex);
		return;
	}
	pthread_mutex_unlock(&c->mutex);
	pthread_mutex_destroy(&c->mutex);
	if (c->key) {
		EVP_PKEY_free(c->key);
	}
	if (c->crt) {
		X509_free(c->crt);
	}
	if (c->chain) {
		sk_X509_pop_free(c->chain, X509_free);
	}
	free(c);
}

struct key_keeper* key_keeper_init(const char* profile)
{

}

void cert_mgr_async_get(struct future* future, struct key_keeper* mgr, int keyring_id, X509* origin_cert, struct event_base* evbase)
{
	X509* orig_cert=SSL_get_peer_certificate(origssl);
	//todo: need implement 
	cert_t * keyring = NULL;
	if (opts->tgcrtdir)
	{
		if (ctx->sni)
		{
			keyring = (cert_t *) cachemgr_tgcrt_get(ctx->sni);
			if (!keyring)
			{
				char * wildcarded = ssl_wildcardify(ctx->sni);
				if (!wildcarded)
				{
					ctx->enomem = 1;
					return NULL;
				}
				keyring = (cert_t *) cachemgr_tgcrt_get(wildcarded);
				free(wildcarded);
			}
			if (keyring && OPTS_DEBUG(ctx->opts))
			{
				log_dbg_printf("Target keyring by SNI\n");
			}
		}
		else if (ctx->origcrt)
		{
			char ** names = ssl_x509_names(ctx->origcrt);
			for (char ** p = names; *p; p++)
			{
				if (!keyring)
				{
					keyring = (cert_t *) cachemgr_tgcrt_get(*p);
				}
				if (!keyring)
				{
					char * wildcarded = ssl_wildcardify(*p);
					if (!wildcarded)
					{
						ctx->enomem = 1;
					}
					else
					{
						keyring = (cert_t *) (wildcarded);
						free(wildcarded);
					}
				}
				free(*p);
			}
			free(names);
			if (ctx->enomem)
			{
				return NULL;
			}
			if (keyring && OPTS_DEBUG(ctx->opts))
			{
				log_dbg_printf("Target keyring by origcrt\n");
			}
		}

		if (keyring)
		{
			ctx->immutable_cert = 1;
		}
	}

	if (!keyring && ctx->origcrt && ctx->opts->key)
	{
		keyring = cert_new();
		keyring->cert = (X509 *) cachemgr_fkcrt_get(ctx->origcrt);

		if (keyring->cert)
		{
			if (OPTS_DEBUG(ctx->opts)) log_dbg_printf("Certificate cache: HIT\n");
		}
		else
		{
			if (OPTS_DEBUG(ctx->opts)) log_dbg_printf("Certificate cache: MISS\n");
			keyring->cert = ssl_x509_forge(ctx->opts->cacrt,
				ctx->opts->cakey,
				ctx->origcrt,
				ctx->opts->key,
				NULL,
				ctx->opts->crlurl);
			cachemgr_fkcrt_set(ctx->origcrt, keyring->cert);
		}

		cert_set_key(keyring, ctx->opts->key);
		cert_set_chain(keyring, ctx->opts->chain);
		ctx->generated_cert = 1;
	}

	if ((WANT_CONNECT_LOG(ctx) || ctx->opts->certgendir) && ctx->origcrt)
	{
		ctx->origcrtfpr = ssl_x509_fingerprint(ctx->origcrt, 0);
		if (!ctx->origcrtfpr)
			ctx->enomem = 1;
	}

	if ((WANT_CONNECT_LOG(ctx) || ctx->opts->certgen_writeall) &&
		keyring && keyring->cert)
	{
		ctx->usedcrtfpr = ssl_x509_fingerprint(keyring->cert, 0);
		if (!ctx->usedcrtfpr)
			ctx->enomem = 1;
	}

	return keyring;
}
void cert_manager_free(cert_t * keyring)
{
	cert_free(keyring);
	return;
}
#endif


struct key_keeper * key_keeper_init(const char * profile, const char* section, void* logger)
{
	return NULL;
}

struct key_keeper * key_keeper_destroy(struct key_keeper *keeper)
{
	return NULL;
}

struct keyring* key_keeper_release_cert(future_result_t* result)
{
	return NULL;
}

void key_keeper_free_keyring(struct keyring* cert)
{
	return;
}

void key_keeper_async_ask(struct future * f, struct key_keeper * keeper, int keyring_id,
	X509 * origin_cert,  int is_cert_valid, struct event_base * evbase)
{
	return;
}