• Skip to content
  • Skip to link menu
Trinity API Reference
  • Trinity API Reference
  • tdeio/kssl
 

tdeio/kssl

  • tdeio
  • kssl
ksslsettings.cpp
1 /* This file is part of the KDE project
2  *
3  * Copyright (C) 2000 George Staikos <staikos@kde.org>
4  *
5  * This library is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU Library General Public
7  * License as published by the Free Software Foundation; either
8  * version 2 of the License, or (at your option) any later version.
9  *
10  * This library is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13  * Library General Public License for more details.
14  *
15  * You should have received a copy of the GNU Library General Public License
16  * along with this library; see the file COPYING.LIB. If not, write to
17  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
18  * Boston, MA 02110-1301, USA.
19  */
20 
21 #ifdef HAVE_CONFIG_H
22 #include <config.h>
23 #endif
24 
25 #include <sys/types.h>
26 #include <sys/stat.h>
27 
28 #include <stdlib.h>
29 #include <pwd.h>
30 #include <unistd.h>
31 
32 #include <tqfile.h>
33 
34 #include "ksslsettings.h"
35 #include <tdeglobal.h>
36 #include <kstandarddirs.h>
37 #include <kdebug.h>
38 
39 // this hack provided by Malte Starostik to avoid glibc/openssl bug
40 // on some systems
41 #ifdef KSSL_HAVE_SSL
42 #define crypt _openssl_crypt
43 #include <openssl/ssl.h>
44 #undef crypt
45 #endif
46 #include <kopenssl.h>
47 
48 
49 class CipherNode {
50 public:
51  CipherNode(const char *_name, int _keylen) :
52  name(_name), keylen(_keylen) {}
53  TQString name;
54  int keylen;
55  inline int operator==(CipherNode &x)
56  { return ((x.keylen == keylen) && (x.name == name)); }
57  inline int operator< (CipherNode &x) { return keylen < x.keylen; }
58  inline int operator<=(CipherNode &x) { return keylen <= x.keylen; }
59  inline int operator> (CipherNode &x) { return keylen > x.keylen; }
60  inline int operator>=(CipherNode &x) { return keylen >= x.keylen; }
61 };
62 
63 
64 class KSSLSettingsPrivate {
65 public:
66  KSSLSettingsPrivate() {
67  kossl = NULL; // try to delay this as long as possible
68  }
69  ~KSSLSettingsPrivate() {
70 
71  }
72 
73  KOSSL *kossl;
74  bool m_bUseEGD;
75  bool m_bUseEFile;
76  TQString m_EGDPath;
77  bool m_bSendX509;
78  bool m_bPromptX509;
79 };
80 
81 //
82 // FIXME
83 // Implementation note: for now, we only read cipher settings from disk,
84 // and do not store them in memory. This should change.
85 //
86 
87 KSSLSettings::KSSLSettings(bool readConfig) {
88  d = new KSSLSettingsPrivate;
89  m_cfg = new TDEConfig("cryptodefaults", false, false);
90 
91  if (!TDEGlobal::dirs()->addResourceType("kssl", TDEStandardDirs::kde_default("data") + "kssl")) {
92  //kdDebug(7029) << "Error adding (kssl, share/apps/kssl)" << endl;
93  }
94 
95  if (readConfig) load();
96 }
97 
98 
99 // we don't save settings incase it was a temporary object
100 KSSLSettings::~KSSLSettings() {
101  delete m_cfg;
102  delete d;
103 }
104 
105 
106 bool KSSLSettings::sslv2() const {
107  return m_bUseSSLv2;
108 }
109 
110 
111 bool KSSLSettings::sslv3() const {
112  return m_bUseSSLv3;
113 }
114 
115 
116 bool KSSLSettings::tlsv1() const {
117  return m_bUseTLSv1;
118 }
119 
120 
121 // FIXME: we should make a default list available if this fails
122 // since OpenSSL seems to just choose any old thing if it's given an
123 // empty list. This behavior is not confirmed though.
124 TQString KSSLSettings::getCipherList() {
125  TQString clist;
126 #ifdef KSSL_HAVE_SSL
127  TQString tcipher;
128  bool firstcipher = true;
129  SSL_METHOD *meth = 0L;
130  TQPtrList<CipherNode> cipherList;
131 
132  cipherList.setAutoDelete(true);
133 
134  if (!d->kossl)
135  d->kossl = KOSSL::self();
136 
137  if (m_bUseSSLv3 && m_bUseSSLv2)
138  meth = d->kossl->TLS_client_method();
139  else if(m_bUseSSLv3)
140  meth = d->kossl->SSLv3_client_method();
141  else if (m_bUseSSLv2)
142  meth = d->kossl->SSLv2_client_method();
143 
144  SSL_CTX *ctx = d->kossl->SSL_CTX_new(meth);
145  SSL* ssl = d->kossl->SSL_new(ctx);
146  STACK_OF(SSL_CIPHER)* sk = d->kossl->SSL_get_ciphers(ssl);
147  int cnt = d->kossl->OPENSSL_sk_num(sk);
148  for (int i=0; i< cnt; i++) {
149  SSL_CIPHER *sc = reinterpret_cast<SSL_CIPHER*>(d->kossl->OPENSSL_sk_value(sk,i));
150  if (!sc)
151  break;
152 
153  if(!strcmp("SSLv2", d->kossl->SSL_CIPHER_get_version(sc)))
154  m_cfg->setGroup("SSLv2");
155  else
156  m_cfg->setGroup("SSLv3");
157 
158  tcipher.sprintf("cipher_%s", d->kossl->SSL_CIPHER_get_name(sc));
159  int bits = d->kossl->SSL_CIPHER_get_bits(sc, NULL);
160  if (m_cfg->readBoolEntry(tcipher, bits >= 56)) {
161  CipherNode *xx = new CipherNode(d->kossl->SSL_CIPHER_get_name(sc),bits);
162  if (!cipherList.contains(xx))
163  cipherList.prepend(xx);
164  else
165  delete xx;
166  }
167  }
168  d->kossl->SSL_free(ssl);
169  d->kossl->SSL_CTX_free(ctx);
170 
171  // Remove any ADH ciphers as per RFC2246
172  // Also remove NULL ciphers and 168bit ciphers
173  for (unsigned int i = 0; i < cipherList.count(); i++) {
174  CipherNode *j = 0L;
175  while ((j = cipherList.at(i)) != 0L) {
176  if (j->name.contains("ADH-") || j->name.contains("NULL-") || j->name.contains("DES-CBC3-SHA") || j->name.contains("FZA")) {
177  cipherList.remove(j);
178  } else {
179  break;
180  }
181  }
182  }
183 
184  // now assemble the list cipher1:cipher2:cipher3:...:ciphern
185  while (!cipherList.isEmpty()) {
186  if (firstcipher)
187  firstcipher = false;
188  else clist.append(":");
189  clist.append(cipherList.getLast()->name);
190  cipherList.removeLast();
191  } // while
192 
193  kdDebug(7029) << "Cipher list is: " << clist << endl;
194 
195 #endif
196  return clist;
197 }
198 
199 // FIXME - sync these up so that we can use them with the control module!!
200 void KSSLSettings::load() {
201  m_cfg->reparseConfiguration();
202 
203  m_cfg->setGroup("TLS");
204  m_bUseTLSv1 = m_cfg->readBoolEntry("Enabled", true);
205 
206 #if OPENSSL_VERSION_NUMBER >= 0x10100000L || defined(OPENSSL_NO_SSL2)
207  m_bUseSSLv2 = false;
208 #else
209  m_cfg->setGroup("SSLv2");
210  m_bUseSSLv2 = m_cfg->readBoolEntry("Enabled", false);
211 #endif
212 
213 #if defined(OPENSSL_NO_SSL3)
214  m_bUseSSLv3 = false;
215 #else
216  m_cfg->setGroup("SSLv3");
217  m_bUseSSLv3 = m_cfg->readBoolEntry("Enabled", true);
218 #endif
219 
220  m_cfg->setGroup("Warnings");
221  m_bWarnOnEnter = m_cfg->readBoolEntry("OnEnter", false);
222  m_bWarnOnLeave = m_cfg->readBoolEntry("OnLeave", true);
223  m_bWarnOnUnencrypted = m_cfg->readBoolEntry("OnUnencrypted", true);
224  m_bWarnOnMixed = m_cfg->readBoolEntry("OnMixed", true);
225 
226  m_cfg->setGroup("Validation");
227  m_bWarnSelfSigned = m_cfg->readBoolEntry("WarnSelfSigned", true);
228  m_bWarnExpired = m_cfg->readBoolEntry("WarnExpired", true);
229  m_bWarnRevoked = m_cfg->readBoolEntry("WarnRevoked", true);
230 
231  m_cfg->setGroup("EGD");
232  d->m_bUseEGD = m_cfg->readBoolEntry("UseEGD", false);
233  d->m_bUseEFile = m_cfg->readBoolEntry("UseEFile", false);
234  d->m_EGDPath = m_cfg->readPathEntry("EGDPath");
235 
236  m_cfg->setGroup("Auth");
237  d->m_bSendX509 = ("send" == m_cfg->readEntry("AuthMethod", ""));
238  d->m_bPromptX509 = ("prompt" == m_cfg->readEntry("AuthMethod", ""));
239 
240  #ifdef KSSL_HAVE_SSL
241 
242 
243 
244  #endif
245 }
246 
247 
248 void KSSLSettings::defaults() {
249  m_bUseTLSv1 = true;
250  m_bUseSSLv2 = false;
251  m_bUseSSLv3 = true;
252  m_bWarnOnEnter = false;
253  m_bWarnOnLeave = true;
254  m_bWarnOnUnencrypted = true;
255  m_bWarnOnMixed = true;
256  m_bWarnSelfSigned = true;
257  m_bWarnExpired = true;
258  m_bWarnRevoked = true;
259  d->m_bUseEGD = false;
260  d->m_bUseEFile = false;
261  d->m_EGDPath = "";
262 }
263 
264 
265 void KSSLSettings::save() {
266  m_cfg->setGroup("TLS");
267  m_cfg->writeEntry("Enabled", m_bUseTLSv1);
268 
269  m_cfg->setGroup("SSLv2");
270  m_cfg->writeEntry("Enabled", m_bUseSSLv2);
271 
272  m_cfg->setGroup("SSLv3");
273  m_cfg->writeEntry("Enabled", m_bUseSSLv3);
274 
275  m_cfg->setGroup("Warnings");
276  m_cfg->writeEntry("OnEnter", m_bWarnOnEnter);
277  m_cfg->writeEntry("OnLeave", m_bWarnOnLeave);
278  m_cfg->writeEntry("OnUnencrypted", m_bWarnOnUnencrypted);
279  m_cfg->writeEntry("OnMixed", m_bWarnOnMixed);
280 
281  m_cfg->setGroup("Validation");
282  m_cfg->writeEntry("WarnSelfSigned", m_bWarnSelfSigned);
283  m_cfg->writeEntry("WarnExpired", m_bWarnExpired);
284  m_cfg->writeEntry("WarnRevoked", m_bWarnRevoked);
285 
286  m_cfg->setGroup("EGD");
287  m_cfg->writeEntry("UseEGD", d->m_bUseEGD);
288  m_cfg->writeEntry("UseEFile", d->m_bUseEFile);
289  m_cfg->writePathEntry("EGDPath", d->m_EGDPath);
290 
291  m_cfg->sync();
292  // FIXME - ciphers
293 #if 0
294 #ifdef KSSL_HAVE_SSL
295  m_cfg->setGroup("SSLv2");
296  for (unsigned int i = 0; i < v2ciphers.count(); i++) {
297  TQString ciphername;
298  ciphername.sprintf("cipher_%s", v2ciphers[i].ascii());
299  if (v2selectedciphers.contains(v2ciphers[i])) {
300  m_cfg->writeEntry(ciphername, true);
301  } else m_cfg->writeEntry(ciphername, false);
302  }
303 
304  m_cfg->setGroup("SSLv3");
305  for (unsigned int i = 0; i < v3ciphers.count(); i++) {
306  TQString ciphername;
307  ciphername.sprintf("cipher_%s", v3ciphers[i].ascii());
308  if (v3selectedciphers.contains(v3ciphers[i])) {
309  m_cfg->writeEntry(ciphername, true);
310  } else m_cfg->writeEntry(ciphername, false);
311  }
312 #endif
313 
314  m_cfg->sync();
315 
316  // insure proper permissions -- contains sensitive data
317  TQString cfgName(TDEGlobal::dirs()->findResource("config", "cryptodefaults"));
318  if (!cfgName.isEmpty())
319  ::chmod(TQFile::encodeName(cfgName), 0600);
320 #endif
321 }
322 
323 
324 bool KSSLSettings::warnOnEnter() const { return m_bWarnOnEnter; }
325 void KSSLSettings::setWarnOnEnter(bool x) { m_bWarnOnEnter = x; }
326 bool KSSLSettings::warnOnUnencrypted() const { return m_bWarnOnUnencrypted; }
327 void KSSLSettings::setWarnOnUnencrypted(bool x) { m_bWarnOnUnencrypted = x; }
328 bool KSSLSettings::warnOnLeave() const { return m_bWarnOnLeave; }
329 void KSSLSettings::setWarnOnLeave(bool x) { m_bWarnOnLeave = x; }
330 bool KSSLSettings::warnOnMixed() const { return m_bWarnOnMixed; }
331 bool KSSLSettings::warnOnSelfSigned() const { return m_bWarnSelfSigned; }
332 bool KSSLSettings::warnOnRevoked() const { return m_bWarnRevoked; }
333 bool KSSLSettings::warnOnExpired() const { return m_bWarnExpired; }
334 bool KSSLSettings::useEGD() const { return d->m_bUseEGD; }
335 bool KSSLSettings::useEFile() const { return d->m_bUseEFile; }
336 bool KSSLSettings::autoSendX509() const { return d->m_bSendX509; }
337 bool KSSLSettings::promptSendX509() const { return d->m_bPromptX509; }
338 
339 void KSSLSettings::setTLSv1(bool enabled) { m_bUseTLSv1 = enabled; }
340 void KSSLSettings::setSSLv2(bool enabled) { m_bUseSSLv2 = enabled; }
341 void KSSLSettings::setSSLv3(bool enabled) { m_bUseSSLv3 = enabled; }
342 
343 TQString& KSSLSettings::getEGDPath() { return d->m_EGDPath; }
344 
KSSLSettings::getCipherList
TQString getCipherList()
Get the OpenSSL cipher list for selecting the list of ciphers to use in a connection.
Definition: ksslsettings.cpp:124
KSSLSettings::warnOnMixed
bool warnOnMixed() const
Does the user want to be warned during mixed SSL/non-SSL mode.
Definition: ksslsettings.cpp:330
KSSLSettings::autoSendX509
bool autoSendX509() const
Does the user want X.509 client certificates to always be sent when possible?
Definition: ksslsettings.cpp:336
KSSLSettings::defaults
void defaults()
Revert to default settings.
Definition: ksslsettings.cpp:248
KSSLSettings::warnOnRevoked
bool warnOnRevoked() const TDE_DEPRECATED
Do not use this.
Definition: ksslsettings.cpp:332
KSSLSettings::KSSLSettings
KSSLSettings(bool readConfig=true)
Construct a KSSL Settings object.
Definition: ksslsettings.cpp:87
KSSLSettings::sslv2
bool sslv2() const
Does the user allow SSLv2.
Definition: ksslsettings.cpp:106
KSSLSettings::setWarnOnUnencrypted
void setWarnOnUnencrypted(bool x)
Change the user's warnOnUnencrypted() setting.
Definition: ksslsettings.cpp:327
KSSLSettings::sslv3
bool sslv3() const
Does the user allow SSLv3.
Definition: ksslsettings.cpp:111
KSSLSettings::warnOnExpired
bool warnOnExpired() const TDE_DEPRECATED
Do not use this.
Definition: ksslsettings.cpp:333
KSSLSettings::warnOnSelfSigned
bool warnOnSelfSigned() const TDE_DEPRECATED
Do not use this.
Definition: ksslsettings.cpp:331
KSSLSettings::tlsv1
bool tlsv1() const
Does the user allow TLSv1.
Definition: ksslsettings.cpp:116
KSSLSettings::load
void load()
Load the user's settings.
Definition: ksslsettings.cpp:200
KSSLSettings::setSSLv3
void setSSLv3(bool enabled)
Change the user's SSLv3 preference.
Definition: ksslsettings.cpp:341
KSSLSettings::warnOnEnter
bool warnOnEnter() const
Does the user want to be warned on entering SSL mode.
Definition: ksslsettings.cpp:324
KSSLSettings::useEFile
bool useEFile() const
Does the user want to use an entropy file?
Definition: ksslsettings.cpp:335
KSSLSettings::setSSLv2
void setSSLv2(bool enabled)
Change the user's SSLv2 preference.
Definition: ksslsettings.cpp:340
KSSLSettings::setWarnOnLeave
void setWarnOnLeave(bool x)
Change the user's warnOnLeave() setting.
Definition: ksslsettings.cpp:329
KSSLSettings::warnOnUnencrypted
bool warnOnUnencrypted() const
Does the user want to be warned on sending unencrypted data.
Definition: ksslsettings.cpp:326
KSSLSettings::promptSendX509
bool promptSendX509() const
Does the user want to be prompted to send X.509 client certificates when possible?
Definition: ksslsettings.cpp:337
KSSLSettings::setTLSv1
void setTLSv1(bool enabled)
Change the user's TLSv1 preference.
Definition: ksslsettings.cpp:339
KSSLSettings::getEGDPath
TQString & getEGDPath()
Get the configured path to the entropy gathering daemon or entropy file.
Definition: ksslsettings.cpp:343
KSSLSettings::save
void save()
Save the current settings.
Definition: ksslsettings.cpp:265
KSSLSettings::~KSSLSettings
~KSSLSettings()
Destroy this KSSL Settings object.
Definition: ksslsettings.cpp:100
KSSLSettings::useEGD
bool useEGD() const
Does the user want to use the Entropy Gathering Daemon?
Definition: ksslsettings.cpp:334
KSSLSettings::setWarnOnEnter
void setWarnOnEnter(bool x)
Change the user's warnOnEnter() setting.
Definition: ksslsettings.cpp:325
KSSLSettings::warnOnLeave
bool warnOnLeave() const
Does the user want to be warned on leaving SSL mode.
Definition: ksslsettings.cpp:328

tdeio/kssl

Skip menu "tdeio/kssl"
  • Main Page
  • Alphabetical List
  • Class List
  • File List
  • Class Members
  • Related Pages

tdeio/kssl

Skip menu "tdeio/kssl"
  • arts
  • dcop
  • dnssd
  • interfaces
  •   kspeech
  •     interface
  •     library
  •   tdetexteditor
  • kate
  • kded
  • kdoctools
  • kimgio
  • kjs
  • libtdemid
  • libtdescreensaver
  • tdeabc
  • tdecmshell
  • tdecore
  • tdefx
  • tdehtml
  • tdeinit
  • tdeio
  •   bookmarks
  •   httpfilter
  •   kpasswdserver
  •   kssl
  •   tdefile
  •   tdeio
  •   tdeioexec
  • tdeioslave
  •   http
  • tdemdi
  •   tdemdi
  • tdenewstuff
  • tdeparts
  • tdeprint
  • tderandr
  • tderesources
  • tdespell2
  • tdesu
  • tdeui
  • tdeunittest
  • tdeutils
  • tdewallet
Generated for tdeio/kssl by doxygen 1.9.1
This website is maintained by Timothy Pearson.