25 #include <sys/types.h>
34 #include "ksslsettings.h"
35 #include <tdeglobal.h>
36 #include <tdestandarddirs.h>
42 #define crypt _openssl_crypt
43 #include <openssl/ssl.h>
51 CipherNode(
const char *_name,
int _keylen) :
52 name(_name), keylen(_keylen) {}
55 inline int operator==(CipherNode &x)
56 {
return ((x.keylen == keylen) && (x.name == name)); }
57 inline int operator< (CipherNode &x) {
return keylen < x.keylen; }
58 inline int operator<=(CipherNode &x) {
return keylen <= x.keylen; }
59 inline int operator> (CipherNode &x) {
return keylen > x.keylen; }
60 inline int operator>=(CipherNode &x) {
return keylen >= x.keylen; }
64 class KSSLSettingsPrivate {
66 KSSLSettingsPrivate() {
69 ~KSSLSettingsPrivate() {
88 d =
new KSSLSettingsPrivate;
89 m_cfg =
new TDEConfig(
"cryptodefaults",
false,
false);
91 if (!TDEGlobal::dirs()->addResourceType(
"kssl", TDEStandardDirs::kde_default(
"data") +
"kssl")) {
95 if (readConfig)
load();
128 bool firstcipher =
true;
129 SSL_METHOD *meth = 0L;
130 TQPtrList<CipherNode> cipherList;
132 cipherList.setAutoDelete(
true);
135 d->kossl = KOSSL::self();
137 if (m_bUseSSLv3 && m_bUseSSLv2)
138 meth = d->kossl->TLS_client_method();
140 meth = d->kossl->SSLv3_client_method();
141 else if (m_bUseSSLv2)
142 meth = d->kossl->SSLv2_client_method();
144 SSL_CTX *ctx = d->kossl->SSL_CTX_new(meth);
145 SSL* ssl = d->kossl->SSL_new(ctx);
146 STACK_OF(SSL_CIPHER)* sk = d->kossl->SSL_get_ciphers(ssl);
147 int cnt = d->kossl->OPENSSL_sk_num(sk);
148 for (
int i=0; i< cnt; i++) {
149 SSL_CIPHER *sc =
reinterpret_cast<SSL_CIPHER*
>(d->kossl->OPENSSL_sk_value(sk,i));
153 if(!strcmp(
"SSLv2", d->kossl->SSL_CIPHER_get_version(sc)))
154 m_cfg->setGroup(
"SSLv2");
156 m_cfg->setGroup(
"SSLv3");
158 tcipher.sprintf(
"cipher_%s", d->kossl->SSL_CIPHER_get_name(sc));
159 int bits = d->kossl->SSL_CIPHER_get_bits(sc, NULL);
160 if (m_cfg->readBoolEntry(tcipher, bits >= 56)) {
161 CipherNode *xx =
new CipherNode(d->kossl->SSL_CIPHER_get_name(sc),bits);
162 if (!cipherList.contains(xx))
163 cipherList.prepend(xx);
168 d->kossl->SSL_free(ssl);
169 d->kossl->SSL_CTX_free(ctx);
173 for (
unsigned int i = 0; i < cipherList.count(); i++) {
175 while ((j = cipherList.at(i)) != 0L) {
176 if (j->name.contains(
"ADH-") || j->name.contains(
"NULL-") || j->name.contains(
"DES-CBC3-SHA") || j->name.contains(
"FZA")) {
177 cipherList.remove(j);
185 while (!cipherList.isEmpty()) {
188 else clist.append(
":");
189 clist.append(cipherList.getLast()->name);
190 cipherList.removeLast();
193 kdDebug(7029) <<
"Cipher list is: " << clist << endl;
201 m_cfg->reparseConfiguration();
203 m_cfg->setGroup(
"TLS");
204 m_bUseTLSv1 = m_cfg->readBoolEntry(
"Enabled",
true);
206 #if OPENSSL_VERSION_NUMBER >= 0x10100000L || defined(OPENSSL_NO_SSL2)
209 m_cfg->setGroup(
"SSLv2");
210 m_bUseSSLv2 = m_cfg->readBoolEntry(
"Enabled",
false);
213 #if defined(OPENSSL_NO_SSL3)
216 m_cfg->setGroup(
"SSLv3");
217 m_bUseSSLv3 = m_cfg->readBoolEntry(
"Enabled",
true);
220 m_cfg->setGroup(
"Warnings");
221 m_bWarnOnEnter = m_cfg->readBoolEntry(
"OnEnter",
false);
222 m_bWarnOnLeave = m_cfg->readBoolEntry(
"OnLeave",
true);
223 m_bWarnOnUnencrypted = m_cfg->readBoolEntry(
"OnUnencrypted",
true);
224 m_bWarnOnMixed = m_cfg->readBoolEntry(
"OnMixed",
true);
226 m_cfg->setGroup(
"Validation");
227 m_bWarnSelfSigned = m_cfg->readBoolEntry(
"WarnSelfSigned",
true);
228 m_bWarnExpired = m_cfg->readBoolEntry(
"WarnExpired",
true);
229 m_bWarnRevoked = m_cfg->readBoolEntry(
"WarnRevoked",
true);
231 m_cfg->setGroup(
"EGD");
232 d->m_bUseEGD = m_cfg->readBoolEntry(
"UseEGD",
false);
233 d->m_bUseEFile = m_cfg->readBoolEntry(
"UseEFile",
false);
234 d->m_EGDPath = m_cfg->readPathEntry(
"EGDPath");
236 m_cfg->setGroup(
"Auth");
237 d->m_bSendX509 = (
"send" == m_cfg->readEntry(
"AuthMethod",
""));
238 d->m_bPromptX509 = (
"prompt" == m_cfg->readEntry(
"AuthMethod",
""));
252 m_bWarnOnEnter =
false;
253 m_bWarnOnLeave =
true;
254 m_bWarnOnUnencrypted =
true;
255 m_bWarnOnMixed =
true;
256 m_bWarnSelfSigned =
true;
257 m_bWarnExpired =
true;
258 m_bWarnRevoked =
true;
259 d->m_bUseEGD =
false;
260 d->m_bUseEFile =
false;
266 m_cfg->setGroup(
"TLS");
267 m_cfg->writeEntry(
"Enabled", m_bUseTLSv1);
269 m_cfg->setGroup(
"SSLv2");
270 m_cfg->writeEntry(
"Enabled", m_bUseSSLv2);
272 m_cfg->setGroup(
"SSLv3");
273 m_cfg->writeEntry(
"Enabled", m_bUseSSLv3);
275 m_cfg->setGroup(
"Warnings");
276 m_cfg->writeEntry(
"OnEnter", m_bWarnOnEnter);
277 m_cfg->writeEntry(
"OnLeave", m_bWarnOnLeave);
278 m_cfg->writeEntry(
"OnUnencrypted", m_bWarnOnUnencrypted);
279 m_cfg->writeEntry(
"OnMixed", m_bWarnOnMixed);
281 m_cfg->setGroup(
"Validation");
282 m_cfg->writeEntry(
"WarnSelfSigned", m_bWarnSelfSigned);
283 m_cfg->writeEntry(
"WarnExpired", m_bWarnExpired);
284 m_cfg->writeEntry(
"WarnRevoked", m_bWarnRevoked);
286 m_cfg->setGroup(
"EGD");
287 m_cfg->writeEntry(
"UseEGD", d->m_bUseEGD);
288 m_cfg->writeEntry(
"UseEFile", d->m_bUseEFile);
289 m_cfg->writePathEntry(
"EGDPath", d->m_EGDPath);
295 m_cfg->setGroup(
"SSLv2");
296 for (
unsigned int i = 0; i < v2ciphers.count(); i++) {
298 ciphername.sprintf(
"cipher_%s", v2ciphers[i].ascii());
299 if (v2selectedciphers.contains(v2ciphers[i])) {
300 m_cfg->writeEntry(ciphername,
true);
301 }
else m_cfg->writeEntry(ciphername,
false);
304 m_cfg->setGroup(
"SSLv3");
305 for (
unsigned int i = 0; i < v3ciphers.count(); i++) {
307 ciphername.sprintf(
"cipher_%s", v3ciphers[i].ascii());
308 if (v3selectedciphers.contains(v3ciphers[i])) {
309 m_cfg->writeEntry(ciphername,
true);
310 }
else m_cfg->writeEntry(ciphername,
false);
317 TQString cfgName(TDEGlobal::dirs()->findResource(
"config",
"cryptodefaults"));
318 if (!cfgName.isEmpty())
319 ::chmod(TQFile::encodeName(cfgName), 0600);