version 1.9, 2004/06/17 10:15:46
|
version 1.14, 2015/11/08 03:15:13
|
Line 37 use strict;
|
Line 37 use strict;
|
|
|
use IO::Socket::INET; |
use IO::Socket::INET; |
use IO::Socket::SSL; |
use IO::Socket::SSL; |
|
use Net::SSLeay; |
|
|
use Fcntl; |
use Fcntl; |
use POSIX; |
use POSIX; |
Line 141 sub PromoteClientSocket {
|
Line 142 sub PromoteClientSocket {
|
my $dupfno = fcntl($PlaintextSocket, F_DUPFD, 0); |
my $dupfno = fcntl($PlaintextSocket, F_DUPFD, 0); |
Debug("Client promotion got dup = $dupfno\n"); |
Debug("Client promotion got dup = $dupfno\n"); |
|
|
|
# Starting with IO::Socket::SSL rev. 1.79, carp warns that a verify |
|
# mode of SSL_VERIFY_NONE should be explicitly set for client, if |
|
# verification is not to be used, and SSL_verify_mode is not set. |
|
# Starting with rev. 1.95, the default became SSL_VERIFY_PEER which |
|
# prevents connections to lond. |
|
# Set SSL_verify_mode to Net::SSLeay::VERIFY_NONE() instead of to |
|
# SSL_VERIFY_NONE for compatibility with IO::Socket::SSL rev. 1.01 |
|
# used by CentOS/RHEL/Scientific Linux 5). |
|
|
my $client = IO::Socket::SSL->new_from_fd($dupfno, |
my $client = IO::Socket::SSL->new_from_fd($dupfno, |
SSL_user_cert => 1, |
SSL_use_cert => 1, |
SSL_key_file => $KeyFile, |
SSL_key_file => $KeyFile, |
SSL_cert_file => $MyCert, |
SSL_cert_file => $MyCert, |
SSL_ca_fie => $CACert); |
SSL_ca_file => $CACert, |
|
SSL_verify_mode => Net::SSLeay::VERIFY_NONE()); |
|
|
if(!$client) { |
if(!$client) { |
$lasterror = IO::Socket::SSL::errstr(); |
$lasterror = IO::Socket::SSL::errstr(); |
Line 196 sub PromoteServerSocket {
|
Line 206 sub PromoteServerSocket {
|
Debug(" Fileno = $dupfno\n"); |
Debug(" Fileno = $dupfno\n"); |
my $client = IO::Socket::SSL->new_from_fd($dupfno, |
my $client = IO::Socket::SSL->new_from_fd($dupfno, |
SSL_server => 1, # Server role. |
SSL_server => 1, # Server role. |
SSL_user_cert => 1, |
SSL_use_cert => 1, |
SSL_key_file => $KeyFile, |
SSL_key_file => $KeyFile, |
SSL_cert_file => $MyCert, |
SSL_cert_file => $MyCert, |
SSL_ca_fie => $CACert); |
SSL_ca_file => $CACert); |
if(!$client) { |
if(!$client) { |
$lasterror = IO::Socket::SSL::errstr(); |
$lasterror = IO::Socket::SSL::errstr(); |
return undef; |
return undef; |
Line 273 sub CertificateFile {
|
Line 283 sub CertificateFile {
|
# Build the actual filenames and check for their existence and |
# Build the actual filenames and check for their existence and |
# readability. |
# readability. |
|
|
my $CaFilename = $CertificateDir.$pathsep.$CaFilename; |
$CaFilename = $CertificateDir.$pathsep.$CaFilename; |
my $CertFilename = $CertificateDir.$pathsep.$CertFilename; |
$CertFilename = $CertificateDir.$pathsep.$CertFilename; |
|
|
if((! -r $CaFilename) || (! -r $CertFilename)) { |
if((! -r $CaFilename) || (! -r $CertFilename)) { |
$lasterror = "CA file $CaFilename or Cert File: $CertFilename " |
$lasterror = "CA file $CaFilename or Cert File: $CertFilename " |
Line 314 sub KeyFile {
|
Line 324 sub KeyFile {
|
# Build the actual filename and ensure that it not only exists but |
# Build the actual filename and ensure that it not only exists but |
# is also readable: |
# is also readable: |
|
|
my $KeyFilename = $CertificateDir.$pathsep.$KeyFilename; |
$KeyFilename = $CertificateDir.$pathsep.$KeyFilename; |
if(! (-r $KeyFilename)) { |
if(! (-r $KeyFilename)) { |
$lasterror = "Unreadable key file $KeyFilename"; |
$lasterror = "Unreadable key file $KeyFilename"; |
return undef; |
return undef; |