summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rwxr-xr-xPICA_client.c32
-rwxr-xr-xPICA_client.h15
-rwxr-xr-xPICA_node.c2
-rw-r--r--pica-client/globals.h1
-rw-r--r--pica-client/main.cpp15
-rw-r--r--pica-client/nodethread.cpp2
-rw-r--r--pica-client/openssltool.cpp20
-rw-r--r--pica-client/openssltool.h2
8 files changed, 79 insertions, 10 deletions
diff --git a/PICA_client.c b/PICA_client.c
index 40d708e..c11e244 100755
--- a/PICA_client.c
+++ b/PICA_client.c
@@ -2,7 +2,7 @@
#include "PICA_proto.h"
#include "PICA_msgproc.h"
#include "PICA_common.h"
-
+#include <openssl/dh.h>
//#ifdef NO_RAND_DEV
//#include "PICA_rand_seed.h"
//#endif
@@ -721,12 +721,16 @@ int PICA_new_connection(const char *nodeaddr,
const char *CA_file,
const char *cert_file,
const char *pkey_file,
+ const char *dh_param_file,
int (*password_cb)(char *buf, int size, int rwflag, void *userdata),
struct PICA_conninfo **ci)
{
int ret,ret_err;
struct PICA_conninfo *cid;
struct sockaddr_in a;
+DH *dh = NULL;
+FILE *dh_file = NULL;
+
if (!(nodeaddr && CA_file && cert_file && pkey_file && ci))
return PICA_ERRINVARG;
@@ -743,7 +747,7 @@ if (!cid->read_buf)
goto error_ret_1;
}
-cid->ctx=SSL_CTX_new(TLSv1_method());//(3)
+cid->ctx=SSL_CTX_new(TLSv1_2_method());//(3)
if (!cid->ctx)
{
@@ -751,6 +755,22 @@ if (!cid->ctx)
goto error_ret_2;
}
+dh_file = fopen(dh_param_file, "r");
+
+if (dh_file)
+ {
+ dh = PEM_read_DHparams(dh_file, NULL, NULL, NULL);
+ fclose(dh_file);
+ }
+
+if (1 != SSL_CTX_set_tmp_dh(cid->ctx, dh))
+{
+ ret_err = PICA_ERRSSL;
+ goto error_ret_2;
+}
+
+DH_free (dh);
+
if (!PICA_get_id_from_cert_file(cert_file, cid->id))
{
ret_err=PICA_ERRINVCERT;
@@ -781,6 +801,14 @@ ret=SSL_CTX_load_verify_locations(cid->ctx,CA_file,0/*"trustedCA/"*/);
//printf("loadverifylocations ret=%i\n",ret);//debug
SSL_CTX_set_client_CA_list(cid->ctx,SSL_load_client_CA_file(CA_file));
+ret = SSL_CTX_set_cipher_list(cid->ctx,"DHE-RSA-CAMELLIA256-SHA"/*:DHE-RSA-AES256-SHA256"*/);
+
+if (ret != 1)
+{
+ ret_err = PICA_ERRSSL;
+ goto error_ret_2;
+}
+
cid->ssl_comm=SSL_new(cid->ctx);//(4)
diff --git a/PICA_client.h b/PICA_client.h
index 4da2e98..2e3b9d5 100755
--- a/PICA_client.h
+++ b/PICA_client.h
@@ -173,13 +173,14 @@ int PICA_get_id_from_cert_file(const char *cert_file, unsigned char *id);
int PICA_client_init(struct PICA_client_callbacks *clcbs);
int PICA_new_connection
- ( const char *nodeaddr,
- unsigned int port,
- const char *CA_file,
- const char *cert_file,
- const char *pkey_file,
- int (*password_cb)(char *buf, int size, int rwflag, void *userdata),
- struct PICA_conninfo **ci);
+ (const char *nodeaddr,
+ unsigned int port,
+ const char *CA_file,
+ const char *cert_file,
+ const char *pkey_file,
+ const char *dh_param_file,
+ int (*password_cb)(char *buf, int size, int rwflag, void *userdata),
+ struct PICA_conninfo **ci);
int PICA_create_channel(struct PICA_conninfo *ci,const unsigned char *peer_id,struct PICA_chaninfo **chn);
int PICA_read_c2n(struct PICA_conninfo *ci);
diff --git a/PICA_node.c b/PICA_node.c
index e123fce..21f622e 100755
--- a/PICA_node.c
+++ b/PICA_node.c
@@ -1342,7 +1342,7 @@ if (ret_comm == -1)
//PICA_rand_seed();
//#endif
-ctx = SSL_CTX_new(TLSv1_method());
+ctx = SSL_CTX_new(TLSv1_2_method());
if (!ctx)
PICA_fatal("unable to create SSL_CTX object");
diff --git a/pica-client/globals.h b/pica-client/globals.h
index d30305d..dcc4f8d 100644
--- a/pica-client/globals.h
+++ b/pica-client/globals.h
@@ -3,6 +3,7 @@
#define PICA_CLIENT_STORAGEDB "pica-client.sqlite"
#define PICA_CLIENT_CONFIGDIR ".pica-client"
+#define PICA_CLIENT_DHPARAMFILE "dhparam4096.pem"
#ifndef PICA_INSTALLPREFIX
diff --git a/pica-client/main.cpp b/pica-client/main.cpp
index 55dc10c..2cfa2d4 100644
--- a/pica-client/main.cpp
+++ b/pica-client/main.cpp
@@ -11,6 +11,7 @@
#include <QMessageBox>
#include <QString>
#include <QIcon>
+#include "openssltool.h"
//globals
QString config_dir;
@@ -239,6 +240,20 @@ static bool create_config_dir()
else
update_database();
+ if (!QFile::exists(config_dir + QDir::separator() + PICA_CLIENT_DHPARAMFILE))
+ {
+ OpenSSLTool osslt;
+ msgBox.setText(QString(QObject::tr("Diffie-Hellman parameters will be generated. Please wait. This process can take several minutes...")));
+ msgBox.exec();
+
+ if (!osslt.GenDHParam(4096, config_dir + QDir::separator() + PICA_CLIENT_DHPARAMFILE))
+ {
+ msgBox.setText(QString(QObject::tr("Failed to generate Diffie-Hellman parameters")));
+ msgBox.exec();
+ return false;
+ }
+ }
+
return true;
}
diff --git a/pica-client/nodethread.cpp b/pica-client/nodethread.cpp
index aa41b04..4065e79 100644
--- a/pica-client/nodethread.cpp
+++ b/pica-client/nodethread.cpp
@@ -1,6 +1,7 @@
#include "nodethread.h"
#include "mainwindow.h"
#include "../PICA_proto.h"
+#include "globals.h"
QMutex NodeThread::finished_mutex;
@@ -26,6 +27,7 @@ void NodeThread::run()
user_account.CA_file.toUtf8().constData(),
user_account.cert_file.toUtf8().constData(),
user_account.pkey_file.toUtf8().constData(),
+ (config_dir + QDir::separator() + PICA_CLIENT_DHPARAMFILE).toUtf8().constData(),
AskPassword::ask_password_cb,
&ci);
diff --git a/pica-client/openssltool.cpp b/pica-client/openssltool.cpp
index 1ee7a90..25640ca 100644
--- a/pica-client/openssltool.cpp
+++ b/pica-client/openssltool.cpp
@@ -158,5 +158,25 @@ QString OpenSSLTool::ReadStdOut()
return QString::fromUtf8(openssl_.readAllStandardOutput().constData());
}
+bool OpenSSLTool::GenDHParam(quint32 numbits, QString output_file)
+{//openssl dhparam -5 4096
+ openssl_.start("openssl",
+ QStringList()
+ <<"dhparam"
+ <<"-out"<<output_file
+ <<"-5"
+ <<QString::number(numbits));
+
+ if (!openssl_.waitForStarted())
+ return false;
+
+ if (!openssl_.waitForFinished(-1))
+ return false;
+
+ if (openssl_.exitCode() != 0)
+ return false;
+
+ return true;
+}
diff --git a/pica-client/openssltool.h b/pica-client/openssltool.h
index b2711bb..cafc291 100644
--- a/pica-client/openssltool.h
+++ b/pica-client/openssltool.h
@@ -17,6 +17,8 @@ public:
QString password, QObject *receiver, const char *finished_slot);
bool GenCertSignal(QString cert_file, QString keyfile, QString keypassword, QString subject, QObject *receiver, const char *finished_slot);
+ bool GenDHParam(quint32 numbits, QString output_file);
+
QString ReadStdErr();
QString ReadStdOut();
generated by cgit v1.2.1 (git 2.18.0) at 2026-10-16 19:57:50 +0000