diff options
author | Alon Bar-Lev <alon.barlev@gmail.com> | 2012-02-29 22:11:59 +0200 |
---|---|---|
committer | David Sommerseth <davids@redhat.com> | 2012-03-22 22:07:08 +0100 |
commit | 34cb9132ef2dae08f91a66015ea5437539a4b557 (patch) | |
tree | edd69bb83cc490a47692cb847d066231cd6146fd /src/openvpn/ssl_verify_openssl.h | |
parent | fcff80aac1f71ebf881fbc269fb3c4df0789de6b (diff) | |
download | openvpn-34cb9132ef2dae08f91a66015ea5437539a4b557.tar.gz openvpn-34cb9132ef2dae08f91a66015ea5437539a4b557.tar.xz openvpn-34cb9132ef2dae08f91a66015ea5437539a4b557.zip |
build: standard directory layout
Suitable for mature project.
root - administrative stuff
doc - documents
src - sources
tests - tests
distro - distro specific files
sample - samples
SIDE EFFECT: many changes to rpm spec.
Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
Acked-by: Adriaan de Jong <dejong@fox-it.com>
Signed-off-by: David Sommerseth <davids@redhat.com>
Diffstat (limited to 'src/openvpn/ssl_verify_openssl.h')
-rw-r--r-- | src/openvpn/ssl_verify_openssl.h | 74 |
1 files changed, 74 insertions, 0 deletions
diff --git a/src/openvpn/ssl_verify_openssl.h b/src/openvpn/ssl_verify_openssl.h new file mode 100644 index 0000000..9c76d34 --- /dev/null +++ b/src/openvpn/ssl_verify_openssl.h @@ -0,0 +1,74 @@ +/* + * OpenVPN -- An application to securely tunnel IP networks + * over a single TCP/UDP port, with support for SSL/TLS-based + * session authentication and key exchange, + * packet encryption, packet authentication, and + * packet compression. + * + * Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net> + * Copyright (C) 2010 Fox Crypto B.V. <openvpn@fox-it.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 + * as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program (see the file COPYING included with this + * distribution); if not, write to the Free Software Foundation, Inc., + * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/** + * @file Control Channel Verification Module OpenSSL backend + */ + + +#ifndef SSL_VERIFY_OPENSSL_H_ +#define SSL_VERIFY_OPENSSL_H_ + +#include <openssl/x509.h> +typedef X509 x509_cert_t; + +/** @name Function for authenticating a new connection from a remote OpenVPN peer + * @{ */ + +/** + * Verify that the remote OpenVPN peer's certificate allows setting up a + * VPN tunnel. + * @ingroup control_tls + * + * This callback function is called every time a new TLS session is being + * setup to determine whether the remote OpenVPN peer's certificate is + * allowed to connect. It is called for once for every certificate in the chain. + * The callback functionality is configured in the \c init_ssl() function, which + * calls the OpenSSL library's \c SSL_CTX_set_verify() function with \c + * verify_callback() as its callback argument. + * + * It checks preverify_ok, and registers the certificate hash. If these steps + * succeed, it calls the \c verify_cert() function, which performs + * OpenVPN-specific verification. + * + * @param preverify_ok - Whether the remote OpenVPN peer's certificate + * past verification. A value of 1 means it + * verified successfully, 0 means it failed. + * @param ctx - The complete context used by the OpenSSL library + * to verify the certificate chain. + * + * @return The return value indicates whether the supplied certificate is + * allowed to set up a VPN tunnel. The following values can be + * returned: + * - \c 0: failure, this certificate is not allowed to connect. + * - \c 1: success, this certificate is allowed to connect. + */ +int verify_callback (int preverify_ok, X509_STORE_CTX * ctx); + +/** @} name Function for authenticating a new connection from a remote OpenVPN peer */ + +char *_openssl_get_subject (X509 *cert, char *buf, int size); + +#endif /* SSL_VERIFY_OPENSSL_H_ */ |