Re: Using the SSL module.

On 22 Jun 2015 16:48, "Chris Angelico" <[email protected]> wrote:
>
> On Mon, Jun 22, 2015 at 4:34 PM, Trilok Tourani
> <[email protected]> wrote:
> > Thanks Chris. Any example would be great.
>
> Okay. Got around to dusting off some old code and making sure it
> actually, yaknow, works. This is written for Pike 8.1, so you may need
> to make some changes for 7.8.
>
>
>
> void http_query(Protocols.HTTP.Server.Request r)
> {
>     write("Request for %s\n",r->not_query);
>     r->response_and_finish((["data":"You requested:
> "+r->not_query,"type":"text/plain"]));
> }
>
> void sockread(object sock,string data)
> {
>     write("[%d] Data received: %O\n",hash_value(sock),data);
>     if (String.trim_all_whites(data)=="quit") {sock->write("Bye!\n");
> sock->close();}
>     else sock->write("Uh huh.\n");
> }
>
> void sockgone(object sock)
> {
>     write("[%d] Disconnected.\n",hash_value(sock));
> }
>
> object mainsock;
> void accept(object sock)
> {
>     mainsock->accept(); //Will return sock, same as the argument.
> Dunno why we get it both ways.
>     write("[%d] New connection from
> %s\n",hash_value(sock),sock->query_address());
>     sock->set_read_callback(sockread);
>     sock->set_close_callback(sockgone);
>     sock->set_id(sock);
>     sock->write("Hello, world!\n");
> }
>
> int main()
> {
>     //Load up three files...
>     //1) Certificate chain from the CSA
>     sscanf(Stdio.read_file("gd_bundle.crt"),"%{%*s-----BEGIN
> CERTIFICATE-----%s-----END CERTIFICATE-----%}",array certs);

[Parsing of a PEM-file by hand removed]

You might want to have a look at Standards.PEM.

>     write("Keys loaded successfully.\n");
>
>     Protocols.HTTP.Server.SSLPort(http_query,443,"::",key,certs);
>
>     object ctx=SSL.Context();
>
ctx->add_cert(Standards.PKCS.RSA.parse_private_key(key),certs,({"*"}));

Note that the add_cert() function is new in Pike 8.0.

>     mainsock=SSL.Port(ctx); mainsock->bind(1234,accept,"::");
>     write("Listening on ports 443 and 1234.\n");
>     return -1;
> }
>
>
>
> This is a dual server - HTTPS and a TLS-enabled telnet-like
> connection. For this, I used a certificate that I bought from GoDaddy,
> so the authority chain comes from the GoDaddy certificate bundle
> (gd_bundle.crt). Using a self-signed cert would also work, and as
> Grubba pointed out, Pike is quite capable of generating those.
>
> It's pretty simple, and might even be simpler than I've shown here.
> Note the one liner to set up HTTPS hosting... a simple reactive
> function to handle requests, and you can completely ignore SSL and
> just work with the requests themselves.

/grubba