X-Git-Url: http://www.privoxy.org/gitweb/?a=blobdiff_plain;ds=sidebyside;f=openssl.c;h=6cc2af55b5a99a46270a734853598e020fd44ae5;hb=1a70173d7f1e3ac1e9bf678bd602537a06e0f406;hp=30ecfe3791b4caac688d24e970d7682c45d384cd;hpb=bf95fdb2933f77e06e8795567632f1550d01c8d9;p=privoxy.git diff --git a/openssl.c b/openssl.c index 30ecfe37..6cc2af55 100644 --- a/openssl.c +++ b/openssl.c @@ -1,11 +1,13 @@ /********************************************************************* * - * File : $Source: $ + * File : $Source: /cvsroot/ijbswa/current/openssl.c,v $ * * Purpose : File with TLS/SSL extension. Contains methods for * creating, using and closing TLS/SSL connections. * * Copyright : Written by and Copyright (c) 2020 Maxim Antonov + * Copyright (C) 2017 Vaclav Svec. FIT CVUT. + * Copyright (C) 2018-2020 by Fabian Keil * * This program is free software; you can redistribute it * and/or modify it under the terms of the GNU General @@ -64,11 +66,19 @@ static void log_ssl_errors(int debuglevel, const char* fmt, ...) __attribute__(( static int ssl_inited = 0; +#if OPENSSL_VERSION_NUMBER < 0x10100000L +#define X509_set1_notBefore X509_set_notBefore +#define X509_set1_notAfter X509_set_notAfter +#define X509_get0_serialNumber X509_get_serialNumber +#define X509_get0_notBefore X509_get_notBefore +#define X509_get0_notAfter X509_get_notAfter +#endif + /********************************************************************* * * Function : openssl_init * - * Description : INitializes OpenSSL library once + * Description : Initializes OpenSSL library once * * Parameters : N/A * @@ -106,7 +116,7 @@ static void openssl_init(void) * or has not yet been sent by the remote end. * * Parameters : - * 1 : ssl = SSL context to test + * 1 : ssl_attr = SSL context to test * * Returns : 0 => No data are pending * >0 => Pending data length @@ -132,7 +142,7 @@ extern size_t is_ssl_pending(struct ssl_attr *ssl_attr) * connection context. * * Parameters : - * 1 : ssl = SSL context to send data to + * 1 : ssl_attr = SSL context to send data to * 2 : buf = Pointer to data to be sent * 3 : len = Length of data to be sent to the SSL context * @@ -161,7 +171,7 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si */ while ((ret = BIO_write(bio, (const unsigned char *)(buf + pos), - send_len)) < 0) + send_len)) <= 0) { if (!BIO_should_retry(bio)) { @@ -186,7 +196,7 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si * it into buffer. * * Parameters : - * 1 : ssl = SSL context to receive data from + * 1 : ssl_attr = SSL context to receive data from * 2 : buf = Pointer to buffer where data will be written * 3 : max_length = Maximum number of bytes to read * @@ -250,7 +260,9 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) char *encoded_text; long l; const ASN1_INTEGER *bs; +#if OPENSSL_VERSION_NUMBER > 0x10100000L const X509_ALGOR *tsig_alg; +#endif int loc; if (!bio) @@ -404,7 +416,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) if (BIO_puts(bio, "\nsubject name : ") <= 0) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for sublect failed"); + log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for subject failed"); ret = -1; goto exit; } @@ -440,6 +452,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) goto exit; } +#if OPENSSL_VERSION_NUMBER > 0x10100000L if (BIO_puts(bio, "\nsigned using : ") <= 0) { log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for signed using failed"); @@ -453,6 +466,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) ret = -1; goto exit; } +#endif pkey = X509_get_pubkey(crt); if (!pkey) { @@ -807,7 +821,8 @@ extern int create_client_ssl_connection(struct client_state *csp) csp->http->hash_of_host_hex); if (BIO_do_handshake(ssl_attr->openssl_attr.bio) != 1) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_do_handshake failed"); + log_ssl_errors(LOG_LEVEL_ERROR, + "The TLS/SSL handshake with the client failed"); ret = -1; goto exit; } @@ -995,13 +1010,35 @@ extern int create_server_ssl_connection(struct client_state *csp) /* * Set the hostname to check against the received server certificate */ +#if OPENSSL_VERSION_NUMBER > 0x10100000L if (!SSL_set1_host(ssl, csp->http->host)) { log_ssl_errors(LOG_LEVEL_ERROR, "SSL_set1_host failed"); ret = -1; goto exit; } - +#else + if (host_is_ip_address(csp->http->host)) + { + if (X509_VERIFY_PARAM_set1_ip_asc(ssl->param, csp->http->host) != 1) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "X509_VERIFY_PARAM_set1_ip_asc() failed"); + ret = -1; + goto exit; + } + } + else + { + if (X509_VERIFY_PARAM_set1_host(ssl->param, csp->http->host, 0) != 1) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "X509_VERIFY_PARAM_set1_host() failed"); + ret = -1; + goto exit; + } + } +#endif /* SNI extension */ if (!SSL_set_tlsext_host_name(ssl, csp->http->host)) { @@ -1018,7 +1055,8 @@ extern int create_server_ssl_connection(struct client_state *csp) if (BIO_do_handshake(ssl_attrs->bio) != 1) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_do_handshake failed"); + log_ssl_errors(LOG_LEVEL_ERROR, + "The TLS/SSL handshake with the server failed"); ret = -1; goto exit; } @@ -1134,11 +1172,11 @@ static void log_ssl_errors(int debuglevel, const char* fmt, ...) va_end(args); /* * In case if called by mistake and there were - * no SSL errors let's report it to the log. + * no TLS/SSL errors let's report it to the log. */ if (!reported) { - log_error(debuglevel, "%s: no ssl errors detected", prefix); + log_error(debuglevel, "%s: no TLS/SSL errors detected", prefix); } } @@ -1515,13 +1553,13 @@ static int ssl_certificate_is_invalid(const char *cert_file) * 1 : cert = The certificate to modify * 2 : issuer = Issuer certificate * 3 : nid = OpenSSL NID - * 2 : data = extension value + * 4 : value = extension value * * Returns : 0 => Error while setting extensuon data * 1 => It worked * *********************************************************************/ -static int set_x509_ext(X509 *cert, X509 *issuer, int nid, const char *value) +static int set_x509_ext(X509 *cert, X509 *issuer, int nid, char *value) { X509_EXTENSION *ext = NULL; X509V3_CTX ctx; @@ -1560,7 +1598,7 @@ exit: * Parameters : * 1 : cert = The certificate to modify * 2 : issuer = Issuer certificate - * 2 : hostname = The hostname to add + * 3 : hostname = The hostname to add * * Returns : 0 => Error while creating certificate. * 1 => It worked