/*********************************************************************
*
- * File : $Source: $
+ * File : $Source: /cvsroot/ijbswa/current/openssl.c,v $
*
* Purpose : File with TLS/SSL extension. Contains methods for
* creating, using and closing TLS/SSL connections.
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define X509_set1_notBefore X509_set_notBefore
#define X509_set1_notAfter X509_set_notAfter
+#define X509_get0_serialNumber X509_get_serialNumber
+#define X509_get0_notBefore X509_get_notBefore
+#define X509_get0_notAfter X509_get_notAfter
#endif
/*********************************************************************
*/
while ((ret = BIO_write(bio,
(const unsigned char *)(buf + pos),
- send_len)) < 0)
+ send_len)) <= 0)
{
if (!BIO_should_retry(bio))
{
*
* Function : ssl_store_cert
*
- * Description : This is a callback function for certificate verification.
- * It's called once for each certificate in the server's
- * certificate trusted chain and prepares information about
- * the certificate. The information can be used to inform
- * the user about invalid certificates.
+ * Description : This function is called once for each certificate in the
+ * server's certificate trusted chain and prepares
+ * information about the certificate. The information can
+ * be used to inform the user about invalid certificates.
*
* Parameters :
* 1 : csp = Current client state (buffers, headers, etc...)
- * 2 : crt = certificate from trusted chain
+ * 2 : crt = certificate from trusted chain
*
* Returns : 0 on success and negative value on error
*
char *encoded_text;
long l;
const ASN1_INTEGER *bs;
+#if OPENSSL_VERSION_NUMBER > 0x10100000L
const X509_ALGOR *tsig_alg;
+#endif
int loc;
if (!bio)
if (BIO_puts(bio, "serial number : ") <= 0)
{
- log_ssl_errors(LOG_LEVEL_ERROR, "BIO_write() for serial failed");
+ log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for serial failed");
ret = -1;
goto exit;
}
if (BIO_puts(bio, "\nsubject name : ") <= 0)
{
- log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for sublect failed");
+ log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for subject failed");
ret = -1;
goto exit;
}
goto exit;
}
+#if OPENSSL_VERSION_NUMBER > 0x10100000L
if (BIO_puts(bio, "\nsigned using : ") <= 0)
{
log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for signed using failed");
tsig_alg = X509_get0_tbs_sigalg(crt);
if (!i2a_ASN1_OBJECT(bio, tsig_alg->algorithm))
{
- log_ssl_errors(LOG_LEVEL_ERROR, "i2a_ASN1_OBJECT() for signed using on failed");
+ log_ssl_errors(LOG_LEVEL_ERROR, "i2a_ASN1_OBJECT() for signed using failed");
ret = -1;
goto exit;
}
+#endif
pkey = X509_get_pubkey(crt);
if (!pkey)
{
len = BIO_get_mem_data(bio, &bio_mem_data);
encoded_text = html_encode(bio_mem_data);
+ if (encoded_text == NULL)
+ {
+ log_error(LOG_LEVEL_ERROR,
+ "Failed to HTML-encode the certificate information");
+ ret = -1;
+ goto exit;
+ }
+
strlcpy(last->info_buf, encoded_text, sizeof(last->info_buf));
freez(encoded_text);
ret = 0;
csp->http->hash_of_host_hex);
if (BIO_do_handshake(ssl_attr->openssl_attr.bio) != 1)
{
- log_ssl_errors(LOG_LEVEL_ERROR, "BIO_do_handshake failed");
+ log_ssl_errors(LOG_LEVEL_ERROR,
+ "The TLS/SSL handshake with the client failed");
ret = -1;
goto exit;
}
/*
* Set the hostname to check against the received server certificate
*/
+#if OPENSSL_VERSION_NUMBER > 0x10100000L
if (!SSL_set1_host(ssl, csp->http->host))
{
log_ssl_errors(LOG_LEVEL_ERROR, "SSL_set1_host failed");
ret = -1;
goto exit;
}
-
+#else
+ if (host_is_ip_address(csp->http->host))
+ {
+ if (X509_VERIFY_PARAM_set1_ip_asc(ssl->param, csp->http->host) != 1)
+ {
+ log_ssl_errors(LOG_LEVEL_ERROR,
+ "X509_VERIFY_PARAM_set1_ip_asc() failed");
+ ret = -1;
+ goto exit;
+ }
+ }
+ else
+ {
+ if (X509_VERIFY_PARAM_set1_host(ssl->param, csp->http->host, 0) != 1)
+ {
+ log_ssl_errors(LOG_LEVEL_ERROR,
+ "X509_VERIFY_PARAM_set1_host() failed");
+ ret = -1;
+ goto exit;
+ }
+ }
+#endif
/* SNI extension */
if (!SSL_set_tlsext_host_name(ssl, csp->http->host))
{
if (BIO_do_handshake(ssl_attrs->bio) != 1)
{
- log_ssl_errors(LOG_LEVEL_ERROR, "BIO_do_handshake failed");
+ log_ssl_errors(LOG_LEVEL_ERROR,
+ "The TLS/SSL handshake with the server failed");
ret = -1;
goto exit;
}
va_end(args);
/*
* In case if called by mistake and there were
- * no SSL errors let's report it to the log.
+ * no TLS/SSL errors let's report it to the log.
*/
if (!reported)
{
- log_error(debuglevel, "%s: no ssl errors detected", prefix);
+ log_error(debuglevel, "%s: no TLS/SSL errors detected", prefix);
}
}