create_server_ssl_connection(): Mimic SSL_set1_host() if it does not exist

[privoxy.git] / openssl.c

diff --git a/openssl.c b/openssl.c
index 30ecfe3..a2d8853 100644 (file)
--- a/openssl.c
+++ b/openssl.c
@@ -6,6 +6,8 @@
  *                creating, using and closing TLS/SSL connections.
  *
  * Copyright   :  Written by and Copyright (c) 2020 Maxim Antonov <mantonov@gmail.com>
+ *                Copyright (C) 2017 Vaclav Svec. FIT CVUT.
+ *                Copyright (C) 2018-2020 by Fabian Keil <fk@fabiankeil.de>
  *
  *                This program is free software; you can redistribute it
  *                and/or modify it under the terms of the GNU General
@@ -64,11 +66,19 @@ static void log_ssl_errors(int debuglevel, const char* fmt, ...) __attribute__((
 
 static int ssl_inited = 0;
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#define X509_set1_notBefore X509_set_notBefore
+#define X509_set1_notAfter X509_set_notAfter
+#define X509_get0_serialNumber X509_get_serialNumber
+#define X509_get0_notBefore X509_get_notBefore
+#define X509_get0_notAfter X509_get_notAfter
+#endif
+
 /*********************************************************************
  *
  * Function    :  openssl_init
  *
- * Description :  INitializes OpenSSL library once
+ * Description :  Initializes OpenSSL library once
  *
  * Parameters  :  N/A
  *
@@ -106,7 +116,7 @@ static void openssl_init(void)
  *                or has not yet been sent by the remote end.
  *
  * Parameters  :
- *          1  :  ssl = SSL context to test
+ *          1  :  ssl_attr = SSL context to test
  *
  * Returns     :   0 => No data are pending
  *                >0 => Pending data length
@@ -132,7 +142,7 @@ extern size_t is_ssl_pending(struct ssl_attr *ssl_attr)
  *                connection context.
  *
  * Parameters  :
- *          1  :  ssl = SSL context to send data to
+ *          1  :  ssl_attr = SSL context to send data to
  *          2  :  buf = Pointer to data to be sent
  *          3  :  len = Length of data to be sent to the SSL context
  *
@@ -186,7 +196,7 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si
  *                it into buffer.
  *
  * Parameters  :
- *          1  :  ssl = SSL context to receive data from
+ *          1  :  ssl_attr = SSL context to receive data from
  *          2  :  buf = Pointer to buffer where data will be written
  *          3  :  max_length = Maximum number of bytes to read
  *
@@ -250,7 +260,9 @@ static int ssl_store_cert(struct client_state *csp, X509* crt)
    char *encoded_text;
    long l;
    const ASN1_INTEGER *bs;
+#if OPENSSL_VERSION_NUMBER > 0x10100000L
    const X509_ALGOR *tsig_alg;
+#endif
    int loc;
 
    if (!bio)
@@ -440,6 +452,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt)
       goto exit;
    }
 
+#if OPENSSL_VERSION_NUMBER > 0x10100000L
    if (BIO_puts(bio, "\nsigned using      : ") <= 0)
    {
       log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for signed using failed");
@@ -453,6 +466,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt)
       ret = -1;
       goto exit;
    }
+#endif
    pkey = X509_get_pubkey(crt);
    if (!pkey)
    {
@@ -995,13 +1009,35 @@ extern int create_server_ssl_connection(struct client_state *csp)
    /*
     * Set the hostname to check against the received server certificate
     */
+#if OPENSSL_VERSION_NUMBER > 0x10100000L
    if (!SSL_set1_host(ssl, csp->http->host))
    {
       log_ssl_errors(LOG_LEVEL_ERROR, "SSL_set1_host failed");
       ret = -1;
       goto exit;
    }
-
+#else
+   if (host_is_ip_address(csp->http->host))
+   {
+      if (X509_VERIFY_PARAM_set1_ip_asc(ssl->param,  csp->http->host) != 1)
+      {
+         log_ssl_errors(LOG_LEVEL_ERROR,
+            "X509_VERIFY_PARAM_set1_ip_asc() failed");
+         ret = -1;
+         goto exit;
+      }
+   }
+   else
+   {
+      if (X509_VERIFY_PARAM_set1_host(ssl->param,  csp->http->host, 0) != 1)
+      {
+         log_ssl_errors(LOG_LEVEL_ERROR,
+            "X509_VERIFY_PARAM_set1_host() failed");
+         ret = -1;
+         goto exit;
+      }
+   }
+#endif
    /* SNI extension */
    if (!SSL_set_tlsext_host_name(ssl, csp->http->host))
    {
@@ -1515,13 +1551,13 @@ static int ssl_certificate_is_invalid(const char *cert_file)
  *          1  :  cert = The certificate to modify
  *          2  :  issuer = Issuer certificate
  *          3  :  nid = OpenSSL NID
- *          2  :  data = extension value
+ *          4  :  value = extension value
  *
  * Returns     :   0 => Error while setting extensuon data
  *                 1 => It worked
  *
  *********************************************************************/
-static int set_x509_ext(X509 *cert, X509 *issuer, int nid, const char *value)
+static int set_x509_ext(X509 *cert, X509 *issuer, int nid, char *value)
 {
    X509_EXTENSION *ext = NULL;
    X509V3_CTX ctx;
@@ -1560,7 +1596,7 @@ exit:
  * Parameters  :
  *          1  :  cert = The certificate to modify
  *          2  :  issuer = Issuer certificate
- *          2  :  hostname = The hostname to add
+ *          3  :  hostname = The hostname to add
  *
  * Returns     :   0 => Error while creating certificate.
  *                 1 => It worked