X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=openssl.c;h=2c065cc50aa3f2476fdd1ac63962caa0fb40c282;hp=a2d8853baaebce3243cce92e982f3bb220038b9b;hb=41f21279811940f86685dbf30934408e447e5c8f;hpb=80685cac02eeff1aec436a033d3e5e6721942f80 diff --git a/openssl.c b/openssl.c index a2d8853b..2c065cc5 100644 --- a/openssl.c +++ b/openssl.c @@ -1,6 +1,6 @@ /********************************************************************* * - * File : $Source: $ + * File : $Source: /cvsroot/ijbswa/current/openssl.c,v $ * * Purpose : File with TLS/SSL extension. Contains methods for * creating, using and closing TLS/SSL connections. @@ -55,7 +55,7 @@ #define CERTIFICATE_AUTHORITY_KEY "keyid:always" #define CERTIFICATE_ALT_NAME_PREFIX "DNS:" #define CERTIFICATE_VERSION 2 -#define VALID_DATETIME_FMT "%Y%m%d%H%M%SZ" +#define VALID_DATETIME_FMT "%y%m%d%H%M%SZ" #define VALID_DATETIME_BUFLEN 16 static int generate_webpage_certificate(struct client_state *csp); @@ -152,31 +152,39 @@ extern size_t is_ssl_pending(struct ssl_attr *ssl_attr) extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, size_t len) { BIO *bio = ssl_attr->openssl_attr.bio; + SSL *ssl; int ret = 0; int pos = 0; /* Position of unsent part in buffer */ + int fd = -1; if (len == 0) { return 0; } + if (BIO_get_ssl(bio, &ssl) == 1) + { + fd = SSL_get_fd(ssl); + } + while (pos < len) { int send_len = (int)len - pos; - log_error(LOG_LEVEL_WRITING, "TLS: %N", send_len, buf+pos); + log_error(LOG_LEVEL_WRITING, "TLS on socket %d: %N", + fd, send_len, buf+pos); /* * Sending one part of the buffer */ while ((ret = BIO_write(bio, (const unsigned char *)(buf + pos), - send_len)) < 0) + send_len)) <= 0) { if (!BIO_should_retry(bio)) { log_ssl_errors(LOG_LEVEL_ERROR, - "Sending data over TLS/SSL failed"); + "Sending data on socket %d over TLS/SSL failed", fd); return -1; } } @@ -207,7 +215,10 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t max_length) { BIO *bio = ssl_attr->openssl_attr.bio; + SSL *ssl; int ret = 0; + int fd = -1; + memset(buf, 0, max_length); /* @@ -221,12 +232,18 @@ extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t m if (ret < 0) { log_ssl_errors(LOG_LEVEL_ERROR, - "Receiving data over TLS/SSL failed"); + "Receiving data on socket %d over TLS/SSL failed", fd); return -1; } - log_error(LOG_LEVEL_RECEIVED, "TLS: %N", ret, buf); + if (BIO_get_ssl(bio, &ssl) == 1) + { + fd = SSL_get_fd(ssl); + } + + log_error(LOG_LEVEL_RECEIVED, "TLS from socket %d: %N", + fd, ret, buf); return ret; } @@ -236,15 +253,14 @@ extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t m * * Function : ssl_store_cert * - * Description : This is a callback function for certificate verification. - * It's called once for each certificate in the server's - * certificate trusted chain and prepares information about - * the certificate. The information can be used to inform - * the user about invalid certificates. + * Description : This function is called once for each certificate in the + * server's certificate trusted chain and prepares + * information about the certificate. The information can + * be used to inform the user about invalid certificates. * * Parameters : * 1 : csp = Current client state (buffers, headers, etc...) - * 2 : crt = certificate from trusted chain + * 2 : crt = certificate from trusted chain * * Returns : 0 on success and negative value on error * @@ -302,7 +318,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) if (len > (sizeof(last->file_buf) - 1)) { log_error(LOG_LEVEL_ERROR, - "X509 PEM cert len %d is larger then buffer len %s", + "X509 PEM cert len %ld is larger than buffer len %lu", len, sizeof(last->file_buf) - 1); len = sizeof(last->file_buf) - 1; } @@ -342,7 +358,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) if (BIO_puts(bio, "serial number : ") <= 0) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_write() for serial failed"); + log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for serial failed"); ret = -1; goto exit; } @@ -416,7 +432,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) if (BIO_puts(bio, "\nsubject name : ") <= 0) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for sublect failed"); + log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for subject failed"); ret = -1; goto exit; } @@ -462,7 +478,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) tsig_alg = X509_get0_tbs_sigalg(crt); if (!i2a_ASN1_OBJECT(bio, tsig_alg->algorithm)) { - log_ssl_errors(LOG_LEVEL_ERROR, "i2a_ASN1_OBJECT() for signed using on failed"); + log_ssl_errors(LOG_LEVEL_ERROR, "i2a_ASN1_OBJECT() for signed using failed"); ret = -1; goto exit; } @@ -638,6 +654,14 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) len = BIO_get_mem_data(bio, &bio_mem_data); encoded_text = html_encode(bio_mem_data); + if (encoded_text == NULL) + { + log_error(LOG_LEVEL_ERROR, + "Failed to HTML-encode the certificate information"); + ret = -1; + goto exit; + } + strlcpy(last->info_buf, encoded_text, sizeof(last->info_buf)); freez(encoded_text); ret = 0; @@ -714,7 +738,7 @@ extern int create_client_ssl_connection(struct client_state *csp) char *ca_file = NULL; char *cert_file = NULL; int ret = 0; - SSL* ssl; + SSL *ssl; /* * Initializing OpenSSL structures for TLS/SSL connection @@ -813,6 +837,18 @@ extern int create_client_ssl_connection(struct client_state *csp) goto exit; } + if (csp->config->cipher_list != NULL) + { + if (!SSL_set_cipher_list(ssl, csp->config->cipher_list)) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "Setting the cipher list '%s' for the client connection failed", + csp->config->cipher_list); + ret = -1; + goto exit; + } + } + /* * Handshake with client */ @@ -821,7 +857,8 @@ extern int create_client_ssl_connection(struct client_state *csp) csp->http->hash_of_host_hex); if (BIO_do_handshake(ssl_attr->openssl_attr.bio) != 1) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_do_handshake failed"); + log_ssl_errors(LOG_LEVEL_ERROR, + "The TLS/SSL handshake with the client failed"); ret = -1; goto exit; } @@ -862,6 +899,7 @@ exit: extern void close_client_ssl_connection(struct client_state *csp) { struct ssl_attr *ssl_attr = &csp->ssl_client_attr; + SSL *ssl; if (csp->ssl_with_client_is_opened == 0) { @@ -872,6 +910,20 @@ extern void close_client_ssl_connection(struct client_state *csp) * Notifying the peer that the connection is being closed. */ BIO_ssl_shutdown(ssl_attr->openssl_attr.bio); + if (BIO_get_ssl(ssl_attr->openssl_attr.bio, &ssl) != 1) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "BIO_get_ssl() failed in close_client_ssl_connection()"); + } + else + { + /* + * Pretend we received a shutdown alert so + * the BIO_free_all() call later on returns + * quickly. + */ + SSL_set_shutdown(ssl, SSL_RECEIVED_SHUTDOWN); + } free_client_ssl_structures(csp); csp->ssl_with_client_is_opened = 0; } @@ -921,6 +973,7 @@ static void free_client_ssl_structures(struct client_state *csp) extern void close_server_ssl_connection(struct client_state *csp) { struct ssl_attr *ssl_attr = &csp->ssl_server_attr; + SSL *ssl; if (csp->ssl_with_server_is_opened == 0) { @@ -931,6 +984,20 @@ extern void close_server_ssl_connection(struct client_state *csp) * Notifying the peer that the connection is being closed. */ BIO_ssl_shutdown(ssl_attr->openssl_attr.bio); + if (BIO_get_ssl(ssl_attr->openssl_attr.bio, &ssl) != 1) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "BIO_get_ssl() failed in close_server_ssl_connection()"); + } + else + { + /* + * Pretend we received a shutdown alert so + * the BIO_free_all() call later on returns + * quickly. + */ + SSL_set_shutdown(ssl, SSL_RECEIVED_SHUTDOWN); + } free_server_ssl_structures(csp); csp->ssl_with_server_is_opened = 0; } @@ -1006,6 +1073,18 @@ extern int create_server_ssl_connection(struct client_state *csp) goto exit; } + if (csp->config->cipher_list != NULL) + { + if (!SSL_set_cipher_list(ssl, csp->config->cipher_list)) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "Setting the cipher list '%s' for the server connection failed", + csp->config->cipher_list); + ret = -1; + goto exit; + } + } + /* * Set the hostname to check against the received server certificate */ @@ -1054,7 +1133,8 @@ extern int create_server_ssl_connection(struct client_state *csp) if (BIO_do_handshake(ssl_attrs->bio) != 1) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_do_handshake failed"); + log_ssl_errors(LOG_LEVEL_ERROR, + "The TLS/SSL handshake with the server failed"); ret = -1; goto exit; } @@ -1084,8 +1164,9 @@ extern int create_server_ssl_connection(struct client_state *csp) else { csp->server_cert_verification_result = verify_result; - log_error(LOG_LEVEL_ERROR, "SSL_get_verify_result failed: %s", - X509_verify_cert_error_string(verify_result)); + log_error(LOG_LEVEL_ERROR, + "X509 certificate verification for %s failed: %s", + csp->http->hostport, X509_verify_cert_error_string(verify_result)); ret = -1; goto exit; } @@ -1170,11 +1251,11 @@ static void log_ssl_errors(int debuglevel, const char* fmt, ...) va_end(args); /* * In case if called by mistake and there were - * no SSL errors let's report it to the log. + * no TLS/SSL errors let's report it to the log. */ if (!reported) { - log_error(debuglevel, "%s: no ssl errors detected", prefix); + log_error(debuglevel, "%s: no TLS/SSL errors detected", prefix); } } @@ -1396,7 +1477,12 @@ static int generate_key(struct client_state *csp, char **key_buf) goto exit; } - BN_set_word(exp, RSA_KEY_PUBLIC_EXPONENT); + if (BN_set_word(exp, RSA_KEY_PUBLIC_EXPONENT) != 1) + { + log_ssl_errors(LOG_LEVEL_ERROR, "Setting RSA key exponent failed"); + ret = -1; + goto exit; + } key_file_path = make_certs_path(csp->config->certificate_directory, (char *)csp->http->hash_of_host_hex, KEY_FILE_TYPE); @@ -1533,6 +1619,7 @@ static int ssl_certificate_is_invalid(const char *cert_file) { log_ssl_errors(LOG_LEVEL_ERROR, "Error checking certificate %s validity", cert_file); + ret = -1; } X509_free(cert); @@ -1769,7 +1856,7 @@ static int generate_webpage_certificate(struct client_state *csp) { log_ssl_errors(LOG_LEVEL_ERROR, "X509 subject name (code: %s, val: %s) error", - CERT_PARAM_COMMON_NAME_FCODE, csp->http->host); + CERT_PARAM_ORGANIZATION_FCODE, csp->http->host); ret = -1; goto exit; } @@ -1778,7 +1865,7 @@ static int generate_webpage_certificate(struct client_state *csp) { log_ssl_errors(LOG_LEVEL_ERROR, "X509 subject name (code: %s, val: %s) error", - CERT_PARAM_COMMON_NAME_FCODE, csp->http->host); + CERT_PARAM_ORG_UNIT_FCODE, csp->http->host); ret = -1; goto exit; } @@ -1787,7 +1874,7 @@ static int generate_webpage_certificate(struct client_state *csp) { log_ssl_errors(LOG_LEVEL_ERROR, "X509 subject name (code: %s, val: %s) error", - CERT_PARAM_COMMON_NAME_FCODE, csp->http->host); + CERT_PARAM_COUNTRY_FCODE, csp->http->host); ret = -1; goto exit; } @@ -1929,7 +2016,7 @@ static int generate_webpage_certificate(struct client_state *csp) if (!X509_set_pubkey(cert, loaded_subject_key)) { log_ssl_errors(LOG_LEVEL_ERROR, - "Setting issuer name in signed certificate failed"); + "Setting public key in signed certificate failed"); ret = -1; goto exit; } @@ -1937,7 +2024,7 @@ static int generate_webpage_certificate(struct client_state *csp) if (!X509_set_subject_name(cert, subject_name)) { log_ssl_errors(LOG_LEVEL_ERROR, - "Setting issuer name in signed certificate failed"); + "Setting subject name in signed certificate failed"); ret = -1; goto exit; } @@ -1991,7 +2078,7 @@ static int generate_webpage_certificate(struct client_state *csp) if (!X509_set1_notBefore(cert, asn_time)) { log_ssl_errors(LOG_LEVEL_ERROR, - "Setting valid not befre in signed certificate failed"); + "Setting valid not before in signed certificate failed"); ret = -1; goto exit; } @@ -2007,7 +2094,7 @@ static int generate_webpage_certificate(struct client_state *csp) if (!set_x509_ext(cert, issuer_cert, NID_subject_key_identifier, CERTIFICATE_SUBJECT_KEY)) { log_ssl_errors(LOG_LEVEL_ERROR, - "Setting the Subject Key Identifie extension failed"); + "Setting the Subject Key Identifier extension failed"); ret = -1; goto exit; } @@ -2023,7 +2110,8 @@ static int generate_webpage_certificate(struct client_state *csp) if (!host_is_ip_address(csp->http->host) && !set_subject_alternative_name(cert, issuer_cert, csp->http->host)) { - log_ssl_errors(LOG_LEVEL_ERROR, "Setting the Subject Alt Nameextension failed"); + log_ssl_errors(LOG_LEVEL_ERROR, + "Setting the Subject Alt Name extension failed"); ret = -1; goto exit; } @@ -2132,12 +2220,14 @@ extern void ssl_release(void) { if (ssl_inited == 1) { +#ifndef OPENSSL_NO_COMP SSL_COMP_free_compression_methods(); - +#endif CONF_modules_free(); CONF_modules_unload(1); - +#ifndef OPENSSL_NO_COMP COMP_zlib_cleanup(); +#endif ERR_free_strings(); EVP_cleanup();