X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=openssl.c;h=56dc52a32d46abe092d6f21d83c02b621d08d625;hp=30ecfe3791b4caac688d24e970d7682c45d384cd;hb=d52db18f24d7242e3723ad5a576e1f9cd0d52043;hpb=bf95fdb2933f77e06e8795567632f1550d01c8d9 diff --git a/openssl.c b/openssl.c index 30ecfe37..56dc52a3 100644 --- a/openssl.c +++ b/openssl.c @@ -1,11 +1,13 @@ /********************************************************************* * - * File : $Source: $ + * File : $Source: /cvsroot/ijbswa/current/openssl.c,v $ * * Purpose : File with TLS/SSL extension. Contains methods for * creating, using and closing TLS/SSL connections. * * Copyright : Written by and Copyright (c) 2020 Maxim Antonov + * Copyright (C) 2017 Vaclav Svec. FIT CVUT. + * Copyright (C) 2018-2020 by Fabian Keil * * This program is free software; you can redistribute it * and/or modify it under the terms of the GNU General @@ -64,11 +66,19 @@ static void log_ssl_errors(int debuglevel, const char* fmt, ...) __attribute__(( static int ssl_inited = 0; +#if OPENSSL_VERSION_NUMBER < 0x10100000L +#define X509_set1_notBefore X509_set_notBefore +#define X509_set1_notAfter X509_set_notAfter +#define X509_get0_serialNumber X509_get_serialNumber +#define X509_get0_notBefore X509_get_notBefore +#define X509_get0_notAfter X509_get_notAfter +#endif + /********************************************************************* * * Function : openssl_init * - * Description : INitializes OpenSSL library once + * Description : Initializes OpenSSL library once * * Parameters : N/A * @@ -106,7 +116,7 @@ static void openssl_init(void) * or has not yet been sent by the remote end. * * Parameters : - * 1 : ssl = SSL context to test + * 1 : ssl_attr = SSL context to test * * Returns : 0 => No data are pending * >0 => Pending data length @@ -132,7 +142,7 @@ extern size_t is_ssl_pending(struct ssl_attr *ssl_attr) * connection context. * * Parameters : - * 1 : ssl = SSL context to send data to + * 1 : ssl_attr = SSL context to send data to * 2 : buf = Pointer to data to be sent * 3 : len = Length of data to be sent to the SSL context * @@ -161,7 +171,7 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si */ while ((ret = BIO_write(bio, (const unsigned char *)(buf + pos), - send_len)) < 0) + send_len)) <= 0) { if (!BIO_should_retry(bio)) { @@ -186,7 +196,7 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si * it into buffer. * * Parameters : - * 1 : ssl = SSL context to receive data from + * 1 : ssl_attr = SSL context to receive data from * 2 : buf = Pointer to buffer where data will be written * 3 : max_length = Maximum number of bytes to read * @@ -226,15 +236,14 @@ extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t m * * Function : ssl_store_cert * - * Description : This is a callback function for certificate verification. - * It's called once for each certificate in the server's - * certificate trusted chain and prepares information about - * the certificate. The information can be used to inform - * the user about invalid certificates. + * Description : This function is called once for each certificate in the + * server's certificate trusted chain and prepares + * information about the certificate. The information can + * be used to inform the user about invalid certificates. * * Parameters : * 1 : csp = Current client state (buffers, headers, etc...) - * 2 : crt = certificate from trusted chain + * 2 : crt = certificate from trusted chain * * Returns : 0 on success and negative value on error * @@ -250,7 +259,9 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) char *encoded_text; long l; const ASN1_INTEGER *bs; +#if OPENSSL_VERSION_NUMBER > 0x10100000L const X509_ALGOR *tsig_alg; +#endif int loc; if (!bio) @@ -290,7 +301,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) if (len > (sizeof(last->file_buf) - 1)) { log_error(LOG_LEVEL_ERROR, - "X509 PEM cert len %d is larger then buffer len %s", + "X509 PEM cert len %ld is larger than buffer len %lu", len, sizeof(last->file_buf) - 1); len = sizeof(last->file_buf) - 1; } @@ -330,7 +341,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) if (BIO_puts(bio, "serial number : ") <= 0) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_write() for serial failed"); + log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for serial failed"); ret = -1; goto exit; } @@ -404,7 +415,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) if (BIO_puts(bio, "\nsubject name : ") <= 0) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for sublect failed"); + log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for subject failed"); ret = -1; goto exit; } @@ -440,6 +451,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) goto exit; } +#if OPENSSL_VERSION_NUMBER > 0x10100000L if (BIO_puts(bio, "\nsigned using : ") <= 0) { log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for signed using failed"); @@ -449,10 +461,11 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) tsig_alg = X509_get0_tbs_sigalg(crt); if (!i2a_ASN1_OBJECT(bio, tsig_alg->algorithm)) { - log_ssl_errors(LOG_LEVEL_ERROR, "i2a_ASN1_OBJECT() for signed using on failed"); + log_ssl_errors(LOG_LEVEL_ERROR, "i2a_ASN1_OBJECT() for signed using failed"); ret = -1; goto exit; } +#endif pkey = X509_get_pubkey(crt); if (!pkey) { @@ -624,6 +637,14 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) len = BIO_get_mem_data(bio, &bio_mem_data); encoded_text = html_encode(bio_mem_data); + if (encoded_text == NULL) + { + log_error(LOG_LEVEL_ERROR, + "Failed to HTML-encode the certificate information"); + ret = -1; + goto exit; + } + strlcpy(last->info_buf, encoded_text, sizeof(last->info_buf)); freez(encoded_text); ret = 0; @@ -807,7 +828,8 @@ extern int create_client_ssl_connection(struct client_state *csp) csp->http->hash_of_host_hex); if (BIO_do_handshake(ssl_attr->openssl_attr.bio) != 1) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_do_handshake failed"); + log_ssl_errors(LOG_LEVEL_ERROR, + "The TLS/SSL handshake with the client failed"); ret = -1; goto exit; } @@ -995,13 +1017,35 @@ extern int create_server_ssl_connection(struct client_state *csp) /* * Set the hostname to check against the received server certificate */ +#if OPENSSL_VERSION_NUMBER > 0x10100000L if (!SSL_set1_host(ssl, csp->http->host)) { log_ssl_errors(LOG_LEVEL_ERROR, "SSL_set1_host failed"); ret = -1; goto exit; } - +#else + if (host_is_ip_address(csp->http->host)) + { + if (X509_VERIFY_PARAM_set1_ip_asc(ssl->param, csp->http->host) != 1) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "X509_VERIFY_PARAM_set1_ip_asc() failed"); + ret = -1; + goto exit; + } + } + else + { + if (X509_VERIFY_PARAM_set1_host(ssl->param, csp->http->host, 0) != 1) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "X509_VERIFY_PARAM_set1_host() failed"); + ret = -1; + goto exit; + } + } +#endif /* SNI extension */ if (!SSL_set_tlsext_host_name(ssl, csp->http->host)) { @@ -1018,7 +1062,8 @@ extern int create_server_ssl_connection(struct client_state *csp) if (BIO_do_handshake(ssl_attrs->bio) != 1) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_do_handshake failed"); + log_ssl_errors(LOG_LEVEL_ERROR, + "The TLS/SSL handshake with the server failed"); ret = -1; goto exit; } @@ -1048,8 +1093,9 @@ extern int create_server_ssl_connection(struct client_state *csp) else { csp->server_cert_verification_result = verify_result; - log_error(LOG_LEVEL_ERROR, "SSL_get_verify_result failed: %s", - X509_verify_cert_error_string(verify_result)); + log_error(LOG_LEVEL_ERROR, + "X509 certificate verification for %s failed: %s", + csp->http->hostport, X509_verify_cert_error_string(verify_result)); ret = -1; goto exit; } @@ -1134,11 +1180,11 @@ static void log_ssl_errors(int debuglevel, const char* fmt, ...) va_end(args); /* * In case if called by mistake and there were - * no SSL errors let's report it to the log. + * no TLS/SSL errors let's report it to the log. */ if (!reported) { - log_error(debuglevel, "%s: no ssl errors detected", prefix); + log_error(debuglevel, "%s: no TLS/SSL errors detected", prefix); } } @@ -1360,7 +1406,12 @@ static int generate_key(struct client_state *csp, char **key_buf) goto exit; } - BN_set_word(exp, RSA_KEY_PUBLIC_EXPONENT); + if (BN_set_word(exp, RSA_KEY_PUBLIC_EXPONENT) != 1) + { + log_ssl_errors(LOG_LEVEL_ERROR, "Setting RSA key exponent failed"); + ret = -1; + goto exit; + } key_file_path = make_certs_path(csp->config->certificate_directory, (char *)csp->http->hash_of_host_hex, KEY_FILE_TYPE); @@ -1515,13 +1566,13 @@ static int ssl_certificate_is_invalid(const char *cert_file) * 1 : cert = The certificate to modify * 2 : issuer = Issuer certificate * 3 : nid = OpenSSL NID - * 2 : data = extension value + * 4 : value = extension value * * Returns : 0 => Error while setting extensuon data * 1 => It worked * *********************************************************************/ -static int set_x509_ext(X509 *cert, X509 *issuer, int nid, const char *value) +static int set_x509_ext(X509 *cert, X509 *issuer, int nid, char *value) { X509_EXTENSION *ext = NULL; X509V3_CTX ctx; @@ -1560,7 +1611,7 @@ exit: * Parameters : * 1 : cert = The certificate to modify * 2 : issuer = Issuer certificate - * 2 : hostname = The hostname to add + * 3 : hostname = The hostname to add * * Returns : 0 => Error while creating certificate. * 1 => It worked @@ -1733,7 +1784,7 @@ static int generate_webpage_certificate(struct client_state *csp) { log_ssl_errors(LOG_LEVEL_ERROR, "X509 subject name (code: %s, val: %s) error", - CERT_PARAM_COMMON_NAME_FCODE, csp->http->host); + CERT_PARAM_ORGANIZATION_FCODE, csp->http->host); ret = -1; goto exit; } @@ -1742,7 +1793,7 @@ static int generate_webpage_certificate(struct client_state *csp) { log_ssl_errors(LOG_LEVEL_ERROR, "X509 subject name (code: %s, val: %s) error", - CERT_PARAM_COMMON_NAME_FCODE, csp->http->host); + CERT_PARAM_ORG_UNIT_FCODE, csp->http->host); ret = -1; goto exit; } @@ -1751,7 +1802,7 @@ static int generate_webpage_certificate(struct client_state *csp) { log_ssl_errors(LOG_LEVEL_ERROR, "X509 subject name (code: %s, val: %s) error", - CERT_PARAM_COMMON_NAME_FCODE, csp->http->host); + CERT_PARAM_COUNTRY_FCODE, csp->http->host); ret = -1; goto exit; } @@ -1893,7 +1944,7 @@ static int generate_webpage_certificate(struct client_state *csp) if (!X509_set_pubkey(cert, loaded_subject_key)) { log_ssl_errors(LOG_LEVEL_ERROR, - "Setting issuer name in signed certificate failed"); + "Setting public key in signed certificate failed"); ret = -1; goto exit; } @@ -1901,7 +1952,7 @@ static int generate_webpage_certificate(struct client_state *csp) if (!X509_set_subject_name(cert, subject_name)) { log_ssl_errors(LOG_LEVEL_ERROR, - "Setting issuer name in signed certificate failed"); + "Setting subject name in signed certificate failed"); ret = -1; goto exit; } @@ -1955,7 +2006,7 @@ static int generate_webpage_certificate(struct client_state *csp) if (!X509_set1_notBefore(cert, asn_time)) { log_ssl_errors(LOG_LEVEL_ERROR, - "Setting valid not befre in signed certificate failed"); + "Setting valid not before in signed certificate failed"); ret = -1; goto exit; } @@ -1971,7 +2022,7 @@ static int generate_webpage_certificate(struct client_state *csp) if (!set_x509_ext(cert, issuer_cert, NID_subject_key_identifier, CERTIFICATE_SUBJECT_KEY)) { log_ssl_errors(LOG_LEVEL_ERROR, - "Setting the Subject Key Identifie extension failed"); + "Setting the Subject Key Identifier extension failed"); ret = -1; goto exit; } @@ -1987,7 +2038,8 @@ static int generate_webpage_certificate(struct client_state *csp) if (!host_is_ip_address(csp->http->host) && !set_subject_alternative_name(cert, issuer_cert, csp->http->host)) { - log_ssl_errors(LOG_LEVEL_ERROR, "Setting the Subject Alt Nameextension failed"); + log_ssl_errors(LOG_LEVEL_ERROR, + "Setting the Subject Alt Name extension failed"); ret = -1; goto exit; }