X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=openssl.c;h=56dc52a32d46abe092d6f21d83c02b621d08d625;hp=81d88b69a76ca023a687ffffcd753d891363aac6;hb=6ede7269d436ab362cf945a497044a831a092196;hpb=079d37212054f93b4e113195e9266ad96176d435

diff --git a/openssl.c b/openssl.c
index 81d88b69..56dc52a3 100644
--- a/openssl.c
+++ b/openssl.c
@@ -1,6 +1,6 @@
 /*********************************************************************
  *
- * File        :  $Source: $
+ * File        :  $Source: /cvsroot/ijbswa/current/openssl.c,v $
  *
  * Purpose     :  File with TLS/SSL extension. Contains methods for
  *                creating, using and closing TLS/SSL connections.
@@ -171,7 +171,7 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si
        */
       while ((ret = BIO_write(bio,
          (const unsigned char *)(buf + pos),
-         send_len)) < 0)
+         send_len)) <= 0)
       {
          if (!BIO_should_retry(bio))
          {
@@ -236,15 +236,14 @@ extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t m
  *
  * Function    :  ssl_store_cert
  *
- * Description :  This is a callback function for certificate verification.
- *                It's called once for each certificate in the server's
- *                certificate trusted chain and prepares information about
- *                the certificate. The information can be used to inform
- *                the user about invalid certificates.
+ * Description : This function is called once for each certificate in the
+ *               server's certificate trusted chain and prepares
+ *               information about the certificate. The information can
+ *               be used to inform the user about invalid certificates.
  *
  * Parameters  :
  *          1  :  csp = Current client state (buffers, headers, etc...)
- *          2  :  crt   = certificate from trusted chain
+ *          2  :  crt = certificate from trusted chain
  *
  * Returns     :  0 on success and negative value on error
  *
@@ -302,7 +301,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt)
    if (len > (sizeof(last->file_buf) - 1))
    {
       log_error(LOG_LEVEL_ERROR,
-         "X509 PEM cert len %d is larger then buffer len %s",
+         "X509 PEM cert len %ld is larger than buffer len %lu",
          len, sizeof(last->file_buf) - 1);
       len = sizeof(last->file_buf) - 1;
    }
@@ -342,7 +341,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt)
 
    if (BIO_puts(bio, "serial number     : ") <= 0)
    {
-      log_ssl_errors(LOG_LEVEL_ERROR, "BIO_write() for serial failed");
+      log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for serial failed");
       ret = -1;
       goto exit;
    }
@@ -462,7 +461,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt)
    tsig_alg = X509_get0_tbs_sigalg(crt);
    if (!i2a_ASN1_OBJECT(bio, tsig_alg->algorithm))
    {
-      log_ssl_errors(LOG_LEVEL_ERROR, "i2a_ASN1_OBJECT() for signed using on failed");
+      log_ssl_errors(LOG_LEVEL_ERROR, "i2a_ASN1_OBJECT() for signed using failed");
       ret = -1;
       goto exit;
    }
@@ -638,6 +637,14 @@ static int ssl_store_cert(struct client_state *csp, X509* crt)
 
    len = BIO_get_mem_data(bio, &bio_mem_data);
    encoded_text = html_encode(bio_mem_data);
+   if (encoded_text == NULL)
+   {
+      log_error(LOG_LEVEL_ERROR,
+         "Failed to HTML-encode the certificate information");
+      ret = -1;
+      goto exit;
+   }
+
    strlcpy(last->info_buf, encoded_text, sizeof(last->info_buf));
    freez(encoded_text);
    ret = 0;
@@ -821,7 +828,8 @@ extern int create_client_ssl_connection(struct client_state *csp)
       csp->http->hash_of_host_hex);
    if (BIO_do_handshake(ssl_attr->openssl_attr.bio) != 1)
    {
-       log_ssl_errors(LOG_LEVEL_ERROR, "BIO_do_handshake failed");
+       log_ssl_errors(LOG_LEVEL_ERROR,
+          "The TLS/SSL handshake with the client failed");
        ret = -1;
        goto exit;
    }
@@ -1054,7 +1062,8 @@ extern int create_server_ssl_connection(struct client_state *csp)
 
    if (BIO_do_handshake(ssl_attrs->bio) != 1)
    {
-      log_ssl_errors(LOG_LEVEL_ERROR, "BIO_do_handshake failed");
+      log_ssl_errors(LOG_LEVEL_ERROR,
+         "The TLS/SSL handshake with the server failed");
       ret = -1;
       goto exit;
    }
@@ -1084,8 +1093,9 @@ extern int create_server_ssl_connection(struct client_state *csp)
       else
       {
          csp->server_cert_verification_result = verify_result;
-         log_error(LOG_LEVEL_ERROR, "SSL_get_verify_result failed: %s",
-            X509_verify_cert_error_string(verify_result));
+         log_error(LOG_LEVEL_ERROR,
+            "X509 certificate verification for %s failed: %s",
+            csp->http->hostport, X509_verify_cert_error_string(verify_result));
          ret = -1;
          goto exit;
       }
@@ -1170,11 +1180,11 @@ static void log_ssl_errors(int debuglevel, const char* fmt, ...)
    va_end(args);
    /*
     * In case if called by mistake and there were
-    * no SSL errors let's report it to the log.
+    * no TLS/SSL errors let's report it to the log.
     */
    if (!reported)
    {
-      log_error(debuglevel, "%s: no ssl errors detected", prefix);
+      log_error(debuglevel, "%s: no TLS/SSL errors detected", prefix);
    }
 }
 
@@ -1396,7 +1406,12 @@ static int generate_key(struct client_state *csp, char **key_buf)
       goto exit;
    }
 
-   BN_set_word(exp, RSA_KEY_PUBLIC_EXPONENT);
+   if (BN_set_word(exp, RSA_KEY_PUBLIC_EXPONENT) != 1)
+   {
+      log_ssl_errors(LOG_LEVEL_ERROR, "Setting RSA key exponent failed");
+      ret = -1;
+      goto exit;
+   }
 
    key_file_path = make_certs_path(csp->config->certificate_directory,
       (char *)csp->http->hash_of_host_hex, KEY_FILE_TYPE);
@@ -1769,7 +1784,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
          "X509 subject name (code: %s, val: %s) error",
-         CERT_PARAM_COMMON_NAME_FCODE, csp->http->host);
+         CERT_PARAM_ORGANIZATION_FCODE, csp->http->host);
       ret = -1;
       goto exit;
    }
@@ -1778,7 +1793,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
          "X509 subject name (code: %s, val: %s) error",
-         CERT_PARAM_COMMON_NAME_FCODE, csp->http->host);
+         CERT_PARAM_ORG_UNIT_FCODE, csp->http->host);
       ret = -1;
       goto exit;
    }
@@ -1787,7 +1802,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
          "X509 subject name (code: %s, val: %s) error",
-         CERT_PARAM_COMMON_NAME_FCODE, csp->http->host);
+         CERT_PARAM_COUNTRY_FCODE, csp->http->host);
       ret = -1;
       goto exit;
    }
@@ -1929,7 +1944,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    if (!X509_set_pubkey(cert, loaded_subject_key))
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
-         "Setting issuer name in signed certificate failed");
+         "Setting public key in signed certificate failed");
       ret = -1;
       goto exit;
    }
@@ -1937,7 +1952,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    if (!X509_set_subject_name(cert, subject_name))
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
-         "Setting issuer name in signed certificate failed");
+         "Setting subject name in signed certificate failed");
       ret = -1;
       goto exit;
    }
@@ -1991,7 +2006,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    if (!X509_set1_notBefore(cert, asn_time))
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
-         "Setting valid not befre in signed certificate failed");
+         "Setting valid not before in signed certificate failed");
       ret = -1;
       goto exit;
    }
@@ -2007,7 +2022,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    if (!set_x509_ext(cert, issuer_cert, NID_subject_key_identifier, CERTIFICATE_SUBJECT_KEY))
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
-         "Setting the Subject Key Identifie extension failed");
+         "Setting the Subject Key Identifier extension failed");
       ret = -1;
       goto exit;
    }
@@ -2023,7 +2038,8 @@ static int generate_webpage_certificate(struct client_state *csp)
    if (!host_is_ip_address(csp->http->host) &&
        !set_subject_alternative_name(cert, issuer_cert, csp->http->host))
    {
-      log_ssl_errors(LOG_LEVEL_ERROR, "Setting the Subject Alt Nameextension failed");
+      log_ssl_errors(LOG_LEVEL_ERROR,
+         "Setting the Subject Alt Name extension failed");
       ret = -1;
       goto exit;
    }