X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=openssl.c;h=72d97d99b9fbd09748c7b35f637ac94f1c5c1d5b;hp=723820bf0d0c6579933fa3ae4eb91d8c1197c2df;hb=73ee407f47ef75d85d1432f3c2665b05fa0c4926;hpb=b987797ccc0276de1f36b8175ce105950d5e97eb

diff --git a/openssl.c b/openssl.c
index 723820bf..72d97d99 100644
--- a/openssl.c
+++ b/openssl.c
@@ -55,7 +55,7 @@
 #define CERTIFICATE_AUTHORITY_KEY                "keyid:always"
 #define CERTIFICATE_ALT_NAME_PREFIX              "DNS:"
 #define CERTIFICATE_VERSION                      2
-#define VALID_DATETIME_FMT                       "%Y%m%d%H%M%SZ"
+#define VALID_DATETIME_FMT                       "%y%m%d%H%M%SZ"
 #define VALID_DATETIME_BUFLEN                    16
 
 static int generate_webpage_certificate(struct client_state *csp);
@@ -152,19 +152,27 @@ extern size_t is_ssl_pending(struct ssl_attr *ssl_attr)
 extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, size_t len)
 {
    BIO *bio = ssl_attr->openssl_attr.bio;
+   SSL *ssl;
    int ret = 0;
    int pos = 0; /* Position of unsent part in buffer */
+   int fd = -1;
 
    if (len == 0)
    {
       return 0;
    }
 
+   if (BIO_get_ssl(bio, &ssl) == 1)
+   {
+      fd = SSL_get_fd(ssl);
+   }
+
    while (pos < len)
    {
       int send_len = (int)len - pos;
 
-      log_error(LOG_LEVEL_WRITING, "TLS: %N", send_len, buf+pos);
+      log_error(LOG_LEVEL_WRITING, "TLS on socket %d: %N",
+         fd, send_len, buf+pos);
 
       /*
        * Sending one part of the buffer
@@ -176,7 +184,7 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si
          if (!BIO_should_retry(bio))
          {
             log_ssl_errors(LOG_LEVEL_ERROR,
-               "Sending data over TLS/SSL failed");
+               "Sending data on socket %d over TLS/SSL failed", fd);
             return -1;
          }
       }
@@ -207,7 +215,10 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si
 extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t max_length)
 {
    BIO *bio = ssl_attr->openssl_attr.bio;
+   SSL *ssl;
    int ret = 0;
+   int fd = -1;
+
    memset(buf, 0, max_length);
 
    /*
@@ -221,12 +232,18 @@ extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t m
    if (ret < 0)
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
-         "Receiving data over TLS/SSL failed");
+         "Receiving data on socket %d over TLS/SSL failed", fd);
 
       return -1;
    }
 
-   log_error(LOG_LEVEL_RECEIVED, "TLS: %N", ret, buf);
+   if (BIO_get_ssl(bio, &ssl) == 1)
+   {
+      fd = SSL_get_fd(ssl);
+   }
+
+   log_error(LOG_LEVEL_RECEIVED, "TLS from socket %d: %N",
+      fd, ret, buf);
 
    return ret;
 }
@@ -236,15 +253,14 @@ extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t m
  *
  * Function    :  ssl_store_cert
  *
- * Description :  This is a callback function for certificate verification.
- *                It's called once for each certificate in the server's
- *                certificate trusted chain and prepares information about
- *                the certificate. The information can be used to inform
- *                the user about invalid certificates.
+ * Description : This function is called once for each certificate in the
+ *               server's certificate trusted chain and prepares
+ *               information about the certificate. The information can
+ *               be used to inform the user about invalid certificates.
  *
  * Parameters  :
  *          1  :  csp = Current client state (buffers, headers, etc...)
- *          2  :  crt   = certificate from trusted chain
+ *          2  :  crt = certificate from trusted chain
  *
  * Returns     :  0 on success and negative value on error
  *
@@ -302,7 +318,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt)
    if (len > (sizeof(last->file_buf) - 1))
    {
       log_error(LOG_LEVEL_ERROR,
-         "X509 PEM cert len %d is larger then buffer len %s",
+         "X509 PEM cert len %ld is larger than buffer len %lu",
          len, sizeof(last->file_buf) - 1);
       len = sizeof(last->file_buf) - 1;
    }
@@ -342,7 +358,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt)
 
    if (BIO_puts(bio, "serial number     : ") <= 0)
    {
-      log_ssl_errors(LOG_LEVEL_ERROR, "BIO_write() for serial failed");
+      log_ssl_errors(LOG_LEVEL_ERROR, "BIO_puts() for serial failed");
       ret = -1;
       goto exit;
    }
@@ -462,7 +478,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt)
    tsig_alg = X509_get0_tbs_sigalg(crt);
    if (!i2a_ASN1_OBJECT(bio, tsig_alg->algorithm))
    {
-      log_ssl_errors(LOG_LEVEL_ERROR, "i2a_ASN1_OBJECT() for signed using on failed");
+      log_ssl_errors(LOG_LEVEL_ERROR, "i2a_ASN1_OBJECT() for signed using failed");
       ret = -1;
       goto exit;
    }
@@ -719,10 +735,9 @@ extern int create_client_ssl_connection(struct client_state *csp)
    struct ssl_attr *ssl_attr = &csp->ssl_client_attr;
    /* Paths to certificates file and key file */
    char *key_file  = NULL;
-   char *ca_file   = NULL;
    char *cert_file = NULL;
    int ret = 0;
-   SSL* ssl;
+   SSL *ssl;
 
    /*
     * Initializing OpenSSL structures for TLS/SSL connection
@@ -743,7 +758,6 @@ extern int create_client_ssl_connection(struct client_state *csp)
    /*
     * Preparing paths to certificates files and key file
     */
-   ca_file   = csp->config->ca_cert_file;
    cert_file = make_certs_path(csp->config->certificate_directory,
       (const char *)csp->http->hash_of_host_hex, CERT_FILE_TYPE);
    key_file  = make_certs_path(csp->config->certificate_directory,
@@ -821,6 +835,18 @@ extern int create_client_ssl_connection(struct client_state *csp)
       goto exit;
    }
 
+   if (csp->config->cipher_list != NULL)
+   {
+      if (!SSL_set_cipher_list(ssl, csp->config->cipher_list))
+      {
+         log_ssl_errors(LOG_LEVEL_ERROR,
+            "Setting the cipher list '%s' for the client connection failed",
+            csp->config->cipher_list);
+         ret = -1;
+         goto exit;
+      }
+   }
+
    /*
     *  Handshake with client
     */
@@ -871,6 +897,7 @@ exit:
 extern void close_client_ssl_connection(struct client_state *csp)
 {
    struct ssl_attr *ssl_attr = &csp->ssl_client_attr;
+   SSL *ssl;
 
    if (csp->ssl_with_client_is_opened == 0)
    {
@@ -881,6 +908,20 @@ extern void close_client_ssl_connection(struct client_state *csp)
     * Notifying the peer that the connection is being closed.
     */
    BIO_ssl_shutdown(ssl_attr->openssl_attr.bio);
+   if (BIO_get_ssl(ssl_attr->openssl_attr.bio, &ssl) != 1)
+   {
+      log_ssl_errors(LOG_LEVEL_ERROR,
+         "BIO_get_ssl() failed in close_client_ssl_connection()");
+   }
+   else
+   {
+      /*
+       * Pretend we received a shutdown alert so
+       * the BIO_free_all() call later on returns
+       * quickly.
+       */
+      SSL_set_shutdown(ssl, SSL_RECEIVED_SHUTDOWN);
+   }
    free_client_ssl_structures(csp);
    csp->ssl_with_client_is_opened = 0;
 }
@@ -930,6 +971,7 @@ static void free_client_ssl_structures(struct client_state *csp)
 extern void close_server_ssl_connection(struct client_state *csp)
 {
    struct ssl_attr *ssl_attr = &csp->ssl_server_attr;
+   SSL *ssl;
 
    if (csp->ssl_with_server_is_opened == 0)
    {
@@ -940,6 +982,20 @@ extern void close_server_ssl_connection(struct client_state *csp)
    * Notifying the peer that the connection is being closed.
    */
    BIO_ssl_shutdown(ssl_attr->openssl_attr.bio);
+   if (BIO_get_ssl(ssl_attr->openssl_attr.bio, &ssl) != 1)
+   {
+      log_ssl_errors(LOG_LEVEL_ERROR,
+         "BIO_get_ssl() failed in close_server_ssl_connection()");
+   }
+   else
+   {
+      /*
+       * Pretend we received a shutdown alert so
+       * the BIO_free_all() call later on returns
+       * quickly.
+       */
+      SSL_set_shutdown(ssl, SSL_RECEIVED_SHUTDOWN);
+   }
    free_server_ssl_structures(csp);
    csp->ssl_with_server_is_opened = 0;
 }
@@ -1015,6 +1071,18 @@ extern int create_server_ssl_connection(struct client_state *csp)
       goto exit;
    }
 
+   if (csp->config->cipher_list != NULL)
+   {
+      if (!SSL_set_cipher_list(ssl, csp->config->cipher_list))
+      {
+         log_ssl_errors(LOG_LEVEL_ERROR,
+            "Setting the cipher list '%s' for the server connection failed",
+            csp->config->cipher_list);
+         ret = -1;
+         goto exit;
+      }
+   }
+
    /*
     * Set the hostname to check against the received server certificate
     */
@@ -1094,8 +1162,9 @@ extern int create_server_ssl_connection(struct client_state *csp)
       else
       {
          csp->server_cert_verification_result = verify_result;
-         log_error(LOG_LEVEL_ERROR, "SSL_get_verify_result failed: %s",
-            X509_verify_cert_error_string(verify_result));
+         log_error(LOG_LEVEL_ERROR,
+            "X509 certificate verification for %s failed: %s",
+            csp->http->hostport, X509_verify_cert_error_string(verify_result));
          ret = -1;
          goto exit;
       }
@@ -1406,7 +1475,12 @@ static int generate_key(struct client_state *csp, char **key_buf)
       goto exit;
    }
 
-   BN_set_word(exp, RSA_KEY_PUBLIC_EXPONENT);
+   if (BN_set_word(exp, RSA_KEY_PUBLIC_EXPONENT) != 1)
+   {
+      log_ssl_errors(LOG_LEVEL_ERROR, "Setting RSA key exponent failed");
+      ret = -1;
+      goto exit;
+   }
 
    key_file_path = make_certs_path(csp->config->certificate_directory,
       (char *)csp->http->hash_of_host_hex, KEY_FILE_TYPE);
@@ -1543,6 +1617,7 @@ static int ssl_certificate_is_invalid(const char *cert_file)
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
          "Error checking certificate %s validity", cert_file);
+      ret = -1;
    }
 
    X509_free(cert);
@@ -1779,7 +1854,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
          "X509 subject name (code: %s, val: %s) error",
-         CERT_PARAM_COMMON_NAME_FCODE, csp->http->host);
+         CERT_PARAM_ORGANIZATION_FCODE, csp->http->host);
       ret = -1;
       goto exit;
    }
@@ -1788,7 +1863,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
          "X509 subject name (code: %s, val: %s) error",
-         CERT_PARAM_COMMON_NAME_FCODE, csp->http->host);
+         CERT_PARAM_ORG_UNIT_FCODE, csp->http->host);
       ret = -1;
       goto exit;
    }
@@ -1797,7 +1872,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
          "X509 subject name (code: %s, val: %s) error",
-         CERT_PARAM_COMMON_NAME_FCODE, csp->http->host);
+         CERT_PARAM_COUNTRY_FCODE, csp->http->host);
       ret = -1;
       goto exit;
    }
@@ -1939,7 +2014,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    if (!X509_set_pubkey(cert, loaded_subject_key))
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
-         "Setting issuer name in signed certificate failed");
+         "Setting public key in signed certificate failed");
       ret = -1;
       goto exit;
    }
@@ -1947,7 +2022,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    if (!X509_set_subject_name(cert, subject_name))
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
-         "Setting issuer name in signed certificate failed");
+         "Setting subject name in signed certificate failed");
       ret = -1;
       goto exit;
    }
@@ -2001,7 +2076,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    if (!X509_set1_notBefore(cert, asn_time))
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
-         "Setting valid not befre in signed certificate failed");
+         "Setting valid not before in signed certificate failed");
       ret = -1;
       goto exit;
    }
@@ -2017,7 +2092,7 @@ static int generate_webpage_certificate(struct client_state *csp)
    if (!set_x509_ext(cert, issuer_cert, NID_subject_key_identifier, CERTIFICATE_SUBJECT_KEY))
    {
       log_ssl_errors(LOG_LEVEL_ERROR,
-         "Setting the Subject Key Identifie extension failed");
+         "Setting the Subject Key Identifier extension failed");
       ret = -1;
       goto exit;
    }
@@ -2033,7 +2108,8 @@ static int generate_webpage_certificate(struct client_state *csp)
    if (!host_is_ip_address(csp->http->host) &&
        !set_subject_alternative_name(cert, issuer_cert, csp->http->host))
    {
-      log_ssl_errors(LOG_LEVEL_ERROR, "Setting the Subject Alt Nameextension failed");
+      log_ssl_errors(LOG_LEVEL_ERROR,
+         "Setting the Subject Alt Name extension failed");
       ret = -1;
       goto exit;
    }
@@ -2142,12 +2218,14 @@ extern void ssl_release(void)
 {
    if (ssl_inited == 1)
    {
+#ifndef OPENSSL_NO_COMP
       SSL_COMP_free_compression_methods();
-
+#endif
       CONF_modules_free();
       CONF_modules_unload(1);
-
+#ifndef OPENSSL_NO_COMP
       COMP_zlib_cleanup();
+#endif
 
       ERR_free_strings();
       EVP_cleanup();