X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=openssl.c;h=a57cb32e978cc60c4b8e39b0304204d1a2a29d1d;hp=cfcc59e8b1efa6bbce978e8708abe654ba7ed1c5;hb=2f65bcbabe6cb3e8ca8bd7f328d6b7d8fab489d0;hpb=1b53e0968d329557c1b7ed00f50a6be5efbb2a58 diff --git a/openssl.c b/openssl.c index cfcc59e8..a57cb32e 100644 --- a/openssl.c +++ b/openssl.c @@ -3,7 +3,8 @@ * File : $Source: /cvsroot/ijbswa/current/openssl.c,v $ * * Purpose : File with TLS/SSL extension. Contains methods for - * creating, using and closing TLS/SSL connections. + * creating, using and closing TLS/SSL connections + * using OpenSSL (or LibreSSL). * * Copyright : Written by and Copyright (c) 2020 Maxim Antonov * Copyright (C) 2017 Vaclav Svec. FIT CVUT. @@ -58,10 +59,10 @@ #define VALID_DATETIME_FMT "%y%m%d%H%M%SZ" #define VALID_DATETIME_BUFLEN 16 -static int generate_webpage_certificate(struct client_state *csp); +static int generate_host_certificate(struct client_state *csp); static void free_client_ssl_structures(struct client_state *csp); static void free_server_ssl_structures(struct client_state *csp); -static int ssl_store_cert(struct client_state *csp, X509* crt); +static int ssl_store_cert(struct client_state *csp, X509 *crt); static void log_ssl_errors(int debuglevel, const char* fmt, ...) __attribute__((format(printf, 2, 3))); static int ssl_inited = 0; @@ -265,14 +266,14 @@ extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t m * Returns : 0 on success and negative value on error * *********************************************************************/ -static int ssl_store_cert(struct client_state *csp, X509* crt) +static int ssl_store_cert(struct client_state *csp, X509 *crt) { - long len = 0; + long len; struct certs_chain *last = &(csp->server_certs_chain); int ret = 0; BIO *bio = BIO_new(BIO_s_mem()); EVP_PKEY *pkey = NULL; - char *bio_mem_data = 0; + char *bio_mem_data = NULL; char *encoded_text; long l; const ASN1_INTEGER *bs; @@ -283,7 +284,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) if (!bio) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_new_mem_buf() failed"); + log_ssl_errors(LOG_LEVEL_ERROR, "BIO_new() failed"); return -1; } @@ -301,34 +302,37 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) last->next = malloc_or_die(sizeof(struct certs_chain)); last->next->next = NULL; memset(last->next->info_buf, 0, sizeof(last->next->info_buf)); - memset(last->next->file_buf, 0, sizeof(last->next->file_buf)); + last->next->file_buf = NULL; /* * Saving certificate file into buffer */ if (!PEM_write_bio_X509(bio, crt)) { - log_ssl_errors(LOG_LEVEL_ERROR, "PEM_write_X509() failed"); + log_ssl_errors(LOG_LEVEL_ERROR, "PEM_write_bio_X509() failed"); ret = -1; goto exit; } len = BIO_get_mem_data(bio, &bio_mem_data); - if (len > (sizeof(last->file_buf) - 1)) + last->file_buf = malloc((size_t)len + 1); + if (last->file_buf == NULL) { log_error(LOG_LEVEL_ERROR, - "X509 PEM cert len %ld is larger than buffer len %lu", - len, sizeof(last->file_buf) - 1); - len = sizeof(last->file_buf) - 1; + "Failed to allocate %lu bytes to store the X509 PEM certificate", + len + 1); + ret = -1; + goto exit; } strncpy(last->file_buf, bio_mem_data, (size_t)len); + last->file_buf[len] = '\0'; BIO_free(bio); bio = BIO_new(BIO_s_mem()); if (!bio) { - log_ssl_errors(LOG_LEVEL_ERROR, "BIO_new_mem_buf() failed"); + log_ssl_errors(LOG_LEVEL_ERROR, "BIO_new() failed"); ret = -1; goto exit; } @@ -387,7 +391,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) ul = (unsigned long)l; neg = ""; } - if (BIO_printf(bio, " %s%lu (%s0x%lx)\n", neg, ul, neg, ul) <= 0) + if (BIO_printf(bio, "%s%lu (%s0x%lx)\n", neg, ul, neg, ul) <= 0) { log_ssl_errors(LOG_LEVEL_ERROR, "BIO_printf() for serial failed"); ret = -1; @@ -500,8 +504,12 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) case EVP_PKEY_DSA: ret = BIO_printf(bio, "\n%-" BC "s: %d bits", "DSA key size", EVP_PKEY_bits(pkey)); break; + case EVP_PKEY_EC: + ret = BIO_printf(bio, "\n%-" BC "s: %d bits", "EC key size", EVP_PKEY_bits(pkey)); + break; default: - ret = BIO_printf(bio, "\n%-" BC "s: %d bits", "non-RSA/DSA key size", EVP_PKEY_bits(pkey)); + ret = BIO_printf(bio, "\n%-" BC "s: %d bits", "non-RSA/DSA/EC key size", + EVP_PKEY_bits(pkey)); break; } if (ret <= 0) @@ -656,7 +664,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) len = BIO_get_mem_data(bio, &bio_mem_data); if (len <= 0) { - log_error(LOG_LEVEL_ERROR, "BIO_get_mem_data() returned %d " + log_error(LOG_LEVEL_ERROR, "BIO_get_mem_data() returned %ld " "while gathering certificate information", len); ret = -1; goto exit; @@ -697,7 +705,7 @@ exit: * Parameters : * 1 : csp = Current client state (buffers, headers, etc...) * - * Returns : 1 => Error while creating hash + * Returns : -1 => Error while creating hash * 0 => Hash created successfully * *********************************************************************/ @@ -783,11 +791,11 @@ extern int create_client_ssl_connection(struct client_state *csp) */ privoxy_mutex_lock(&certificate_mutex); - ret = generate_webpage_certificate(csp); + ret = generate_host_certificate(csp); if (ret < 0) { log_error(LOG_LEVEL_ERROR, - "Generate_webpage_certificate failed: %d", ret); + "generate_host_certificate failed: %d", ret); privoxy_mutex_unlock(&certificate_mutex); ret = -1; goto exit; @@ -869,7 +877,9 @@ extern int create_client_ssl_connection(struct client_state *csp) goto exit; } - log_error(LOG_LEVEL_CONNECT, "Client successfully connected over TLS/SSL"); + log_error(LOG_LEVEL_CONNECT, "Client successfully connected over %s (%s).", + SSL_get_version(ssl), SSL_get_cipher_name(ssl)); + csp->ssl_with_client_is_opened = 1; ret = 0; @@ -1179,7 +1189,8 @@ extern int create_server_ssl_connection(struct client_state *csp) } } - log_error(LOG_LEVEL_CONNECT, "Server successfully connected over TLS/SSL"); + log_error(LOG_LEVEL_CONNECT, "Server successfully connected over %s (%s).", + SSL_get_version(ssl), SSL_get_cipher_name(ssl)); /* * Server certificate chain is valid, so we can clean @@ -1286,8 +1297,8 @@ static void log_ssl_errors(int debuglevel, const char* fmt, ...) extern int ssl_base64_encode(unsigned char *dst, size_t dlen, size_t *olen, const unsigned char *src, size_t slen) { - *olen = 4 * ((slen/3) + ((slen%3) ? 1 : 0)) + 1; - if (*olen < dlen) + *olen = 4 * ((slen/3) + ((slen%3) ? 1 : 0)) + 1; + if (*olen > dlen) { return ENOBUFS; } @@ -1472,39 +1483,41 @@ exit: static int generate_key(struct client_state *csp, char **key_buf) { int ret = 0; - char* key_file_path = NULL; - BIGNUM *exp = BN_new(); - RSA *rsa = RSA_new(); - EVP_PKEY *key = EVP_PKEY_new(); + char* key_file_path; + BIGNUM *exp; + RSA *rsa; + EVP_PKEY *key; - if (exp == NULL || rsa == NULL || key == NULL) + key_file_path = make_certs_path(csp->config->certificate_directory, + (char *)csp->http->hash_of_host_hex, KEY_FILE_TYPE); + if (key_file_path == NULL) { - log_ssl_errors(LOG_LEVEL_ERROR, "RSA key memory allocation failure"); - ret = -1; - goto exit; + return -1; } - if (BN_set_word(exp, RSA_KEY_PUBLIC_EXPONENT) != 1) + /* + * Test if key already exists. If so, we don't have to create it again. + */ + if (file_exists(key_file_path) == 1) { - log_ssl_errors(LOG_LEVEL_ERROR, "Setting RSA key exponent failed"); - ret = -1; - goto exit; + freez(key_file_path); + return 0; } - key_file_path = make_certs_path(csp->config->certificate_directory, - (char *)csp->http->hash_of_host_hex, KEY_FILE_TYPE); - if (key_file_path == NULL) + exp = BN_new(); + rsa = RSA_new(); + key = EVP_PKEY_new(); + if (exp == NULL || rsa == NULL || key == NULL) { + log_ssl_errors(LOG_LEVEL_ERROR, "RSA key memory allocation failure"); ret = -1; goto exit; } - /* - * Test if key already exists. If so, we don't have to create it again. - */ - if (file_exists(key_file_path) == 1) + if (BN_set_word(exp, RSA_KEY_PUBLIC_EXPONENT) != 1) { - ret = 0; + log_ssl_errors(LOG_LEVEL_ERROR, "Setting RSA key exponent failed"); + ret = -1; goto exit; } @@ -1570,7 +1583,7 @@ exit: * pointer to certificate instance otherwise * *********************************************************************/ -static X509* ssl_certificate_load(const char *cert_path) +static X509 *ssl_certificate_load(const char *cert_path) { X509 *cert = NULL; FILE *cert_f = NULL; @@ -1616,8 +1629,6 @@ static int ssl_certificate_is_invalid(const char *cert_file) if (!(cert = ssl_certificate_load(cert_file))) { - log_ssl_errors(LOG_LEVEL_ERROR, - "Error reading certificate file %s", cert_file); return 1; } @@ -1709,7 +1720,7 @@ static int set_subject_alternative_name(X509 *cert, X509 *issuer, const char *ho /********************************************************************* * - * Function : generate_webpage_certificate + * Function : generate_host_certificate * * Description : Creates certificate file in presetted directory. * If certificate already exists, no other certificate @@ -1725,7 +1736,7 @@ static int set_subject_alternative_name(X509 *cert, X509 *issuer, const char *ho * 1 => Certificate created * *********************************************************************/ -static int generate_webpage_certificate(struct client_state *csp) +static int generate_host_certificate(struct client_state *csp) { char *key_buf = NULL; /* Buffer for created key */ X509 *issuer_cert = NULL; @@ -1743,6 +1754,8 @@ static int generate_webpage_certificate(struct client_state *csp) cert_options cert_opt; char cert_valid_from[VALID_DATETIME_BUFLEN]; char cert_valid_to[VALID_DATETIME_BUFLEN]; + const char *common_name; + enum { CERT_PARAM_COMMON_NAME_MAX = 64 }; /* Paths to keys and certificates needed to create certificate */ cert_opt.issuer_key = NULL; @@ -1764,6 +1777,15 @@ static int generate_webpage_certificate(struct client_state *csp) return -1; } + if (enforce_sane_certificate_state(cert_opt.output_file, + cert_opt.subject_key)) + { + freez(cert_opt.output_file); + freez(cert_opt.subject_key); + + return -1; + } + if (file_exists(cert_opt.output_file) == 1) { /* The file exists, but is it valid? */ @@ -1802,25 +1824,6 @@ static int generate_webpage_certificate(struct client_state *csp) } } - if (file_exists(cert_opt.output_file) == 0 && - file_exists(cert_opt.subject_key) == 1) - { - log_error(LOG_LEVEL_ERROR, - "A website key already exists but there's no matching certificate. " - "Removing %s before creating a new key and certificate.", - cert_opt.subject_key); - if (unlink(cert_opt.subject_key)) - { - log_error(LOG_LEVEL_ERROR, "Failed to unlink %s: %E", - cert_opt.subject_key); - - freez(cert_opt.output_file); - freez(cert_opt.subject_key); - - return -1; - } - } - /* * Create key for requested host */ @@ -1863,13 +1866,20 @@ static int generate_webpage_certificate(struct client_state *csp) subject_name = X509_NAME_new(); if (!subject_name) { - log_ssl_errors(LOG_LEVEL_ERROR, "RSA key memory allocation failure"); + log_ssl_errors(LOG_LEVEL_ERROR, "X509 memory allocation failure"); ret = -1; goto exit; } + /* + * Make sure OpenSSL doesn't reject the common name due to its length. + * The clients should only care about the Subject Alternative Name anyway + * and we always use the real host name for that. + */ + common_name = (strlen(csp->http->host) > CERT_PARAM_COMMON_NAME_MAX) ? + CGI_SITE_2_HOST : csp->http->host; if (!X509_NAME_add_entry_by_txt(subject_name, CERT_PARAM_COMMON_NAME_FCODE, - MBSTRING_ASC, (void *)csp->http->host, -1, -1, 0)) + MBSTRING_ASC, (void *)common_name, -1, -1, 0)) { log_ssl_errors(LOG_LEVEL_ERROR, "X509 subject name (code: %s, val: %s) error", @@ -1878,7 +1888,7 @@ static int generate_webpage_certificate(struct client_state *csp) goto exit; } if (!X509_NAME_add_entry_by_txt(subject_name, CERT_PARAM_ORGANIZATION_FCODE, - MBSTRING_ASC, (void *)csp->http->host, -1, -1, 0)) + MBSTRING_ASC, (void *)common_name, -1, -1, 0)) { log_ssl_errors(LOG_LEVEL_ERROR, "X509 subject name (code: %s, val: %s) error", @@ -1887,7 +1897,7 @@ static int generate_webpage_certificate(struct client_state *csp) goto exit; } if (!X509_NAME_add_entry_by_txt(subject_name, CERT_PARAM_ORG_UNIT_FCODE, - MBSTRING_ASC, (void *)csp->http->host, -1, -1, 0)) + MBSTRING_ASC, (void *)common_name, -1, -1, 0)) { log_ssl_errors(LOG_LEVEL_ERROR, "X509 subject name (code: %s, val: %s) error", @@ -1900,7 +1910,7 @@ static int generate_webpage_certificate(struct client_state *csp) { log_ssl_errors(LOG_LEVEL_ERROR, "X509 subject name (code: %s, val: %s) error", - CERT_PARAM_COUNTRY_FCODE, csp->http->host); + CERT_PARAM_COUNTRY_FCODE, CERT_PARAM_COUNTRY_CODE); ret = -1; goto exit; } @@ -1942,7 +1952,7 @@ static int generate_webpage_certificate(struct client_state *csp) serial_num = BN_new(); if (!serial_num) { - log_error(LOG_LEVEL_ERROR, "generate_webpage_certificate: memory error"); + log_error(LOG_LEVEL_ERROR, "generate_host_certificate: memory error"); ret = -1; goto exit; } @@ -2231,6 +2241,7 @@ extern void ssl_crt_verify_info(char *buf, size_t size, struct client_state *csp } +#ifdef FEATURE_GRACEFUL_TERMINATION /********************************************************************* * * Function : ssl_release @@ -2246,8 +2257,12 @@ extern void ssl_release(void) { if (ssl_inited == 1) { +#if OPENSSL_VERSION_NUMBER >= 0x1000200fL +#ifndef LIBRESSL_VERSION_NUMBER #ifndef OPENSSL_NO_COMP SSL_COMP_free_compression_methods(); +#endif +#endif #endif CONF_modules_free(); CONF_modules_unload(1); @@ -2261,4 +2276,4 @@ extern void ssl_release(void) CRYPTO_cleanup_all_ex_data(); } } - +#endif /* def FEATURE_GRACEFUL_TERMINATION */