X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=openssl.c;h=e1655d88884daad716b3b10a9b2bb69a0736dee8;hp=0005ed5fcb744872bab42db8c413d4a81f485dc2;hb=c1691b7fafea3eb2e569db6c8e68c01afdacaf6c;hpb=5d972b9163c3f0b1146a9c597d14e3a989f93b4f diff --git a/openssl.c b/openssl.c index 0005ed5f..e1655d88 100644 --- a/openssl.c +++ b/openssl.c @@ -55,7 +55,7 @@ #define CERTIFICATE_AUTHORITY_KEY "keyid:always" #define CERTIFICATE_ALT_NAME_PREFIX "DNS:" #define CERTIFICATE_VERSION 2 -#define VALID_DATETIME_FMT "%Y%m%d%H%M%SZ" +#define VALID_DATETIME_FMT "%y%m%d%H%M%SZ" #define VALID_DATETIME_BUFLEN 16 static int generate_webpage_certificate(struct client_state *csp); @@ -152,19 +152,27 @@ extern size_t is_ssl_pending(struct ssl_attr *ssl_attr) extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, size_t len) { BIO *bio = ssl_attr->openssl_attr.bio; + SSL *ssl; int ret = 0; int pos = 0; /* Position of unsent part in buffer */ + int fd = -1; if (len == 0) { return 0; } + if (BIO_get_ssl(bio, &ssl) == 1) + { + fd = SSL_get_fd(ssl); + } + while (pos < len) { int send_len = (int)len - pos; - log_error(LOG_LEVEL_WRITING, "TLS: %N", send_len, buf+pos); + log_error(LOG_LEVEL_WRITING, "TLS on socket %d: %N", + fd, send_len, buf+pos); /* * Sending one part of the buffer @@ -176,7 +184,7 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si if (!BIO_should_retry(bio)) { log_ssl_errors(LOG_LEVEL_ERROR, - "Sending data over TLS/SSL failed"); + "Sending data on socket %d over TLS/SSL failed", fd); return -1; } } @@ -207,7 +215,10 @@ extern int ssl_send_data(struct ssl_attr *ssl_attr, const unsigned char *buf, si extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t max_length) { BIO *bio = ssl_attr->openssl_attr.bio; + SSL *ssl; int ret = 0; + int fd = -1; + memset(buf, 0, max_length); /* @@ -221,12 +232,18 @@ extern int ssl_recv_data(struct ssl_attr *ssl_attr, unsigned char *buf, size_t m if (ret < 0) { log_ssl_errors(LOG_LEVEL_ERROR, - "Receiving data over TLS/SSL failed"); + "Receiving data on socket %d over TLS/SSL failed", fd); return -1; } - log_error(LOG_LEVEL_RECEIVED, "TLS: %N", ret, buf); + if (BIO_get_ssl(bio, &ssl) == 1) + { + fd = SSL_get_fd(ssl); + } + + log_error(LOG_LEVEL_RECEIVED, "TLS from socket %d: %N", + fd, ret, buf); return ret; } @@ -301,7 +318,7 @@ static int ssl_store_cert(struct client_state *csp, X509* crt) if (len > (sizeof(last->file_buf) - 1)) { log_error(LOG_LEVEL_ERROR, - "X509 PEM cert len %d is larger than buffer len %d", + "X509 PEM cert len %ld is larger than buffer len %lu", len, sizeof(last->file_buf) - 1); len = sizeof(last->file_buf) - 1; } @@ -718,10 +735,9 @@ extern int create_client_ssl_connection(struct client_state *csp) struct ssl_attr *ssl_attr = &csp->ssl_client_attr; /* Paths to certificates file and key file */ char *key_file = NULL; - char *ca_file = NULL; char *cert_file = NULL; int ret = 0; - SSL* ssl; + SSL *ssl; /* * Initializing OpenSSL structures for TLS/SSL connection @@ -742,7 +758,6 @@ extern int create_client_ssl_connection(struct client_state *csp) /* * Preparing paths to certificates files and key file */ - ca_file = csp->config->ca_cert_file; cert_file = make_certs_path(csp->config->certificate_directory, (const char *)csp->http->hash_of_host_hex, CERT_FILE_TYPE); key_file = make_certs_path(csp->config->certificate_directory, @@ -820,6 +835,18 @@ extern int create_client_ssl_connection(struct client_state *csp) goto exit; } + if (csp->config->cipher_list != NULL) + { + if (!SSL_set_cipher_list(ssl, csp->config->cipher_list)) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "Setting the cipher list '%s' for the client connection failed", + csp->config->cipher_list); + ret = -1; + goto exit; + } + } + /* * Handshake with client */ @@ -870,6 +897,7 @@ exit: extern void close_client_ssl_connection(struct client_state *csp) { struct ssl_attr *ssl_attr = &csp->ssl_client_attr; + SSL *ssl; if (csp->ssl_with_client_is_opened == 0) { @@ -880,6 +908,20 @@ extern void close_client_ssl_connection(struct client_state *csp) * Notifying the peer that the connection is being closed. */ BIO_ssl_shutdown(ssl_attr->openssl_attr.bio); + if (BIO_get_ssl(ssl_attr->openssl_attr.bio, &ssl) != 1) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "BIO_get_ssl() failed in close_client_ssl_connection()"); + } + else + { + /* + * Pretend we received a shutdown alert so + * the BIO_free_all() call later on returns + * quickly. + */ + SSL_set_shutdown(ssl, SSL_RECEIVED_SHUTDOWN); + } free_client_ssl_structures(csp); csp->ssl_with_client_is_opened = 0; } @@ -929,6 +971,7 @@ static void free_client_ssl_structures(struct client_state *csp) extern void close_server_ssl_connection(struct client_state *csp) { struct ssl_attr *ssl_attr = &csp->ssl_server_attr; + SSL *ssl; if (csp->ssl_with_server_is_opened == 0) { @@ -939,6 +982,20 @@ extern void close_server_ssl_connection(struct client_state *csp) * Notifying the peer that the connection is being closed. */ BIO_ssl_shutdown(ssl_attr->openssl_attr.bio); + if (BIO_get_ssl(ssl_attr->openssl_attr.bio, &ssl) != 1) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "BIO_get_ssl() failed in close_server_ssl_connection()"); + } + else + { + /* + * Pretend we received a shutdown alert so + * the BIO_free_all() call later on returns + * quickly. + */ + SSL_set_shutdown(ssl, SSL_RECEIVED_SHUTDOWN); + } free_server_ssl_structures(csp); csp->ssl_with_server_is_opened = 0; } @@ -1014,6 +1071,18 @@ extern int create_server_ssl_connection(struct client_state *csp) goto exit; } + if (csp->config->cipher_list != NULL) + { + if (!SSL_set_cipher_list(ssl, csp->config->cipher_list)) + { + log_ssl_errors(LOG_LEVEL_ERROR, + "Setting the cipher list '%s' for the server connection failed", + csp->config->cipher_list); + ret = -1; + goto exit; + } + } + /* * Set the hostname to check against the received server certificate */ @@ -1093,8 +1162,9 @@ extern int create_server_ssl_connection(struct client_state *csp) else { csp->server_cert_verification_result = verify_result; - log_error(LOG_LEVEL_ERROR, "SSL_get_verify_result failed: %s", - X509_verify_cert_error_string(verify_result)); + log_error(LOG_LEVEL_ERROR, + "X509 certificate verification for %s failed: %s", + csp->http->hostport, X509_verify_cert_error_string(verify_result)); ret = -1; goto exit; } @@ -1547,6 +1617,7 @@ static int ssl_certificate_is_invalid(const char *cert_file) { log_ssl_errors(LOG_LEVEL_ERROR, "Error checking certificate %s validity", cert_file); + ret = -1; } X509_free(cert); @@ -1722,6 +1793,25 @@ static int generate_webpage_certificate(struct client_state *csp) } } + if (file_exists(cert_opt.output_file) == 0 && + file_exists(cert_opt.subject_key) == 1) + { + log_error(LOG_LEVEL_ERROR, + "A website key already exists but there's no matching certificate. " + "Removing %s before creating a new key and certificate.", + cert_opt.subject_key); + if (unlink(cert_opt.subject_key)) + { + log_error(LOG_LEVEL_ERROR, "Failed to unlink %s: %E", + cert_opt.subject_key); + + freez(cert_opt.output_file); + freez(cert_opt.subject_key); + + return -1; + } + } + /* * Create key for requested host */ @@ -2147,12 +2237,14 @@ extern void ssl_release(void) { if (ssl_inited == 1) { +#ifndef OPENSSL_NO_COMP SSL_COMP_free_compression_methods(); - +#endif CONF_modules_free(); CONF_modules_unload(1); - +#ifndef OPENSSL_NO_COMP COMP_zlib_cleanup(); +#endif ERR_free_strings(); EVP_cleanup();