X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=ssl_common.c;h=879111e9bc2fc47bbe4ddb858f422a480f3b01dd;hp=1aa13365f4dc61622074f2df8908314ed37b1cf3;hb=f2be4cfb0e98db4cf6fcf33f3f1efadabe399887;hpb=f9b953ed3f2bc2de510352e56dfbf91efd19ac7e diff --git a/ssl_common.c b/ssl_common.c index 1aa13365..879111e9 100644 --- a/ssl_common.c +++ b/ssl_common.c @@ -1,13 +1,13 @@ /********************************************************************* * - * File : $Source: /cvsroot/ijbswa/current/ssl.c,v $ + * File : $Source: /cvsroot/ijbswa/current/ssl_common.c,v $ * * Purpose : File with TLS/SSL extension. Contains methods for * creating, using and closing TLS/SSL connections that do * not depend on particular TLS/SSL library. * * Copyright : Written by and Copyright (c) 2017 Vaclav Svec. FIT CVUT. - * Copyright (C) 2018-2020 by Fabian Keil + * Copyright (C) 2018-2021 by Fabian Keil * * This program is free software; you can redistribute it * and/or modify it under the terms of the GNU General @@ -31,6 +31,7 @@ #include #include +#include #include "config.h" #include "project.h" #include "miscutil.h" @@ -91,7 +92,7 @@ extern int server_use_ssl(const struct client_state *csp) * connection, optionally delaying the operation. * * Parameters : - * 1 : ssl = SSL context to send data to + * 1 : ssl_attr = SSL context to send data to * 2 : buf = Pointer to data to be sent * 3 : len = Length of data to be sent to the SSL context * 4 : delay = Delay in milliseconds. @@ -154,7 +155,7 @@ extern int ssl_send_data_delayed(struct ssl_attr* ssl_attr, * SSL connection. Alternative to function flush_socket. * * Parameters : - * 1 : ssl = SSL context to send buffer to + * 1 : ssl_attr = SSL context to send buffer to * 2 : iob = The I/O buffer to flush, usually csp->iob. * * Returns : On success, the number of bytes send are returned (zero @@ -323,6 +324,7 @@ extern void ssl_send_certificate_error(struct client_state *csp) size_t message_len = 0; int ret = 0; struct certs_chain *cert = NULL; + const size_t head_length = 63; /* Header of message with certificate information */ const char message_begin[] = @@ -333,7 +335,7 @@ extern void ssl_send_certificate_error(struct client_state *csp) "Server certificate verification failed\n" "

Server certificate verification failed

\n" "

Privoxy was unable " - "to securely connnect to the destination server.

" + "to securely connect to the destination server.

" "

Reason: "; const char message_end[] = "\r\n\r\n"; char reason[INVALID_CERT_INFO_BUF_SIZE]; @@ -406,9 +408,20 @@ extern void ssl_send_certificate_error(struct client_state *csp) /* * Sending final message to client */ - ssl_send_data(ssl_attr, (const unsigned char *)message, strlen(message)); + (void)ssl_send_data(ssl_attr, (const unsigned char *)message, strlen(message)); free_certificate_chain(csp); + + log_error(LOG_LEVEL_CRUNCH, "Certificate error: %s: https://%s%s", + reason, csp->http->hostport, csp->http->path); + log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s https://%s%s %s\" 200 %lu", + csp->ip_addr_str, csp->http->gpc, csp->http->hostport, csp->http->path, + csp->http->version, message_len-head_length); + +#ifdef FEATURE_CONNECTION_KEEP_ALIVE + csp->flags &= ~CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE; + csp->flags |= CSP_FLAG_SERVER_SOCKET_TAINTED; +#endif } @@ -475,12 +488,12 @@ extern char *make_certs_path(const char *conf_dir, const char *file_name, + strlen(file_name) + strlen(suffix) + 2; /* Setting delimiter and editing path length */ -#if defined(_WIN32) || defined(__OS2__) +#if defined(_WIN32) char delim[] = "\\"; path_size += 1; -#else /* ifndef _WIN32 || __OS2__ */ +#else /* ifndef _WIN32 */ char delim[] = "/"; -#endif /* ifndef _WIN32 || __OS2__ */ +#endif /* ifndef _WIN32 */ /* * Building up path from many parts @@ -686,3 +699,52 @@ extern int host_is_ip_address(const char *host) return 1; } + + +/********************************************************************* + * + * Function : enforce_sane_certificate_state + * + * Description : Makes sure the certificate state is sane. + * + * Parameters : + * 1 : certificate = Path to the potentionally existing certifcate. + * 2 : key = Path to the potentionally existing key. + * + * Returns : -1 => Error + * 0 => Certificate state is sane + * + *********************************************************************/ +extern int enforce_sane_certificate_state(const char *certificate, const char *key) +{ + const int certificate_exists = file_exists(certificate); + const int key_exists = file_exists(key); + + if (!certificate_exists && key_exists) + { + log_error(LOG_LEVEL_ERROR, + "A website key already exists but there's no matching certificate. " + "Removing %s before creating a new key and certificate.", key); + if (unlink(key)) + { + log_error(LOG_LEVEL_ERROR, "Failed to unlink %s: %E", key); + + return -1; + } + } + if (certificate_exists && !key_exists) + { + log_error(LOG_LEVEL_ERROR, + "A certificate exists but there's no matching key. " + "Removing %s before creating a new key and certificate.", certificate); + if (unlink(certificate)) + { + log_error(LOG_LEVEL_ERROR, "Failed to unlink %s: %E", certificate); + + return -1; + } + } + + return 0; + +}