SoniEx2
/
c.sexchat
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Be compatable with TLS 

closes #461
This commit is contained in:
TingPing 2013-03-23 22:24:19 -03:00
parent 2c029f763c
commit 84ffde7152
1 changed files with 329 additions and 329 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

658
src/common/ssl.c
View File

@ -1,330 +1,330 @@
/* /*
* ssl.c v0.0.3 * ssl.c v0.0.3
* Copyright (C) 2000 -- DaP <profeta@freemail.c3.hu> * Copyright (C) 2000 -- DaP <profeta@freemail.c3.hu>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or * the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version. * (at your option) any later version.
* *
* This program is distributed in the hope that it will be useful, * This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of * but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details. * GNU General Public License for more details.
* *
* You should have received a copy of the GNU General Public License * You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software * along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
*/ */
#include "inet.h" /* make it first to avoid macro redefinitions */ #include "inet.h" /* make it first to avoid macro redefinitions */
#include <openssl/ssl.h> /* SSL_() */ #include <openssl/ssl.h> /* SSL_() */
#include <openssl/err.h> /* ERR_() */ #include <openssl/err.h> /* ERR_() */
#ifdef WIN32 #ifdef WIN32
#include <openssl/rand.h> /* RAND_seed() */ #include <openssl/rand.h> /* RAND_seed() */
#include "../../config-win32.h" /* HAVE_SNPRINTF */ #include "../../config-win32.h" /* HAVE_SNPRINTF */
#else #else
#include "../../config.h" #include "../../config.h"
#endif #endif
#include <time.h> /* asctime() */ #include <time.h> /* asctime() */
#include <string.h> /* strncpy() */ #include <string.h> /* strncpy() */
#include "ssl.h" /* struct cert_info */ #include "ssl.h" /* struct cert_info */
#ifndef HAVE_SNPRINTF #ifndef HAVE_SNPRINTF
#include <glib.h> #include <glib.h>
#include <glib/gprintf.h> #include <glib/gprintf.h>
#define snprintf g_snprintf #define snprintf g_snprintf
#endif #endif
/* globals */ /* globals */
static struct chiper_info chiper_info; /* static buffer for _SSL_get_cipher_info() */ static struct chiper_info chiper_info; /* static buffer for _SSL_get_cipher_info() */
static char err_buf[256]; /* generic error buffer */ static char err_buf[256]; /* generic error buffer */
/* +++++ Internal functions +++++ */ /* +++++ Internal functions +++++ */
static void static void
__SSL_fill_err_buf (char *funcname) __SSL_fill_err_buf (char *funcname)
{ {
int err; int err;
char buf[256]; char buf[256];
err = ERR_get_error (); err = ERR_get_error ();
ERR_error_string (err, buf); ERR_error_string (err, buf);
snprintf (err_buf, sizeof (err_buf), "%s: %s (%d)\n", funcname, buf, err); snprintf (err_buf, sizeof (err_buf), "%s: %s (%d)\n", funcname, buf, err);
} }
static void static void
__SSL_critical_error (char *funcname) __SSL_critical_error (char *funcname)
{ {
__SSL_fill_err_buf (funcname); __SSL_fill_err_buf (funcname);
fprintf (stderr, "%s\n", err_buf); fprintf (stderr, "%s\n", err_buf);
exit (1); exit (1);
} }
/* +++++ SSL functions +++++ */ /* +++++ SSL functions +++++ */
SSL_CTX * SSL_CTX *
_SSL_context_init (void (*info_cb_func), int server) _SSL_context_init (void (*info_cb_func), int server)
{ {
SSL_CTX *ctx; SSL_CTX *ctx;
#ifdef WIN32 #ifdef WIN32
int i, r; int i, r;
#endif #endif
SSLeay_add_ssl_algorithms (); SSLeay_add_ssl_algorithms ();
SSL_load_error_strings (); SSL_load_error_strings ();
ctx = SSL_CTX_new (server ? SSLv3_server_method() : SSLv3_client_method ()); ctx = SSL_CTX_new (server ? SSLv23_server_method() : SSLv23_client_method ());
SSL_CTX_set_session_cache_mode (ctx, SSL_SESS_CACHE_BOTH); SSL_CTX_set_session_cache_mode (ctx, SSL_SESS_CACHE_BOTH);
SSL_CTX_set_timeout (ctx, 300); SSL_CTX_set_timeout (ctx, 300);
/* used in SSL_connect(), SSL_accept() */ /* used in SSL_connect(), SSL_accept() */
SSL_CTX_set_info_callback (ctx, info_cb_func); SSL_CTX_set_info_callback (ctx, info_cb_func);
#ifdef WIN32 #ifdef WIN32
/* under win32, OpenSSL needs to be seeded with some randomness */ /* under win32, OpenSSL needs to be seeded with some randomness */
for (i = 0; i < 128; i++) for (i = 0; i < 128; i++)
{ {
r = rand (); r = rand ();
RAND_seed ((unsigned char *)&r, sizeof (r)); RAND_seed ((unsigned char *)&r, sizeof (r));
} }
#endif #endif
return(ctx); return(ctx);
} }
static void static void
ASN1_TIME_snprintf (char *buf, int buf_len, ASN1_TIME * tm) ASN1_TIME_snprintf (char *buf, int buf_len, ASN1_TIME * tm)
{ {
char *expires = NULL; char *expires = NULL;
BIO *inMem = BIO_new (BIO_s_mem ()); BIO *inMem = BIO_new (BIO_s_mem ());
ASN1_TIME_print (inMem, tm); ASN1_TIME_print (inMem, tm);
BIO_get_mem_data (inMem, &expires); BIO_get_mem_data (inMem, &expires);
buf[0] = 0; buf[0] = 0;
if (expires != NULL) if (expires != NULL)
{ {
memset (buf, 0, buf_len); memset (buf, 0, buf_len);
strncpy (buf, expires, 24); strncpy (buf, expires, 24);
} }
BIO_free (inMem); BIO_free (inMem);
} }
static void static void
broke_oneline (char *oneline, char *parray[]) broke_oneline (char *oneline, char *parray[])
{ {
char *pt, *ppt; char *pt, *ppt;
int i; int i;
i = 0; i = 0;
ppt = pt = oneline + 1; ppt = pt = oneline + 1;
while ((pt = strchr (pt, '/'))) while ((pt = strchr (pt, '/')))
{ {
*pt = 0; *pt = 0;
parray[i++] = ppt; parray[i++] = ppt;
ppt = ++pt; ppt = ++pt;
} }
parray[i++] = ppt; parray[i++] = ppt;
parray[i] = NULL; parray[i] = NULL;
} }
/* /*
FIXME: Master-Key, Extensions, CA bits FIXME: Master-Key, Extensions, CA bits
(openssl x509 -text -in servcert.pem) (openssl x509 -text -in servcert.pem)
*/ */
int int
_SSL_get_cert_info (struct cert_info *cert_info, SSL * ssl) _SSL_get_cert_info (struct cert_info *cert_info, SSL * ssl)
{ {
X509 *peer_cert; X509 *peer_cert;
EVP_PKEY *peer_pkey; EVP_PKEY *peer_pkey;
/* EVP_PKEY *ca_pkey; */ /* EVP_PKEY *ca_pkey; */
/* EVP_PKEY *tmp_pkey; */ /* EVP_PKEY *tmp_pkey; */
char notBefore[64]; char notBefore[64];
char notAfter[64]; char notAfter[64];
int alg; int alg;
int sign_alg; int sign_alg;
if (!(peer_cert = SSL_get_peer_certificate (ssl))) if (!(peer_cert = SSL_get_peer_certificate (ssl)))
return (1); /* FATAL? */ return (1); /* FATAL? */
X509_NAME_oneline (X509_get_subject_name (peer_cert), cert_info->subject, X509_NAME_oneline (X509_get_subject_name (peer_cert), cert_info->subject,
sizeof (cert_info->subject)); sizeof (cert_info->subject));
X509_NAME_oneline (X509_get_issuer_name (peer_cert), cert_info->issuer, X509_NAME_oneline (X509_get_issuer_name (peer_cert), cert_info->issuer,
sizeof (cert_info->issuer)); sizeof (cert_info->issuer));
broke_oneline (cert_info->subject, cert_info->subject_word); broke_oneline (cert_info->subject, cert_info->subject_word);
broke_oneline (cert_info->issuer, cert_info->issuer_word); broke_oneline (cert_info->issuer, cert_info->issuer_word);
alg = OBJ_obj2nid (peer_cert->cert_info->key->algor->algorithm); alg = OBJ_obj2nid (peer_cert->cert_info->key->algor->algorithm);
sign_alg = OBJ_obj2nid (peer_cert->sig_alg->algorithm); sign_alg = OBJ_obj2nid (peer_cert->sig_alg->algorithm);
ASN1_TIME_snprintf (notBefore, sizeof (notBefore), ASN1_TIME_snprintf (notBefore, sizeof (notBefore),
X509_get_notBefore (peer_cert)); X509_get_notBefore (peer_cert));
ASN1_TIME_snprintf (notAfter, sizeof (notAfter), ASN1_TIME_snprintf (notAfter, sizeof (notAfter),
X509_get_notAfter (peer_cert)); X509_get_notAfter (peer_cert));
peer_pkey = X509_get_pubkey (peer_cert); peer_pkey = X509_get_pubkey (peer_cert);
strncpy (cert_info->algorithm, strncpy (cert_info->algorithm,
(alg == NID_undef) ? "Unknown" : OBJ_nid2ln (alg), (alg == NID_undef) ? "Unknown" : OBJ_nid2ln (alg),
sizeof (cert_info->algorithm)); sizeof (cert_info->algorithm));
cert_info->algorithm_bits = EVP_PKEY_bits (peer_pkey); cert_info->algorithm_bits = EVP_PKEY_bits (peer_pkey);
strncpy (cert_info->sign_algorithm, strncpy (cert_info->sign_algorithm,
(sign_alg == NID_undef) ? "Unknown" : OBJ_nid2ln (sign_alg), (sign_alg == NID_undef) ? "Unknown" : OBJ_nid2ln (sign_alg),
sizeof (cert_info->sign_algorithm)); sizeof (cert_info->sign_algorithm));
/* EVP_PKEY_bits(ca_pkey)); */ /* EVP_PKEY_bits(ca_pkey)); */
cert_info->sign_algorithm_bits = 0; cert_info->sign_algorithm_bits = 0;
strncpy (cert_info->notbefore, notBefore, sizeof (cert_info->notbefore)); strncpy (cert_info->notbefore, notBefore, sizeof (cert_info->notbefore));
strncpy (cert_info->notafter, notAfter, sizeof (cert_info->notafter)); strncpy (cert_info->notafter, notAfter, sizeof (cert_info->notafter));
EVP_PKEY_free (peer_pkey); EVP_PKEY_free (peer_pkey);
/* SSL_SESSION_print_fp(stdout, SSL_get_session(ssl)); */ /* SSL_SESSION_print_fp(stdout, SSL_get_session(ssl)); */
/* /*
if (ssl->session->sess_cert->peer_rsa_tmp) { if (ssl->session->sess_cert->peer_rsa_tmp) {
tmp_pkey = EVP_PKEY_new(); tmp_pkey = EVP_PKEY_new();
EVP_PKEY_assign_RSA(tmp_pkey, ssl->session->sess_cert->peer_rsa_tmp); EVP_PKEY_assign_RSA(tmp_pkey, ssl->session->sess_cert->peer_rsa_tmp);
cert_info->rsa_tmp_bits = EVP_PKEY_bits (tmp_pkey); cert_info->rsa_tmp_bits = EVP_PKEY_bits (tmp_pkey);
EVP_PKEY_free(tmp_pkey); EVP_PKEY_free(tmp_pkey);
} else } else
fprintf(stderr, "REMOTE SIDE DOESN'T PROVIDES ->peer_rsa_tmp\n"); fprintf(stderr, "REMOTE SIDE DOESN'T PROVIDES ->peer_rsa_tmp\n");
*/ */
cert_info->rsa_tmp_bits = 0; cert_info->rsa_tmp_bits = 0;
X509_free (peer_cert); X509_free (peer_cert);
return (0); return (0);
} }
struct chiper_info * struct chiper_info *
_SSL_get_cipher_info (SSL * ssl) _SSL_get_cipher_info (SSL * ssl)
{ {
const SSL_CIPHER *c; const SSL_CIPHER *c;
c = SSL_get_current_cipher (ssl); c = SSL_get_current_cipher (ssl);
strncpy (chiper_info.version, SSL_CIPHER_get_version (c), strncpy (chiper_info.version, SSL_CIPHER_get_version (c),
sizeof (chiper_info.version)); sizeof (chiper_info.version));
strncpy (chiper_info.chiper, SSL_CIPHER_get_name (c), strncpy (chiper_info.chiper, SSL_CIPHER_get_name (c),
sizeof (chiper_info.chiper)); sizeof (chiper_info.chiper));
SSL_CIPHER_get_bits (c, &chiper_info.chiper_bits); SSL_CIPHER_get_bits (c, &chiper_info.chiper_bits);
return (&chiper_info); return (&chiper_info);
} }
int int
_SSL_send (SSL * ssl, char *buf, int len) _SSL_send (SSL * ssl, char *buf, int len)
{ {
int num; int num;
num = SSL_write (ssl, buf, len); num = SSL_write (ssl, buf, len);
switch (SSL_get_error (ssl, num)) switch (SSL_get_error (ssl, num))
{ {
case SSL_ERROR_SSL: /* setup errno! */ case SSL_ERROR_SSL: /* setup errno! */
/* ??? */ /* ??? */
__SSL_fill_err_buf ("SSL_write"); __SSL_fill_err_buf ("SSL_write");
fprintf (stderr, "%s\n", err_buf); fprintf (stderr, "%s\n", err_buf);
break; break;
case SSL_ERROR_SYSCALL: case SSL_ERROR_SYSCALL:
/* ??? */ /* ??? */
perror ("SSL_write/write"); perror ("SSL_write/write");
break; break;
case SSL_ERROR_ZERO_RETURN: case SSL_ERROR_ZERO_RETURN:
/* fprintf(stderr, "SSL closed on write\n"); */ /* fprintf(stderr, "SSL closed on write\n"); */
break; break;
} }
return (num); return (num);
} }
int int
_SSL_recv (SSL * ssl, char *buf, int len) _SSL_recv (SSL * ssl, char *buf, int len)
{ {
int num; int num;
num = SSL_read (ssl, buf, len); num = SSL_read (ssl, buf, len);
switch (SSL_get_error (ssl, num)) switch (SSL_get_error (ssl, num))
{ {
case SSL_ERROR_SSL: case SSL_ERROR_SSL:
/* ??? */ /* ??? */
__SSL_fill_err_buf ("SSL_read"); __SSL_fill_err_buf ("SSL_read");
fprintf (stderr, "%s\n", err_buf); fprintf (stderr, "%s\n", err_buf);
break; break;
case SSL_ERROR_SYSCALL: case SSL_ERROR_SYSCALL:
/* ??? */ /* ??? */
if (!would_block ()) if (!would_block ())
perror ("SSL_read/read"); perror ("SSL_read/read");
break; break;
case SSL_ERROR_ZERO_RETURN: case SSL_ERROR_ZERO_RETURN:
/* fprintf(stdeerr, "SSL closed on read\n"); */ /* fprintf(stdeerr, "SSL closed on read\n"); */
break; break;
} }
return (num); return (num);
} }
SSL * SSL *
_SSL_socket (SSL_CTX *ctx, int sd) _SSL_socket (SSL_CTX *ctx, int sd)
{ {
SSL *ssl; SSL *ssl;
if (!(ssl = SSL_new (ctx))) if (!(ssl = SSL_new (ctx)))
/* FATAL */ /* FATAL */
__SSL_critical_error ("SSL_new"); __SSL_critical_error ("SSL_new");
SSL_set_fd (ssl, sd); SSL_set_fd (ssl, sd);
if (ctx->method == SSLv3_client_method()) if (ctx->method == SSLv23_client_method())
SSL_set_connect_state (ssl); SSL_set_connect_state (ssl);
else else
SSL_set_accept_state(ssl); SSL_set_accept_state(ssl);
return (ssl); return (ssl);
} }
char * char *
_SSL_set_verify (SSL_CTX *ctx, void *verify_callback, char *cacert) _SSL_set_verify (SSL_CTX *ctx, void *verify_callback, char *cacert)
{ {
if (!SSL_CTX_set_default_verify_paths (ctx)) if (!SSL_CTX_set_default_verify_paths (ctx))
{ {
__SSL_fill_err_buf ("SSL_CTX_set_default_verify_paths"); __SSL_fill_err_buf ("SSL_CTX_set_default_verify_paths");
return (err_buf); return (err_buf);
} }
/* /*
if (cacert) if (cacert)
{ {
if (!SSL_CTX_load_verify_locations (ctx, cacert, NULL)) if (!SSL_CTX_load_verify_locations (ctx, cacert, NULL))
{ {
__SSL_fill_err_buf ("SSL_CTX_load_verify_locations"); __SSL_fill_err_buf ("SSL_CTX_load_verify_locations");
return (err_buf); return (err_buf);
} }
} }
*/ */
SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER, verify_callback); SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER, verify_callback);
return (NULL); return (NULL);
} }
void void
_SSL_close (SSL * ssl) _SSL_close (SSL * ssl)
{ {
SSL_set_shutdown (ssl, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN); SSL_set_shutdown (ssl, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
SSL_free (ssl); SSL_free (ssl);
ERR_remove_state (0); /* free state buffer */ ERR_remove_state (0); /* free state buffer */
} }