2002-09-03 13:52:59 +02:00
|
|
|
/***************************************************************************
|
2004-05-18 09:25:13 +02:00
|
|
|
* _ _ ____ _
|
|
|
|
* Project ___| | | | _ \| |
|
|
|
|
* / __| | | | |_) | |
|
|
|
|
* | (__| |_| | _ <| |___
|
1999-12-29 15:20:26 +01:00
|
|
|
* \___|\___/|_| \_\_____|
|
|
|
|
*
|
2004-01-07 10:19:33 +01:00
|
|
|
* Copyright (C) 1998 - 2004, Daniel Stenberg, <daniel@haxx.se>, et al.
|
1999-12-29 15:20:26 +01:00
|
|
|
*
|
2002-09-03 13:52:59 +02:00
|
|
|
* This software is licensed as described in the file COPYING, which
|
|
|
|
* you should have received as part of this distribution. The terms
|
|
|
|
* are also available at http://curl.haxx.se/docs/copyright.html.
|
2004-05-18 09:25:13 +02:00
|
|
|
*
|
2001-01-03 10:29:33 +01:00
|
|
|
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
|
|
|
* copies of the Software, and permit persons to whom the Software is
|
2002-09-03 13:52:59 +02:00
|
|
|
* furnished to do so, under the terms of the COPYING file.
|
1999-12-29 15:20:26 +01:00
|
|
|
*
|
2001-01-03 10:29:33 +01:00
|
|
|
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
|
|
|
* KIND, either express or implied.
|
1999-12-29 15:20:26 +01:00
|
|
|
*
|
2001-01-03 10:29:33 +01:00
|
|
|
* $Id$
|
2002-09-03 13:52:59 +02:00
|
|
|
***************************************************************************/
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2000-05-22 16:12:12 +02:00
|
|
|
/*
|
2001-12-18 00:01:39 +01:00
|
|
|
* The original SSL code for curl was written by
|
2000-05-22 16:12:12 +02:00
|
|
|
* Linas Vepstas <linas@linas.org> and Sampo Kellomaki <sampo@iki.fi>
|
|
|
|
*/
|
|
|
|
|
2000-08-24 16:26:33 +02:00
|
|
|
#include "setup.h"
|
2001-12-18 00:01:39 +01:00
|
|
|
|
1999-12-29 15:20:26 +01:00
|
|
|
#include <string.h>
|
|
|
|
#include <stdlib.h>
|
2003-10-07 23:46:47 +02:00
|
|
|
#include <ctype.h>
|
2003-03-13 22:41:02 +01:00
|
|
|
#ifdef HAVE_SYS_TYPES_H
|
|
|
|
#include <sys/types.h>
|
|
|
|
#endif
|
2003-02-14 10:03:03 +01:00
|
|
|
#ifdef HAVE_SYS_SOCKET_H
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#endif
|
1999-12-29 15:20:26 +01:00
|
|
|
|
|
|
|
#include "urldata.h"
|
|
|
|
#include "sendf.h"
|
2000-03-03 00:01:35 +01:00
|
|
|
#include "formdata.h" /* for the boundary function */
|
2003-03-31 07:13:26 +02:00
|
|
|
#include "url.h" /* for the ssl config check function */
|
2003-10-07 23:46:47 +02:00
|
|
|
#include "inet_pton.h"
|
2004-01-29 14:56:45 +01:00
|
|
|
#include "ssluse.h"
|
2004-03-10 09:43:01 +01:00
|
|
|
#include "connect.h" /* Curl_ourerrno() proto */
|
1999-12-29 15:20:26 +01:00
|
|
|
|
|
|
|
#ifdef USE_SSLEAY
|
2001-03-07 18:08:20 +01:00
|
|
|
#include <openssl/rand.h>
|
2003-10-07 23:46:47 +02:00
|
|
|
#include <openssl/x509v3.h>
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2004-05-11 13:30:23 +02:00
|
|
|
#include "memory.h"
|
|
|
|
|
2001-04-24 23:41:29 +02:00
|
|
|
/* The last #include file should be: */
|
|
|
|
#include "memdebug.h"
|
|
|
|
|
2002-01-17 11:40:13 +01:00
|
|
|
#if OPENSSL_VERSION_NUMBER >= 0x0090581fL
|
|
|
|
#define HAVE_SSL_GET1_SESSION 1
|
|
|
|
#else
|
|
|
|
#undef HAVE_SSL_GET1_SESSION
|
|
|
|
#endif
|
|
|
|
|
2001-08-14 10:36:30 +02:00
|
|
|
#if OPENSSL_VERSION_NUMBER >= 0x00904100L
|
|
|
|
#define HAVE_USERDATA_IN_PWD_CALLBACK 1
|
|
|
|
#else
|
|
|
|
#undef HAVE_USERDATA_IN_PWD_CALLBACK
|
|
|
|
#endif
|
|
|
|
|
2002-06-10 14:38:10 +02:00
|
|
|
#if OPENSSL_VERSION_NUMBER >= 0x00907001L
|
|
|
|
/* ENGINE_load_private_key() takes four arguments */
|
|
|
|
#define HAVE_ENGINE_LOAD_FOUR_ARGS
|
|
|
|
#else
|
|
|
|
/* ENGINE_load_private_key() takes three arguments */
|
|
|
|
#undef HAVE_ENGINE_LOAD_FOUR_ARGS
|
|
|
|
#endif
|
|
|
|
|
2004-04-29 09:36:40 +02:00
|
|
|
#if OPENSSL_VERSION_NUMBER >= 0x00906001L
|
|
|
|
#define HAVE_ERR_ERROR_STRING_N 1
|
|
|
|
#endif
|
|
|
|
|
2002-06-10 14:38:10 +02:00
|
|
|
|
2001-08-14 10:36:30 +02:00
|
|
|
#ifndef HAVE_USERDATA_IN_PWD_CALLBACK
|
1999-12-29 15:20:26 +01:00
|
|
|
static char global_passwd[64];
|
2001-08-14 10:36:30 +02:00
|
|
|
#endif
|
1999-12-29 15:20:26 +01:00
|
|
|
|
|
|
|
static int passwd_callback(char *buf, int num, int verify
|
2001-08-14 10:36:30 +02:00
|
|
|
#if HAVE_USERDATA_IN_PWD_CALLBACK
|
1999-12-29 15:20:26 +01:00
|
|
|
/* This was introduced in 0.9.4, we can set this
|
|
|
|
using SSL_CTX_set_default_passwd_cb_userdata()
|
|
|
|
*/
|
2001-08-14 10:36:30 +02:00
|
|
|
, void *global_passwd
|
1999-12-29 15:20:26 +01:00
|
|
|
#endif
|
|
|
|
)
|
|
|
|
{
|
|
|
|
if(verify)
|
|
|
|
fprintf(stderr, "%s\n", buf);
|
|
|
|
else {
|
2001-08-14 10:36:30 +02:00
|
|
|
if(num > (int)strlen((char *)global_passwd)) {
|
1999-12-29 15:20:26 +01:00
|
|
|
strcpy(buf, global_passwd);
|
2004-03-23 16:20:57 +01:00
|
|
|
return (int)strlen(buf);
|
1999-12-29 15:20:26 +01:00
|
|
|
}
|
2004-05-18 09:25:13 +02:00
|
|
|
}
|
1999-12-29 15:20:26 +01:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2004-05-18 09:25:13 +02:00
|
|
|
/*
|
|
|
|
* rand_enough() is a function that returns TRUE if we have seeded the random
|
|
|
|
* engine properly. We use some preprocessor magic to provide a seed_enough()
|
|
|
|
* macro to use, just to prevent a compiler warning on this function if we
|
|
|
|
* pass in an argument that is never used.
|
|
|
|
*/
|
2001-08-14 10:36:30 +02:00
|
|
|
|
2004-05-18 09:25:13 +02:00
|
|
|
#ifdef HAVE_RAND_STATUS
|
|
|
|
#define seed_enough(x) rand_enough()
|
|
|
|
static bool rand_enough(void)
|
|
|
|
{
|
|
|
|
return RAND_status()?TRUE:FALSE;
|
|
|
|
}
|
2001-03-06 01:04:58 +01:00
|
|
|
#else
|
2004-05-18 09:25:13 +02:00
|
|
|
#define seed_enough(x) rand_enough(x)
|
|
|
|
static bool rand_enough(int nread)
|
|
|
|
{
|
|
|
|
/* this is a very silly decision to make */
|
|
|
|
return (nread > 500)?TRUE:FALSE;
|
2001-03-06 01:04:58 +01:00
|
|
|
}
|
2004-05-18 09:25:13 +02:00
|
|
|
#endif
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2001-01-05 11:11:41 +01:00
|
|
|
static
|
2002-01-29 15:11:38 +01:00
|
|
|
int random_the_seed(struct SessionHandle *data)
|
2001-03-06 01:04:58 +01:00
|
|
|
{
|
2002-01-29 15:11:38 +01:00
|
|
|
char *buf = data->state.buffer; /* point to the big buffer */
|
2001-03-06 01:04:58 +01:00
|
|
|
int nread=0;
|
|
|
|
|
|
|
|
/* Q: should we add support for a random file name as a libcurl option?
|
2001-03-12 16:47:17 +01:00
|
|
|
A: Yes, it is here */
|
|
|
|
|
|
|
|
#ifndef RANDOM_FILE
|
|
|
|
/* if RANDOM_FILE isn't defined, we only perform this if an option tells
|
|
|
|
us to! */
|
2001-08-31 00:48:34 +02:00
|
|
|
if(data->set.ssl.random_file)
|
2001-03-12 16:47:17 +01:00
|
|
|
#define RANDOM_FILE "" /* doesn't matter won't be used */
|
2001-03-06 01:04:58 +01:00
|
|
|
#endif
|
2001-03-12 16:47:17 +01:00
|
|
|
{
|
|
|
|
/* let the option override the define */
|
2001-08-31 00:48:34 +02:00
|
|
|
nread += RAND_load_file((data->set.ssl.random_file?
|
|
|
|
data->set.ssl.random_file:RANDOM_FILE),
|
2001-03-12 16:47:17 +01:00
|
|
|
16384);
|
2002-01-29 15:11:38 +01:00
|
|
|
if(seed_enough(nread))
|
2001-03-06 01:04:58 +01:00
|
|
|
return nread;
|
|
|
|
}
|
|
|
|
|
2001-03-12 16:47:17 +01:00
|
|
|
#if defined(HAVE_RAND_EGD)
|
2001-03-06 01:04:58 +01:00
|
|
|
/* only available in OpenSSL 0.9.5 and later */
|
2001-03-12 16:47:17 +01:00
|
|
|
/* EGD_SOCKET is set at configure time or not at all */
|
|
|
|
#ifndef EGD_SOCKET
|
|
|
|
/* If we don't have the define set, we only do this if the egd-option
|
|
|
|
is set */
|
2001-08-31 00:48:34 +02:00
|
|
|
if(data->set.ssl.egdsocket)
|
2001-03-12 16:47:17 +01:00
|
|
|
#define EGD_SOCKET "" /* doesn't matter won't be used */
|
|
|
|
#endif
|
2001-03-07 18:08:20 +01:00
|
|
|
{
|
2001-03-12 16:47:17 +01:00
|
|
|
/* If there's an option and a define, the option overrides the
|
|
|
|
define */
|
2003-03-11 19:55:34 +01:00
|
|
|
int ret = RAND_egd(data->set.ssl.egdsocket?
|
|
|
|
data->set.ssl.egdsocket:EGD_SOCKET);
|
2001-03-07 18:08:20 +01:00
|
|
|
if(-1 != ret) {
|
|
|
|
nread += ret;
|
2002-01-29 15:11:38 +01:00
|
|
|
if(seed_enough(nread))
|
2001-03-07 18:08:20 +01:00
|
|
|
return nread;
|
|
|
|
}
|
2001-03-06 01:04:58 +01:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/* If we get here, it means we need to seed the PRNG using a "silly"
|
|
|
|
approach! */
|
|
|
|
#ifdef HAVE_RAND_SCREEN
|
|
|
|
/* This one gets a random value by reading the currently shown screen */
|
|
|
|
RAND_screen();
|
|
|
|
nread = 100; /* just a value */
|
|
|
|
#else
|
|
|
|
{
|
|
|
|
int len;
|
2003-03-11 19:55:34 +01:00
|
|
|
char *area;
|
|
|
|
|
|
|
|
/* Changed call to RAND_seed to use the underlying RAND_add implementation
|
|
|
|
* directly. Do this in a loop, with the amount of additional entropy
|
|
|
|
* being dependent upon the algorithm used by Curl_FormBoundary(): N bytes
|
|
|
|
* of a 7-bit ascii set. -- Richard Gorton, March 11 2003.
|
|
|
|
*/
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-03-11 19:55:34 +01:00
|
|
|
do {
|
|
|
|
area = Curl_FormBoundary();
|
|
|
|
if(!area)
|
|
|
|
return 3; /* out of memory */
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2004-03-23 16:20:57 +01:00
|
|
|
len = (int)strlen(area);
|
2003-03-11 19:55:34 +01:00
|
|
|
RAND_add(area, len, (len >> 1));
|
2001-03-06 01:04:58 +01:00
|
|
|
|
2003-03-11 19:55:34 +01:00
|
|
|
free(area); /* now remove the random junk */
|
|
|
|
} while (!RAND_status());
|
2001-03-06 01:04:58 +01:00
|
|
|
}
|
2001-03-14 09:20:41 +01:00
|
|
|
#endif
|
2001-03-06 01:04:58 +01:00
|
|
|
|
2001-03-12 16:47:17 +01:00
|
|
|
/* generates a default path for the random seed file */
|
|
|
|
buf[0]=0; /* blank it first */
|
|
|
|
RAND_file_name(buf, BUFSIZE);
|
2003-10-07 23:46:47 +02:00
|
|
|
if(buf[0]) {
|
2001-03-12 16:47:17 +01:00
|
|
|
/* we got a file name to try */
|
|
|
|
nread += RAND_load_file(buf, 16384);
|
2002-01-29 15:11:38 +01:00
|
|
|
if(seed_enough(nread))
|
2001-03-12 16:47:17 +01:00
|
|
|
return nread;
|
|
|
|
}
|
|
|
|
|
2002-01-29 15:11:38 +01:00
|
|
|
infof(data, "libcurl is now using a weak random seed!\n");
|
2001-03-06 01:04:58 +01:00
|
|
|
return nread;
|
|
|
|
}
|
|
|
|
|
2001-12-18 00:01:39 +01:00
|
|
|
#ifndef SSL_FILETYPE_ENGINE
|
|
|
|
#define SSL_FILETYPE_ENGINE 42
|
|
|
|
#endif
|
|
|
|
static int do_file_type(const char *type)
|
|
|
|
{
|
2003-10-07 23:46:47 +02:00
|
|
|
if(!type || !type[0])
|
2001-12-18 00:01:39 +01:00
|
|
|
return SSL_FILETYPE_PEM;
|
2003-10-07 23:46:47 +02:00
|
|
|
if(curl_strequal(type, "PEM"))
|
2001-12-18 00:01:39 +01:00
|
|
|
return SSL_FILETYPE_PEM;
|
2003-10-07 23:46:47 +02:00
|
|
|
if(curl_strequal(type, "DER"))
|
2001-12-18 00:01:39 +01:00
|
|
|
return SSL_FILETYPE_ASN1;
|
2003-10-07 23:46:47 +02:00
|
|
|
if(curl_strequal(type, "ENG"))
|
2001-12-18 00:01:39 +01:00
|
|
|
return SSL_FILETYPE_ENGINE;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2001-03-06 01:04:58 +01:00
|
|
|
static
|
|
|
|
int cert_stuff(struct connectdata *conn,
|
2003-11-24 08:15:37 +01:00
|
|
|
SSL_CTX* ctx,
|
2001-01-05 11:11:41 +01:00
|
|
|
char *cert_file,
|
2001-12-18 00:01:39 +01:00
|
|
|
const char *cert_type,
|
|
|
|
char *key_file,
|
|
|
|
const char *key_type)
|
1999-12-29 15:20:26 +01:00
|
|
|
{
|
2001-08-31 00:48:34 +02:00
|
|
|
struct SessionHandle *data = conn->data;
|
2001-12-18 00:01:39 +01:00
|
|
|
int file_type;
|
|
|
|
|
2003-10-07 23:46:47 +02:00
|
|
|
if(cert_file != NULL) {
|
1999-12-29 15:20:26 +01:00
|
|
|
SSL *ssl;
|
|
|
|
X509 *x509;
|
|
|
|
|
2001-12-18 00:01:39 +01:00
|
|
|
if(data->set.key_passwd) {
|
2001-08-14 10:36:30 +02:00
|
|
|
#ifndef HAVE_USERDATA_IN_PWD_CALLBACK
|
1999-12-29 15:20:26 +01:00
|
|
|
/*
|
|
|
|
* If password has been given, we store that in the global
|
|
|
|
* area (*shudder*) for a while:
|
|
|
|
*/
|
2001-12-18 00:01:39 +01:00
|
|
|
strcpy(global_passwd, data->set.key_passwd);
|
2001-08-14 10:36:30 +02:00
|
|
|
#else
|
|
|
|
/*
|
|
|
|
* We set the password in the callback userdata
|
|
|
|
*/
|
2003-11-24 08:15:37 +01:00
|
|
|
SSL_CTX_set_default_passwd_cb_userdata(ctx,
|
2001-12-18 00:01:39 +01:00
|
|
|
data->set.key_passwd);
|
2001-08-14 10:36:30 +02:00
|
|
|
#endif
|
1999-12-29 15:20:26 +01:00
|
|
|
/* Set passwd callback: */
|
2003-11-24 08:15:37 +01:00
|
|
|
SSL_CTX_set_default_passwd_cb(ctx, passwd_callback);
|
1999-12-29 15:20:26 +01:00
|
|
|
}
|
|
|
|
|
2001-12-18 00:01:39 +01:00
|
|
|
file_type = do_file_type(cert_type);
|
|
|
|
|
|
|
|
switch(file_type) {
|
|
|
|
case SSL_FILETYPE_PEM:
|
2002-05-21 10:15:42 +02:00
|
|
|
/* SSL_CTX_use_certificate_chain_file() only works on PEM files */
|
2003-11-24 08:15:37 +01:00
|
|
|
if(SSL_CTX_use_certificate_chain_file(ctx,
|
|
|
|
cert_file) != 1) {
|
2001-12-18 00:01:39 +01:00
|
|
|
failf(data, "unable to set certificate file (wrong password?)");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
break;
|
2002-05-21 10:15:42 +02:00
|
|
|
|
|
|
|
case SSL_FILETYPE_ASN1:
|
|
|
|
/* SSL_CTX_use_certificate_file() works with either PEM or ASN1, but
|
|
|
|
we use the case above for PEM so this can only be performed with
|
|
|
|
ASN1 files. */
|
2003-11-24 08:15:37 +01:00
|
|
|
if(SSL_CTX_use_certificate_file(ctx,
|
|
|
|
cert_file,
|
|
|
|
file_type) != 1) {
|
2002-05-21 10:15:42 +02:00
|
|
|
failf(data, "unable to set certificate file (wrong password?)");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
break;
|
2001-12-18 00:01:39 +01:00
|
|
|
case SSL_FILETYPE_ENGINE:
|
|
|
|
failf(data, "file type ENG for certificate not implemented");
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
default:
|
|
|
|
failf(data, "not supported file type '%s' for certificate", cert_type);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
file_type = do_file_type(key_type);
|
|
|
|
|
|
|
|
switch(file_type) {
|
|
|
|
case SSL_FILETYPE_PEM:
|
2003-10-07 23:46:47 +02:00
|
|
|
if(key_file == NULL)
|
2001-12-18 00:01:39 +01:00
|
|
|
/* cert & key can only be in PEM case in the same file */
|
|
|
|
key_file=cert_file;
|
|
|
|
case SSL_FILETYPE_ASN1:
|
2003-11-24 08:15:37 +01:00
|
|
|
if(SSL_CTX_use_PrivateKey_file(ctx, key_file, file_type) != 1) {
|
2002-12-09 16:37:54 +01:00
|
|
|
failf(data, "unable to set private key file: '%s' type %s\n",
|
|
|
|
key_file, key_type?key_type:"PEM");
|
2001-12-18 00:01:39 +01:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case SSL_FILETYPE_ENGINE:
|
|
|
|
#ifdef HAVE_OPENSSL_ENGINE_H
|
|
|
|
{ /* XXXX still needs some work */
|
|
|
|
EVP_PKEY *priv_key = NULL;
|
2003-10-07 23:46:47 +02:00
|
|
|
if(conn && conn->data && conn->data->engine) {
|
2002-06-10 14:38:10 +02:00
|
|
|
#ifdef HAVE_ENGINE_LOAD_FOUR_ARGS
|
|
|
|
UI_METHOD *ui_method = UI_OpenSSL();
|
|
|
|
#endif
|
2003-10-07 23:46:47 +02:00
|
|
|
if(!key_file || !key_file[0]) {
|
2001-12-18 00:01:39 +01:00
|
|
|
failf(data, "no key set to load from crypto engine\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
priv_key = ENGINE_load_private_key(conn->data->engine,key_file,
|
2002-06-10 14:38:10 +02:00
|
|
|
#ifdef HAVE_ENGINE_LOAD_FOUR_ARGS
|
|
|
|
ui_method,
|
|
|
|
#endif
|
2001-12-18 00:01:39 +01:00
|
|
|
data->set.key_passwd);
|
2003-10-07 23:46:47 +02:00
|
|
|
if(!priv_key) {
|
2001-12-18 00:01:39 +01:00
|
|
|
failf(data, "failed to load private key from crypto engine\n");
|
|
|
|
return 0;
|
|
|
|
}
|
2003-11-24 08:15:37 +01:00
|
|
|
if(SSL_CTX_use_PrivateKey(ctx, priv_key) != 1) {
|
2001-12-18 00:01:39 +01:00
|
|
|
failf(data, "unable to set private key\n");
|
|
|
|
EVP_PKEY_free(priv_key);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
EVP_PKEY_free(priv_key); /* we don't need the handle any more... */
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
failf(data, "crypto engine not set, can't load private key\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
2004-04-26 13:52:43 +02:00
|
|
|
break;
|
2001-12-18 00:01:39 +01:00
|
|
|
#else
|
|
|
|
failf(data, "file type ENG for private key not supported\n");
|
|
|
|
return 0;
|
|
|
|
#endif
|
|
|
|
default:
|
|
|
|
failf(data, "not supported file type for private key\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
ssl=SSL_new(ctx);
|
1999-12-29 15:20:26 +01:00
|
|
|
x509=SSL_get_certificate(ssl);
|
2002-12-13 15:08:49 +01:00
|
|
|
|
|
|
|
/* This version was provided by Evan Jordan and is supposed to not
|
|
|
|
leak memory as the previous version: */
|
2003-10-07 23:46:47 +02:00
|
|
|
if(x509 != NULL) {
|
2002-12-13 15:08:49 +01:00
|
|
|
EVP_PKEY *pktmp = X509_get_pubkey(x509);
|
|
|
|
EVP_PKEY_copy_parameters(pktmp,SSL_get_privatekey(ssl));
|
|
|
|
EVP_PKEY_free(pktmp);
|
|
|
|
}
|
|
|
|
|
1999-12-29 15:20:26 +01:00
|
|
|
SSL_free(ssl);
|
|
|
|
|
|
|
|
/* If we are using DSA, we can copy the parameters from
|
|
|
|
* the private key */
|
2004-05-18 09:25:13 +02:00
|
|
|
|
|
|
|
|
1999-12-29 15:20:26 +01:00
|
|
|
/* Now we know that a key and cert have been set against
|
|
|
|
* the SSL context */
|
2003-11-24 08:15:37 +01:00
|
|
|
if(!SSL_CTX_check_private_key(ctx)) {
|
2001-12-11 14:13:01 +01:00
|
|
|
failf(data, "Private key does not match the certificate public key");
|
1999-12-29 15:20:26 +01:00
|
|
|
return(0);
|
|
|
|
}
|
2004-05-18 09:25:13 +02:00
|
|
|
#ifndef HAVE_USERDATA_IN_PWD_CALLBACK
|
1999-12-29 15:20:26 +01:00
|
|
|
/* erase it now */
|
|
|
|
memset(global_passwd, 0, sizeof(global_passwd));
|
2001-08-14 10:36:30 +02:00
|
|
|
#endif
|
1999-12-29 15:20:26 +01:00
|
|
|
}
|
|
|
|
return(1);
|
|
|
|
}
|
|
|
|
|
2001-01-05 11:11:41 +01:00
|
|
|
static
|
1999-12-29 15:20:26 +01:00
|
|
|
int cert_verify_callback(int ok, X509_STORE_CTX *ctx)
|
|
|
|
{
|
|
|
|
X509 *err_cert;
|
|
|
|
char buf[256];
|
|
|
|
|
|
|
|
err_cert=X509_STORE_CTX_get_current_cert(ctx);
|
2004-04-29 09:36:40 +02:00
|
|
|
X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf));
|
2001-06-29 09:38:11 +02:00
|
|
|
return ok;
|
1999-12-29 15:20:26 +01:00
|
|
|
}
|
|
|
|
|
2001-05-30 10:00:29 +02:00
|
|
|
/* "global" init done? */
|
|
|
|
static int init_ssl=0;
|
2002-01-29 15:11:38 +01:00
|
|
|
|
|
|
|
/* we have the "SSL is seeded" boolean global for the application to
|
|
|
|
prevent multiple time-consuming seedings in vain */
|
|
|
|
static bool ssl_seeded = FALSE;
|
2004-04-29 09:36:40 +02:00
|
|
|
#endif /* USE_SSLEAY */
|
2001-05-30 10:00:29 +02:00
|
|
|
|
2001-05-28 16:12:43 +02:00
|
|
|
/* Global init */
|
|
|
|
void Curl_SSL_init(void)
|
|
|
|
{
|
|
|
|
#ifdef USE_SSLEAY
|
|
|
|
/* make sure this is only done once */
|
2001-05-30 10:00:29 +02:00
|
|
|
if(0 != init_ssl)
|
2001-05-28 16:12:43 +02:00
|
|
|
return;
|
|
|
|
|
2001-05-30 10:00:29 +02:00
|
|
|
init_ssl++; /* never again */
|
2001-05-28 16:12:43 +02:00
|
|
|
|
2001-12-18 00:01:39 +01:00
|
|
|
#ifdef HAVE_ENGINE_LOAD_BUILTIN_ENGINES
|
|
|
|
ENGINE_load_builtin_engines();
|
|
|
|
#endif
|
|
|
|
|
2001-05-28 16:12:43 +02:00
|
|
|
/* Lets get nice error messages */
|
|
|
|
SSL_load_error_strings();
|
|
|
|
|
|
|
|
/* Setup all the global SSL stuff */
|
|
|
|
SSLeay_add_ssl_algorithms();
|
2001-09-07 11:40:46 +02:00
|
|
|
#else
|
|
|
|
/* SSL disabled, do nothing */
|
2001-05-28 16:12:43 +02:00
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2001-09-07 11:40:46 +02:00
|
|
|
/* Global cleanup */
|
|
|
|
void Curl_SSL_cleanup(void)
|
|
|
|
{
|
|
|
|
#ifdef USE_SSLEAY
|
|
|
|
if(init_ssl) {
|
|
|
|
/* only cleanup if we did a previous init */
|
|
|
|
|
|
|
|
/* Free the SSL error strings */
|
|
|
|
ERR_free_strings();
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2001-09-07 11:40:46 +02:00
|
|
|
/* EVP_cleanup() removes all ciphers and digests from the
|
|
|
|
table. */
|
|
|
|
EVP_cleanup();
|
2001-11-14 08:11:39 +01:00
|
|
|
|
2001-12-18 00:01:39 +01:00
|
|
|
#ifdef HAVE_ENGINE_cleanup
|
|
|
|
ENGINE_cleanup();
|
|
|
|
#endif
|
|
|
|
|
2003-08-19 11:56:16 +02:00
|
|
|
#ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
|
|
|
|
/* this function was not present in 0.9.6b, but was added sometimes
|
|
|
|
later */
|
2003-08-19 09:51:09 +02:00
|
|
|
CRYPTO_cleanup_all_ex_data();
|
2003-08-19 11:56:16 +02:00
|
|
|
#endif
|
2003-08-19 09:51:09 +02:00
|
|
|
|
2001-11-14 08:11:39 +01:00
|
|
|
init_ssl=0; /* not inited any more */
|
2001-09-07 11:40:46 +02:00
|
|
|
}
|
|
|
|
#else
|
|
|
|
/* SSL disabled, do nothing */
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
#ifndef USE_SSLEAY
|
|
|
|
void Curl_SSL_Close(struct connectdata *conn)
|
|
|
|
{
|
|
|
|
(void)conn;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2001-09-07 11:40:46 +02:00
|
|
|
#ifdef USE_SSLEAY
|
|
|
|
|
2001-08-28 10:37:54 +02:00
|
|
|
/*
|
|
|
|
* This function is called when an SSL connection is closed.
|
|
|
|
*/
|
|
|
|
void Curl_SSL_Close(struct connectdata *conn)
|
|
|
|
{
|
2003-11-24 08:15:37 +01:00
|
|
|
if(conn->ssl[FIRSTSOCKET].use) {
|
|
|
|
int i;
|
2001-08-28 10:37:54 +02:00
|
|
|
/*
|
|
|
|
ERR_remove_state() frees the error queue associated with
|
|
|
|
thread pid. If pid == 0, the current thread will have its
|
|
|
|
error queue removed.
|
|
|
|
|
|
|
|
Since error queue data structures are allocated
|
|
|
|
automatically for new threads, they must be freed when
|
|
|
|
threads are terminated in oder to avoid memory leaks.
|
|
|
|
*/
|
|
|
|
ERR_remove_state(0);
|
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
for(i=0; i<2; i++) {
|
|
|
|
struct ssl_connect_data *connssl = &conn->ssl[i];
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
if(connssl->handle) {
|
|
|
|
(void)SSL_shutdown(connssl->handle);
|
|
|
|
SSL_set_connect_state(connssl->handle);
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
SSL_free (connssl->handle);
|
|
|
|
connssl->handle = NULL;
|
|
|
|
}
|
|
|
|
if(connssl->ctx) {
|
|
|
|
SSL_CTX_free (connssl->ctx);
|
|
|
|
connssl->ctx = NULL;
|
|
|
|
}
|
|
|
|
connssl->use = FALSE; /* get back to ordinary socket usage */
|
2001-08-28 10:37:54 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2001-05-28 16:12:43 +02:00
|
|
|
|
2001-08-28 10:37:54 +02:00
|
|
|
/*
|
|
|
|
* This sets up a session cache to the specified size.
|
|
|
|
*/
|
2001-08-31 00:48:34 +02:00
|
|
|
CURLcode Curl_SSL_InitSessions(struct SessionHandle *data, long amount)
|
2001-08-28 10:37:54 +02:00
|
|
|
{
|
|
|
|
struct curl_ssl_session *session;
|
|
|
|
|
2001-09-06 10:32:01 +02:00
|
|
|
if(data->state.session)
|
2001-08-28 10:37:54 +02:00
|
|
|
/* this is just a precaution to prevent multiple inits */
|
|
|
|
return CURLE_OK;
|
|
|
|
|
|
|
|
session = (struct curl_ssl_session *)
|
|
|
|
malloc(amount * sizeof(struct curl_ssl_session));
|
|
|
|
if(!session)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
|
|
|
|
/* "blank out" the newly allocated memory */
|
|
|
|
memset(session, 0, amount * sizeof(struct curl_ssl_session));
|
|
|
|
|
|
|
|
/* store the info in the SSL section */
|
2001-08-31 00:48:34 +02:00
|
|
|
data->set.ssl.numsessions = amount;
|
2001-09-06 10:32:01 +02:00
|
|
|
data->state.session = session;
|
|
|
|
data->state.sessionage = 1; /* this is brand new */
|
2001-08-28 10:37:54 +02:00
|
|
|
|
|
|
|
return CURLE_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check if there's a session ID for the given connection in the cache,
|
|
|
|
* and if there's one suitable, it is returned.
|
|
|
|
*/
|
|
|
|
static int Get_SSL_Session(struct connectdata *conn,
|
|
|
|
SSL_SESSION **ssl_sessionid)
|
|
|
|
{
|
|
|
|
struct curl_ssl_session *check;
|
2001-08-31 00:48:34 +02:00
|
|
|
struct SessionHandle *data = conn->data;
|
2001-08-28 10:37:54 +02:00
|
|
|
long i;
|
|
|
|
|
2001-08-31 00:48:34 +02:00
|
|
|
for(i=0; i< data->set.ssl.numsessions; i++) {
|
2001-09-06 10:32:01 +02:00
|
|
|
check = &data->state.session[i];
|
2001-08-28 10:37:54 +02:00
|
|
|
if(!check->sessionid)
|
|
|
|
/* not session ID means blank entry */
|
|
|
|
continue;
|
2004-04-27 15:56:23 +02:00
|
|
|
if(curl_strequal(conn->host.name, check->name) &&
|
2003-03-31 07:13:26 +02:00
|
|
|
(conn->remote_port == check->remote_port) &&
|
|
|
|
Curl_ssl_config_matches(&conn->ssl_config, &check->ssl_config)) {
|
2001-08-28 10:37:54 +02:00
|
|
|
/* yes, we have a session ID! */
|
2001-09-06 10:32:01 +02:00
|
|
|
data->state.sessionage++; /* increase general age */
|
|
|
|
check->age = data->state.sessionage; /* set this as used in this age */
|
2001-08-28 10:37:54 +02:00
|
|
|
*ssl_sessionid = check->sessionid;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
*ssl_sessionid = (SSL_SESSION *)NULL;
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Kill a single session ID entry in the cache.
|
|
|
|
*/
|
|
|
|
static int Kill_Single_Session(struct curl_ssl_session *session)
|
|
|
|
{
|
|
|
|
if(session->sessionid) {
|
|
|
|
/* defensive check */
|
|
|
|
|
|
|
|
/* free the ID */
|
|
|
|
SSL_SESSION_free(session->sessionid);
|
|
|
|
session->sessionid=NULL;
|
|
|
|
session->age = 0; /* fresh */
|
2003-03-31 07:13:26 +02:00
|
|
|
|
|
|
|
Curl_free_ssl_config(&session->ssl_config);
|
|
|
|
|
2004-05-13 17:19:02 +02:00
|
|
|
Curl_safefree(session->name);
|
2001-08-28 10:37:54 +02:00
|
|
|
session->name = NULL; /* no name */
|
|
|
|
|
|
|
|
return 0; /* ok */
|
|
|
|
}
|
|
|
|
else
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This function is called when the 'data' struct is going away. Close
|
|
|
|
* down everything and free all resources!
|
|
|
|
*/
|
2001-08-31 00:48:34 +02:00
|
|
|
int Curl_SSL_Close_All(struct SessionHandle *data)
|
2001-08-28 10:37:54 +02:00
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
2004-05-18 09:25:13 +02:00
|
|
|
if(data->state.session) {
|
2001-09-06 08:26:24 +02:00
|
|
|
for(i=0; i< data->set.ssl.numsessions; i++)
|
|
|
|
/* the single-killer function handles empty table slots */
|
2001-09-06 10:32:01 +02:00
|
|
|
Kill_Single_Session(&data->state.session[i]);
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2001-09-06 08:26:24 +02:00
|
|
|
/* free the cache data */
|
2001-09-06 10:32:01 +02:00
|
|
|
free(data->state.session);
|
2001-09-06 08:26:24 +02:00
|
|
|
}
|
2001-12-18 00:01:39 +01:00
|
|
|
#ifdef HAVE_OPENSSL_ENGINE_H
|
2003-10-07 23:46:47 +02:00
|
|
|
if(data->engine)
|
2001-12-18 00:01:39 +01:00
|
|
|
{
|
|
|
|
ENGINE_free(data->engine);
|
|
|
|
data->engine = NULL;
|
|
|
|
}
|
|
|
|
#endif
|
2001-08-28 10:37:54 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Extract the session id and store it in the session cache.
|
|
|
|
*/
|
2003-11-24 08:15:37 +01:00
|
|
|
static int Store_SSL_Session(struct connectdata *conn,
|
|
|
|
struct ssl_connect_data *ssl)
|
2001-08-28 10:37:54 +02:00
|
|
|
{
|
|
|
|
SSL_SESSION *ssl_sessionid;
|
|
|
|
int i;
|
2001-08-31 00:48:34 +02:00
|
|
|
struct SessionHandle *data=conn->data; /* the mother of all structs */
|
2002-01-09 10:38:37 +01:00
|
|
|
struct curl_ssl_session *store = &data->state.session[0];
|
2001-09-06 10:32:01 +02:00
|
|
|
int oldest_age=data->state.session[0].age; /* zero if unused */
|
2004-05-13 17:19:02 +02:00
|
|
|
char *clone_host;
|
|
|
|
|
|
|
|
clone_host = strdup(conn->host.name);
|
|
|
|
if(!clone_host)
|
|
|
|
return -1; /* bail out */
|
2001-08-28 10:37:54 +02:00
|
|
|
|
|
|
|
/* ask OpenSSL, say please */
|
2002-01-17 11:40:13 +01:00
|
|
|
|
|
|
|
#ifdef HAVE_SSL_GET1_SESSION
|
2003-11-24 08:15:37 +01:00
|
|
|
ssl_sessionid = SSL_get1_session(ssl->handle);
|
2001-08-28 10:37:54 +02:00
|
|
|
|
|
|
|
/* SSL_get1_session() will increment the reference
|
|
|
|
count and the session will stay in memory until explicitly freed with
|
2004-05-18 09:25:13 +02:00
|
|
|
SSL_SESSION_free(3), regardless of its state.
|
2002-01-17 11:40:13 +01:00
|
|
|
This function was introduced in openssl 0.9.5a. */
|
|
|
|
#else
|
2003-11-24 08:15:37 +01:00
|
|
|
ssl_sessionid = SSL_get_session(ssl->handle);
|
2002-01-17 11:40:13 +01:00
|
|
|
|
|
|
|
/* if SSL_get1_session() is unavailable, use SSL_get_session().
|
|
|
|
This is an inferior option because the session can be flushed
|
|
|
|
at any time by openssl. It is included only so curl compiles
|
|
|
|
under versions of openssl < 0.9.5a.
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2002-01-17 11:40:13 +01:00
|
|
|
WARNING: How curl behaves if it's session is flushed is
|
2004-05-18 09:25:13 +02:00
|
|
|
untested.
|
2002-01-17 11:40:13 +01:00
|
|
|
*/
|
|
|
|
#endif
|
2001-08-28 10:37:54 +02:00
|
|
|
|
|
|
|
/* Now we should add the session ID and the host name to the cache, (remove
|
|
|
|
the oldest if necessary) */
|
|
|
|
|
|
|
|
/* find an empty slot for us, or find the oldest */
|
2002-01-09 10:38:37 +01:00
|
|
|
for(i=1; (i<data->set.ssl.numsessions) &&
|
|
|
|
data->state.session[i].sessionid; i++) {
|
2001-09-06 10:32:01 +02:00
|
|
|
if(data->state.session[i].age < oldest_age) {
|
|
|
|
oldest_age = data->state.session[i].age;
|
|
|
|
store = &data->state.session[i];
|
2001-08-28 10:37:54 +02:00
|
|
|
}
|
|
|
|
}
|
2001-08-31 00:48:34 +02:00
|
|
|
if(i == data->set.ssl.numsessions)
|
2001-08-28 10:37:54 +02:00
|
|
|
/* cache is full, we must "kill" the oldest entry! */
|
|
|
|
Kill_Single_Session(store);
|
|
|
|
else
|
2001-09-06 10:32:01 +02:00
|
|
|
store = &data->state.session[i]; /* use this slot */
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2001-08-28 10:37:54 +02:00
|
|
|
/* now init the session struct wisely */
|
|
|
|
store->sessionid = ssl_sessionid;
|
2003-11-24 08:15:37 +01:00
|
|
|
store->age = data->state.sessionage; /* set current age */
|
2004-05-13 17:19:02 +02:00
|
|
|
store->name = clone_host; /* clone host name */
|
2001-08-29 11:36:41 +02:00
|
|
|
store->remote_port = conn->remote_port; /* port number */
|
2001-08-28 10:37:54 +02:00
|
|
|
|
2003-03-31 07:13:26 +02:00
|
|
|
Curl_clone_ssl_config(&conn->ssl_config, &store->ssl_config);
|
|
|
|
|
2001-08-28 10:37:54 +02:00
|
|
|
return 0;
|
|
|
|
}
|
2001-05-28 16:12:43 +02:00
|
|
|
|
2001-09-11 12:00:49 +02:00
|
|
|
static int Curl_ASN1_UTCTIME_output(struct connectdata *conn,
|
|
|
|
const char *prefix,
|
|
|
|
ASN1_UTCTIME *tm)
|
|
|
|
{
|
|
|
|
char *asn1_string;
|
|
|
|
int gmt=FALSE;
|
|
|
|
int i;
|
|
|
|
int year=0,month=0,day=0,hour=0,minute=0,second=0;
|
|
|
|
struct SessionHandle *data = conn->data;
|
|
|
|
|
|
|
|
if(!data->set.verbose)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
i=tm->length;
|
|
|
|
asn1_string=(char *)tm->data;
|
|
|
|
|
2003-10-07 23:46:47 +02:00
|
|
|
if(i < 10)
|
2001-09-11 12:00:49 +02:00
|
|
|
return 1;
|
2003-10-07 23:46:47 +02:00
|
|
|
if(asn1_string[i-1] == 'Z')
|
2001-09-11 12:00:49 +02:00
|
|
|
gmt=TRUE;
|
|
|
|
for (i=0; i<10; i++)
|
2003-10-07 23:46:47 +02:00
|
|
|
if((asn1_string[i] > '9') || (asn1_string[i] < '0'))
|
2001-09-11 12:00:49 +02:00
|
|
|
return 2;
|
|
|
|
|
|
|
|
year= (asn1_string[0]-'0')*10+(asn1_string[1]-'0');
|
2003-10-07 23:46:47 +02:00
|
|
|
if(year < 50)
|
2001-09-11 12:00:49 +02:00
|
|
|
year+=100;
|
|
|
|
|
|
|
|
month= (asn1_string[2]-'0')*10+(asn1_string[3]-'0');
|
2003-10-07 23:46:47 +02:00
|
|
|
if((month > 12) || (month < 1))
|
2001-09-11 12:00:49 +02:00
|
|
|
return 3;
|
|
|
|
|
|
|
|
day= (asn1_string[4]-'0')*10+(asn1_string[5]-'0');
|
|
|
|
hour= (asn1_string[6]-'0')*10+(asn1_string[7]-'0');
|
|
|
|
minute= (asn1_string[8]-'0')*10+(asn1_string[9]-'0');
|
|
|
|
|
2003-10-07 23:46:47 +02:00
|
|
|
if((asn1_string[10] >= '0') && (asn1_string[10] <= '9') &&
|
|
|
|
(asn1_string[11] >= '0') && (asn1_string[11] <= '9'))
|
2001-09-11 12:00:49 +02:00
|
|
|
second= (asn1_string[10]-'0')*10+(asn1_string[11]-'0');
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2001-09-11 12:00:49 +02:00
|
|
|
infof(data,
|
|
|
|
"%s%04d-%02d-%02d %02d:%02d:%02d %s\n",
|
|
|
|
prefix, year+1900, month, day, hour, minute, second, (gmt?"GMT":""));
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2004-05-18 09:25:13 +02:00
|
|
|
#endif
|
2001-09-07 11:40:46 +02:00
|
|
|
|
2003-01-07 17:33:11 +01:00
|
|
|
/* ====================================================== */
|
2003-05-01 15:37:36 +02:00
|
|
|
#ifdef USE_SSLEAY
|
2003-01-07 17:33:11 +01:00
|
|
|
static int
|
|
|
|
cert_hostcheck(const char *certname, const char *hostname)
|
|
|
|
{
|
|
|
|
char *tmp;
|
|
|
|
const char *certdomain;
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-01-07 17:33:11 +01:00
|
|
|
if(!certname ||
|
|
|
|
strlen(certname)<3 ||
|
|
|
|
!hostname ||
|
|
|
|
!strlen(hostname)) /* sanity check */
|
|
|
|
return 0;
|
|
|
|
|
2003-02-28 13:20:08 +01:00
|
|
|
if(curl_strequal(certname, hostname)) /* trivial case */
|
2003-01-07 17:33:11 +01:00
|
|
|
return 1;
|
|
|
|
|
|
|
|
certdomain = certname + 1;
|
|
|
|
|
|
|
|
if((certname[0] != '*') || (certdomain[0] != '.'))
|
|
|
|
return 0; /* not a wildcard certificate, check failed */
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-01-07 17:33:11 +01:00
|
|
|
if(!strchr(certdomain+1, '.'))
|
|
|
|
return 0; /* the certificate must have at least another dot in its name */
|
|
|
|
|
|
|
|
/* find 'certdomain' within 'hostname' */
|
|
|
|
tmp = strstr(hostname, certdomain);
|
|
|
|
if(tmp) {
|
|
|
|
/* ok the certname's domain matches the hostname, let's check that it's a
|
|
|
|
tail-match */
|
2003-02-28 13:20:08 +01:00
|
|
|
if(curl_strequal(tmp, certdomain))
|
2003-01-07 17:33:11 +01:00
|
|
|
/* looks like a match. Just check we havent swallowed a '.' */
|
|
|
|
return tmp == strchr(hostname, '.');
|
|
|
|
else
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2003-10-16 15:44:34 +02:00
|
|
|
/* Quote from RFC2818 section 3.1 "Server Identity"
|
|
|
|
|
|
|
|
If a subjectAltName extension of type dNSName is present, that MUST
|
|
|
|
be used as the identity. Otherwise, the (most specific) Common Name
|
|
|
|
field in the Subject field of the certificate MUST be used. Although
|
|
|
|
the use of the Common Name is existing practice, it is deprecated and
|
|
|
|
Certification Authorities are encouraged to use the dNSName instead.
|
|
|
|
|
|
|
|
Matching is performed using the matching rules specified by
|
|
|
|
[RFC2459]. If more than one identity of a given type is present in
|
|
|
|
the certificate (e.g., more than one dNSName name, a match in any one
|
|
|
|
of the set is considered acceptable.) Names may contain the wildcard
|
|
|
|
character * which is considered to match any single domain name
|
|
|
|
component or component fragment. E.g., *.a.com matches foo.a.com but
|
|
|
|
not bar.foo.a.com. f*.com matches foo.com but not bar.com.
|
|
|
|
|
|
|
|
In some cases, the URI is specified as an IP address rather than a
|
|
|
|
hostname. In this case, the iPAddress subjectAltName must be present
|
|
|
|
in the certificate and must exactly match the IP in the URI.
|
2003-10-15 16:42:11 +02:00
|
|
|
|
|
|
|
*/
|
2003-11-24 08:15:37 +01:00
|
|
|
static CURLcode verifyhost(struct connectdata *conn,
|
|
|
|
X509 *server_cert)
|
2003-10-07 23:46:47 +02:00
|
|
|
{
|
2003-10-16 15:44:34 +02:00
|
|
|
bool matched = FALSE; /* no alternative match yet */
|
|
|
|
int target = GEN_DNS; /* target type, GEN_DNS or GEN_IPADD */
|
2004-01-16 10:17:04 +01:00
|
|
|
int addrlen = 0;
|
2003-10-16 15:44:34 +02:00
|
|
|
struct SessionHandle *data = conn->data;
|
|
|
|
STACK_OF(GENERAL_NAME) *altnames;
|
2003-10-07 23:46:47 +02:00
|
|
|
#ifdef ENABLE_IPV6
|
|
|
|
struct in6_addr addr;
|
|
|
|
#else
|
|
|
|
struct in_addr addr;
|
|
|
|
#endif
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-10-07 23:46:47 +02:00
|
|
|
#ifdef ENABLE_IPV6
|
2004-05-18 09:25:13 +02:00
|
|
|
if(conn->bits.ipv6_ip &&
|
2004-04-27 15:56:23 +02:00
|
|
|
Curl_inet_pton(AF_INET6, conn->host.name, &addr)) {
|
2003-10-16 15:44:34 +02:00
|
|
|
target = GEN_IPADD;
|
|
|
|
addrlen = sizeof(struct in6_addr);
|
2003-10-07 23:46:47 +02:00
|
|
|
}
|
|
|
|
else
|
|
|
|
#endif
|
2004-04-27 15:56:23 +02:00
|
|
|
if(Curl_inet_pton(AF_INET, conn->host.name, &addr)) {
|
2003-10-16 15:44:34 +02:00
|
|
|
target = GEN_IPADD;
|
|
|
|
addrlen = sizeof(struct in_addr);
|
2003-10-07 23:46:47 +02:00
|
|
|
}
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-10-16 15:44:34 +02:00
|
|
|
/* get a "list" of alternative names */
|
2003-11-24 08:15:37 +01:00
|
|
|
altnames = X509_get_ext_d2i(server_cert, NID_subject_alt_name, NULL, NULL);
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-10-16 15:44:34 +02:00
|
|
|
if(altnames) {
|
2004-01-16 10:17:04 +01:00
|
|
|
int hostlen = 0;
|
|
|
|
int domainlen = 0;
|
|
|
|
char *domain = NULL;
|
2003-10-16 15:44:34 +02:00
|
|
|
int numalts;
|
|
|
|
int i;
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-10-16 15:44:34 +02:00
|
|
|
if(GEN_DNS == target) {
|
2004-04-27 15:56:23 +02:00
|
|
|
hostlen = (int)strlen(conn->host.name);
|
|
|
|
domain = strchr(conn->host.name, '.');
|
2003-10-16 15:44:34 +02:00
|
|
|
if(domain)
|
2004-03-23 16:20:57 +01:00
|
|
|
domainlen = (int)strlen(domain);
|
2003-10-16 15:44:34 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* get amount of alternatives, RFC2459 claims there MUST be at least
|
|
|
|
one, but we don't depend on it... */
|
|
|
|
numalts = sk_GENERAL_NAME_num(altnames);
|
|
|
|
|
|
|
|
/* loop through all alternatives while none has matched */
|
|
|
|
for (i=0; (i<numalts) && !matched; i++) {
|
|
|
|
/* get a handle to alternative name number i */
|
|
|
|
const GENERAL_NAME *check = sk_GENERAL_NAME_value(altnames, i);
|
|
|
|
|
|
|
|
/* only check alternatives of the same type the target is */
|
|
|
|
if(check->type == target) {
|
|
|
|
/* get data and length */
|
|
|
|
const char *altptr = (char *)ASN1_STRING_data(check->d.ia5);
|
|
|
|
const int altlen = ASN1_STRING_length(check->d.ia5);
|
|
|
|
|
|
|
|
switch(target) {
|
|
|
|
case GEN_DNS: /* name comparison */
|
2003-10-07 23:46:47 +02:00
|
|
|
/* Is this an exact match? */
|
2003-10-16 15:44:34 +02:00
|
|
|
if((hostlen == altlen) &&
|
2004-04-27 15:56:23 +02:00
|
|
|
curl_strnequal(conn->host.name, altptr, hostlen))
|
2003-10-16 15:44:34 +02:00
|
|
|
matched = TRUE;
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-10-07 23:46:47 +02:00
|
|
|
/* Is this a wildcard match? */
|
2003-10-16 15:44:34 +02:00
|
|
|
else if((altptr[0] == '*') &&
|
|
|
|
(domainlen == altlen-1) &&
|
|
|
|
curl_strnequal(domain, altptr+1, domainlen))
|
|
|
|
matched = TRUE;
|
|
|
|
break;
|
2004-05-18 09:25:13 +02:00
|
|
|
|
|
|
|
case GEN_IPADD: /* IP address comparison */
|
2003-10-16 15:44:34 +02:00
|
|
|
/* compare alternative IP address if the data chunk is the same size
|
|
|
|
our server IP address is */
|
|
|
|
if((altlen == addrlen) && !memcmp(altptr, &addr, altlen))
|
|
|
|
matched = TRUE;
|
|
|
|
break;
|
2003-10-07 23:46:47 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2003-10-16 15:44:34 +02:00
|
|
|
GENERAL_NAMES_free(altnames);
|
2003-10-07 23:46:47 +02:00
|
|
|
}
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-10-16 15:44:34 +02:00
|
|
|
if(matched)
|
|
|
|
/* an alternative name matched the server hostname */
|
2004-05-18 00:01:16 +02:00
|
|
|
infof(data, "\t subjectAltName: %s matched\n", conn->host.dispname);
|
2003-10-16 15:44:34 +02:00
|
|
|
else {
|
2004-05-18 00:01:16 +02:00
|
|
|
/* we have to look to the last occurence of a commonName in the
|
|
|
|
distinguished one to get the most significant one. */
|
|
|
|
int j,i=-1 ;
|
|
|
|
|
|
|
|
/* The following is done because of a bug in 0.9.6b */
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2004-05-18 00:01:16 +02:00
|
|
|
unsigned char *nulstr = (unsigned char *)"";
|
|
|
|
unsigned char *peer_CN = nulstr;
|
|
|
|
|
2004-05-18 09:25:13 +02:00
|
|
|
X509_NAME *name = X509_get_subject_name(server_cert) ;
|
|
|
|
if (name)
|
|
|
|
while ((j=X509_NAME_get_index_by_NID(name,NID_commonName,i))>=0)
|
|
|
|
i=j;
|
2004-05-18 00:01:16 +02:00
|
|
|
|
|
|
|
/* we have the name entry and we will now convert this to a string
|
|
|
|
that we can use for comparison. Doing this we support BMPstring,
|
|
|
|
UTF8 etc. */
|
|
|
|
|
|
|
|
if (i>=0) {
|
|
|
|
j = ASN1_STRING_to_UTF8(&peer_CN,
|
|
|
|
X509_NAME_ENTRY_get_data(
|
|
|
|
X509_NAME_get_entry(name,i)));
|
|
|
|
}
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2004-05-18 00:01:16 +02:00
|
|
|
if (peer_CN == nulstr)
|
|
|
|
peer_CN = NULL;
|
|
|
|
|
|
|
|
if (!peer_CN) {
|
2003-10-07 23:46:47 +02:00
|
|
|
if(data->set.ssl.verifyhost > 1) {
|
|
|
|
failf(data,
|
|
|
|
"SSL: unable to obtain common name from peer certificate");
|
|
|
|
return CURLE_SSL_PEER_CERTIFICATE;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
/* Consider verifyhost == 1 as an "OK" for a missing CN field, but we
|
|
|
|
output a note about the situation */
|
|
|
|
infof(data, "\t common name: WARNING couldn't obtain\n");
|
|
|
|
}
|
|
|
|
}
|
2004-05-18 00:01:16 +02:00
|
|
|
else if(!cert_hostcheck((const char *)peer_CN, conn->host.name)) {
|
|
|
|
if(data->set.ssl.verifyhost > 1) {
|
|
|
|
failf(data, "SSL: certificate subject name '%s' does not match "
|
|
|
|
"target host name '%s'", peer_CN, conn->host.dispname);
|
|
|
|
OPENSSL_free(peer_CN);
|
|
|
|
return CURLE_SSL_PEER_CERTIFICATE ;
|
2003-10-07 23:46:47 +02:00
|
|
|
}
|
|
|
|
else
|
2004-05-18 00:01:16 +02:00
|
|
|
infof(data, "\t common name: %s (does not match '%s')\n",
|
|
|
|
peer_CN, conn->host.dispname);
|
2003-10-07 23:46:47 +02:00
|
|
|
}
|
2004-05-18 00:01:16 +02:00
|
|
|
else {
|
|
|
|
infof(data, "\t common name: %s (matched)\n", peer_CN);
|
|
|
|
OPENSSL_free(peer_CN);
|
|
|
|
}
|
2004-05-18 09:25:13 +02:00
|
|
|
}
|
2003-10-07 23:46:47 +02:00
|
|
|
return CURLE_OK;
|
|
|
|
}
|
2003-10-08 15:06:50 +02:00
|
|
|
#endif
|
2003-10-07 23:46:47 +02:00
|
|
|
|
1999-12-29 15:20:26 +01:00
|
|
|
/* ====================================================== */
|
2001-05-12 11:29:56 +02:00
|
|
|
CURLcode
|
2003-11-24 08:15:37 +01:00
|
|
|
Curl_SSLConnect(struct connectdata *conn,
|
|
|
|
int sockindex)
|
1999-12-29 15:20:26 +01:00
|
|
|
{
|
2001-05-12 11:29:56 +02:00
|
|
|
CURLcode retcode = CURLE_OK;
|
|
|
|
|
1999-12-29 15:20:26 +01:00
|
|
|
#ifdef USE_SSLEAY
|
2001-08-31 00:48:34 +02:00
|
|
|
struct SessionHandle *data = conn->data;
|
2001-02-20 18:35:51 +01:00
|
|
|
int err;
|
2003-02-05 08:43:05 +01:00
|
|
|
int what;
|
2001-02-20 18:35:51 +01:00
|
|
|
char * str;
|
|
|
|
SSL_METHOD *req_method;
|
2001-08-28 10:37:54 +02:00
|
|
|
SSL_SESSION *ssl_sessionid=NULL;
|
2001-09-11 12:00:49 +02:00
|
|
|
ASN1_TIME *certdate;
|
2004-03-09 23:52:50 +01:00
|
|
|
curl_socket_t sockfd = conn->sock[sockindex];
|
2003-11-24 08:15:37 +01:00
|
|
|
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2001-02-20 18:35:51 +01:00
|
|
|
/* mark this is being ssl enabled from here on out. */
|
2003-11-24 08:15:37 +01:00
|
|
|
connssl->use = TRUE;
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2002-01-30 09:17:23 +01:00
|
|
|
if(!ssl_seeded || data->set.ssl.random_file || data->set.ssl.egdsocket) {
|
2002-01-29 15:11:38 +01:00
|
|
|
/* Make funny stuff to get random input */
|
|
|
|
random_the_seed(data);
|
|
|
|
|
|
|
|
ssl_seeded = TRUE;
|
|
|
|
}
|
2001-11-05 15:06:42 +01:00
|
|
|
|
|
|
|
/* check to see if we've been told to use an explicit SSL/TLS version */
|
2001-08-31 00:48:34 +02:00
|
|
|
switch(data->set.ssl.version) {
|
2001-02-20 18:35:51 +01:00
|
|
|
default:
|
2001-11-05 15:06:42 +01:00
|
|
|
case CURL_SSLVERSION_DEFAULT:
|
|
|
|
/* we try to figure out version */
|
2001-02-20 18:35:51 +01:00
|
|
|
req_method = SSLv23_client_method();
|
|
|
|
break;
|
2001-11-05 15:06:42 +01:00
|
|
|
case CURL_SSLVERSION_TLSv1:
|
|
|
|
req_method = TLSv1_client_method();
|
|
|
|
break;
|
|
|
|
case CURL_SSLVERSION_SSLv2:
|
2001-02-20 18:35:51 +01:00
|
|
|
req_method = SSLv2_client_method();
|
|
|
|
break;
|
2001-11-05 15:06:42 +01:00
|
|
|
case CURL_SSLVERSION_SSLv3:
|
2001-02-20 18:35:51 +01:00
|
|
|
req_method = SSLv3_client_method();
|
|
|
|
break;
|
|
|
|
}
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
connssl->ctx = SSL_CTX_new(req_method);
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
if(!connssl->ctx) {
|
2001-02-20 18:35:51 +01:00
|
|
|
failf(data, "SSL: couldn't create a context!");
|
2001-05-12 11:29:56 +02:00
|
|
|
return CURLE_OUT_OF_MEMORY;
|
2001-02-20 18:35:51 +01:00
|
|
|
}
|
2003-06-02 15:27:03 +02:00
|
|
|
|
|
|
|
/* OpenSSL contains code to work-around lots of bugs and flaws in various
|
|
|
|
SSL-implementations. SSL_CTX_set_options() is used to enabled those
|
|
|
|
work-arounds. The man page for this option states that SSL_OP_ALL enables
|
|
|
|
ll the work-arounds and that "It is usually safe to use SSL_OP_ALL to
|
|
|
|
enable the bug workaround options if compatibility with somewhat broken
|
|
|
|
implementations is desired."
|
|
|
|
|
|
|
|
*/
|
2003-11-24 08:15:37 +01:00
|
|
|
SSL_CTX_set_options(connssl->ctx, SSL_OP_ALL);
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2001-08-31 00:48:34 +02:00
|
|
|
if(data->set.cert) {
|
2003-10-07 23:46:47 +02:00
|
|
|
if(!cert_stuff(conn,
|
2003-11-24 08:15:37 +01:00
|
|
|
connssl->ctx,
|
2003-10-07 23:46:47 +02:00
|
|
|
data->set.cert,
|
|
|
|
data->set.cert_type,
|
|
|
|
data->set.key,
|
|
|
|
data->set.key_type)) {
|
2001-06-12 20:22:52 +02:00
|
|
|
/* failf() is already done in cert_stuff() */
|
2002-08-30 13:09:49 +02:00
|
|
|
return CURLE_SSL_CERTPROBLEM;
|
1999-12-29 15:20:26 +01:00
|
|
|
}
|
2001-02-20 18:35:51 +01:00
|
|
|
}
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2001-09-12 00:21:02 +02:00
|
|
|
if(data->set.ssl.cipher_list) {
|
2003-11-24 08:15:37 +01:00
|
|
|
if(!SSL_CTX_set_cipher_list(connssl->ctx,
|
2003-10-07 23:46:47 +02:00
|
|
|
data->set.ssl.cipher_list)) {
|
2001-12-11 14:13:01 +01:00
|
|
|
failf(data, "failed setting cipher list");
|
2002-08-30 13:09:49 +02:00
|
|
|
return CURLE_SSL_CIPHER;
|
2001-09-12 00:21:02 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2003-10-23 09:44:55 +02:00
|
|
|
if (data->set.ssl.CAfile || data->set.ssl.CApath) {
|
|
|
|
/* tell SSL where to find CA certificates that are used to verify
|
|
|
|
the servers certificate. */
|
2003-11-24 08:15:37 +01:00
|
|
|
if (!SSL_CTX_load_verify_locations(connssl->ctx, data->set.ssl.CAfile,
|
2003-10-23 09:44:55 +02:00
|
|
|
data->set.ssl.CApath)) {
|
|
|
|
if (data->set.ssl.verifypeer) {
|
|
|
|
/* Fail if we insist on successfully verifying the server. */
|
|
|
|
failf(data,"error setting certificate verify locations:\n"
|
|
|
|
" CAfile: %s\n CApath: %s\n",
|
|
|
|
data->set.ssl.CAfile ? data->set.ssl.CAfile : "none",
|
|
|
|
data->set.ssl.CApath ? data->set.ssl.CApath : "none");
|
|
|
|
return CURLE_SSL_CACERT;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
/* Just continue with a warning if no strict certificate verification
|
|
|
|
is required. */
|
2003-11-24 08:15:37 +01:00
|
|
|
infof(data, "error setting certificate verify locations,"
|
2003-10-23 09:44:55 +02:00
|
|
|
" continuing anyway:\n");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
/* Everything is fine. */
|
2003-11-24 08:15:37 +01:00
|
|
|
infof(data, "successfully set certificate verify locations:\n");
|
2000-10-30 12:53:40 +01:00
|
|
|
}
|
2003-11-24 08:15:37 +01:00
|
|
|
infof(data,
|
|
|
|
" CAfile: %s\n"
|
|
|
|
" CApath: %s\n",
|
|
|
|
data->set.ssl.CAfile ? data->set.ssl.CAfile : "none",
|
|
|
|
data->set.ssl.CApath ? data->set.ssl.CApath : "none");
|
2001-02-20 18:35:51 +01:00
|
|
|
}
|
2003-10-23 09:44:55 +02:00
|
|
|
/* SSL always tries to verify the peer, this only says whether it should
|
|
|
|
* fail to connect if the verification fails, or if it should continue
|
|
|
|
* anyway. In the latter case the result of the verification is checked with
|
|
|
|
* SSL_get_verify_result() below. */
|
2003-11-24 08:15:37 +01:00
|
|
|
SSL_CTX_set_verify(connssl->ctx,
|
2003-10-23 09:44:55 +02:00
|
|
|
data->set.ssl.verifypeer?SSL_VERIFY_PEER:SSL_VERIFY_NONE,
|
|
|
|
cert_verify_callback);
|
2000-10-30 12:53:40 +01:00
|
|
|
|
2003-07-04 18:29:23 +02:00
|
|
|
/* give application a chance to interfere with SSL set up. */
|
2003-10-07 23:46:47 +02:00
|
|
|
if(data->set.ssl.fsslctx) {
|
2003-11-24 08:15:37 +01:00
|
|
|
retcode = (*data->set.ssl.fsslctx)(data, connssl->ctx,
|
2003-07-05 15:27:02 +02:00
|
|
|
data->set.ssl.fsslctxp);
|
2003-10-07 23:46:47 +02:00
|
|
|
if(retcode) {
|
2003-07-04 18:29:23 +02:00
|
|
|
failf(data,"error signaled by ssl ctx callback");
|
2003-07-05 15:27:02 +02:00
|
|
|
return retcode;
|
2003-07-04 18:29:23 +02:00
|
|
|
}
|
|
|
|
}
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2001-02-20 18:35:51 +01:00
|
|
|
/* Lets make an SSL structure */
|
2003-11-24 08:15:37 +01:00
|
|
|
connssl->handle = SSL_new(connssl->ctx);
|
|
|
|
SSL_set_connect_state(connssl->handle);
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
connssl->server_cert = 0x0;
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2001-08-28 10:37:54 +02:00
|
|
|
if(!conn->bits.reuse) {
|
|
|
|
/* We're not re-using a connection, check if there's a cached ID we
|
|
|
|
can/should use here! */
|
|
|
|
if(!Get_SSL_Session(conn, &ssl_sessionid)) {
|
|
|
|
/* we got a session id, use it! */
|
2003-11-24 08:15:37 +01:00
|
|
|
SSL_set_session(connssl->handle, ssl_sessionid);
|
2001-08-28 10:37:54 +02:00
|
|
|
/* Informational message */
|
|
|
|
infof (data, "SSL re-using session ID\n");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2001-02-20 18:35:51 +01:00
|
|
|
/* pass the raw socket into the SSL layers */
|
2003-11-24 08:15:37 +01:00
|
|
|
SSL_set_fd(connssl->handle, sockfd);
|
2002-01-07 19:38:01 +01:00
|
|
|
|
2004-01-29 14:56:45 +01:00
|
|
|
while(1) {
|
2002-01-07 19:38:01 +01:00
|
|
|
fd_set writefd;
|
|
|
|
fd_set readfd;
|
|
|
|
struct timeval interval;
|
|
|
|
long timeout_ms;
|
|
|
|
|
|
|
|
/* Find out if any timeout is set. If not, use 300 seconds.
|
|
|
|
Otherwise, figure out the most strict timeout of the two possible one
|
|
|
|
and then how much time that has elapsed to know how much time we
|
|
|
|
allow for the connect call */
|
|
|
|
if(data->set.timeout || data->set.connecttimeout) {
|
2004-03-23 16:20:57 +01:00
|
|
|
long has_passed;
|
2002-01-07 19:38:01 +01:00
|
|
|
|
|
|
|
/* Evaluate in milliseconds how much time that has passed */
|
|
|
|
has_passed = Curl_tvdiff(Curl_tvnow(), data->progress.start);
|
|
|
|
|
|
|
|
#ifndef min
|
|
|
|
#define min(a, b) ((a) < (b) ? (a) : (b))
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/* get the most strict timeout of the ones converted to milliseconds */
|
|
|
|
if(data->set.timeout &&
|
|
|
|
(data->set.timeout>data->set.connecttimeout))
|
|
|
|
timeout_ms = data->set.timeout*1000;
|
|
|
|
else
|
|
|
|
timeout_ms = data->set.connecttimeout*1000;
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2002-01-07 19:38:01 +01:00
|
|
|
/* subtract the passed time */
|
2004-03-23 16:20:57 +01:00
|
|
|
timeout_ms -= has_passed;
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2002-01-09 00:23:24 +01:00
|
|
|
if(timeout_ms < 0) {
|
2002-01-07 19:38:01 +01:00
|
|
|
/* a precaution, no need to continue if time already is up */
|
2002-01-09 00:23:24 +01:00
|
|
|
failf(data, "SSL connection timeout");
|
|
|
|
return CURLE_OPERATION_TIMEOUTED;
|
|
|
|
}
|
2002-01-07 19:38:01 +01:00
|
|
|
}
|
|
|
|
else
|
|
|
|
/* no particular time-out has been set */
|
|
|
|
timeout_ms=300000; /* milliseconds, default to five minutes */
|
|
|
|
|
2003-02-05 08:43:05 +01:00
|
|
|
|
|
|
|
FD_ZERO(&writefd);
|
|
|
|
FD_ZERO(&readfd);
|
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
err = SSL_connect(connssl->handle);
|
2003-02-05 08:43:05 +01:00
|
|
|
|
|
|
|
/* 1 is fine
|
|
|
|
0 is "not successful but was shut down controlled"
|
|
|
|
<0 is "handshake was not successful, because a fatal error occurred" */
|
|
|
|
if(1 != err) {
|
2003-11-24 08:15:37 +01:00
|
|
|
int detail = SSL_get_error(connssl->handle, err);
|
2003-02-05 08:43:05 +01:00
|
|
|
|
|
|
|
if(SSL_ERROR_WANT_READ == detail)
|
2003-11-24 08:15:37 +01:00
|
|
|
FD_SET(sockfd, &readfd);
|
2003-02-05 08:43:05 +01:00
|
|
|
else if(SSL_ERROR_WANT_WRITE == detail)
|
2003-11-24 08:15:37 +01:00
|
|
|
FD_SET(sockfd, &writefd);
|
2003-02-05 08:43:05 +01:00
|
|
|
else {
|
|
|
|
/* untreated error */
|
2004-03-23 16:20:57 +01:00
|
|
|
unsigned long errdetail;
|
2003-02-05 08:43:05 +01:00
|
|
|
char error_buffer[120]; /* OpenSSL documents that this must be at least
|
|
|
|
120 bytes long. */
|
2003-04-14 14:53:29 +02:00
|
|
|
|
2004-03-23 16:20:57 +01:00
|
|
|
errdetail = ERR_get_error(); /* Gets the earliest error code from the
|
|
|
|
thread's error queue and removes the
|
|
|
|
entry. */
|
2003-04-14 14:53:29 +02:00
|
|
|
|
2004-03-23 16:20:57 +01:00
|
|
|
switch(errdetail) {
|
2003-04-15 00:00:36 +02:00
|
|
|
case 0x1407E086:
|
|
|
|
/* 1407E086:
|
|
|
|
SSL routines:
|
|
|
|
SSL2_SET_CERTIFICATE:
|
|
|
|
certificate verify failed */
|
|
|
|
case 0x14090086:
|
2003-04-14 14:53:29 +02:00
|
|
|
/* 14090086:
|
|
|
|
SSL routines:
|
|
|
|
SSL3_GET_SERVER_CERTIFICATE:
|
|
|
|
certificate verify failed */
|
|
|
|
failf(data,
|
|
|
|
"SSL certificate problem, verify that the CA cert is OK");
|
|
|
|
return CURLE_SSL_CACERT;
|
2003-04-15 00:00:36 +02:00
|
|
|
default:
|
2003-04-14 14:53:29 +02:00
|
|
|
/* detail is already set to the SSL error above */
|
2004-04-29 09:36:40 +02:00
|
|
|
#ifdef HAVE_ERR_ERROR_STRING_N
|
2003-04-14 14:53:29 +02:00
|
|
|
/* OpenSSL 0.9.6 and later has a function named
|
2004-04-29 09:36:40 +02:00
|
|
|
ERRO_error_string_n() that takes the size of the buffer as a
|
|
|
|
third argument */
|
|
|
|
ERR_error_string_n(errdetail, error_buffer, sizeof(error_buffer));
|
|
|
|
#else
|
|
|
|
ERR_error_string(errdetail, error_buffer);
|
|
|
|
#endif
|
|
|
|
|
|
|
|
failf(data, "SSL: %s", error_buffer);
|
2003-04-14 14:53:29 +02:00
|
|
|
return CURLE_SSL_CONNECT_ERROR;
|
|
|
|
}
|
2003-02-05 08:43:05 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
else
|
|
|
|
/* we have been connected fine, get out of the connect loop */
|
|
|
|
break;
|
|
|
|
|
2002-01-07 19:38:01 +01:00
|
|
|
interval.tv_sec = timeout_ms/1000;
|
|
|
|
timeout_ms -= interval.tv_sec*1000;
|
|
|
|
|
|
|
|
interval.tv_usec = timeout_ms*1000;
|
|
|
|
|
2004-03-10 09:43:01 +01:00
|
|
|
while(1) {
|
|
|
|
what = select(sockfd+1, &readfd, &writefd, NULL, &interval);
|
|
|
|
if(what > 0)
|
|
|
|
/* reabable or writable, go loop in the outer loop */
|
|
|
|
break;
|
|
|
|
else if(0 == what) {
|
|
|
|
/* timeout */
|
|
|
|
failf(data, "SSL connection timeout");
|
|
|
|
return CURLE_OPERATION_TIMEDOUT;
|
|
|
|
}
|
|
|
|
else {
|
2004-03-11 13:57:04 +01:00
|
|
|
#if !defined(WIN32) && defined(EINTR)
|
2004-03-10 09:43:01 +01:00
|
|
|
/* For platforms without EINTR all errnos are bad */
|
|
|
|
if (errno == EINTR)
|
|
|
|
continue; /* retry the select() */
|
|
|
|
#endif
|
|
|
|
/* anything other than the unimportant EINTR is fatally bad */
|
|
|
|
failf(data, "select on SSL socket, errno: %d", Curl_ourerrno());
|
|
|
|
return CURLE_SSL_CONNECT_ERROR;
|
|
|
|
}
|
|
|
|
} /* while()-loop for the select() */
|
|
|
|
} /* while()-loop for the SSL_connect() */
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2001-02-20 18:35:51 +01:00
|
|
|
/* Informational message */
|
|
|
|
infof (data, "SSL connection using %s\n",
|
2003-11-24 08:15:37 +01:00
|
|
|
SSL_get_cipher(connssl->handle));
|
2001-08-28 10:37:54 +02:00
|
|
|
|
|
|
|
if(!ssl_sessionid) {
|
|
|
|
/* Since this is not a cached session ID, then we want to stach this one
|
|
|
|
in the cache! */
|
2003-11-24 08:15:37 +01:00
|
|
|
Store_SSL_Session(conn, connssl);
|
2001-08-28 10:37:54 +02:00
|
|
|
}
|
|
|
|
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2001-02-20 18:35:51 +01:00
|
|
|
/* Get server's certificate (note: beware of dynamic allocation) - opt */
|
|
|
|
/* major serious hack alert -- we should check certificates
|
|
|
|
* to authenticate the server; otherwise we risk man-in-the-middle
|
|
|
|
* attack
|
|
|
|
*/
|
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
connssl->server_cert = SSL_get_peer_certificate(connssl->handle);
|
|
|
|
if(!connssl->server_cert) {
|
2001-02-20 18:35:51 +01:00
|
|
|
failf(data, "SSL: couldn't get peer certificate!");
|
2001-05-12 11:29:56 +02:00
|
|
|
return CURLE_SSL_PEER_CERTIFICATE;
|
2001-02-20 18:35:51 +01:00
|
|
|
}
|
|
|
|
infof (data, "Server certificate:\n");
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
str = X509_NAME_oneline(X509_get_subject_name(connssl->server_cert),
|
2003-10-07 23:46:47 +02:00
|
|
|
NULL, 0);
|
2001-02-20 18:35:51 +01:00
|
|
|
if(!str) {
|
|
|
|
failf(data, "SSL: couldn't get X509-subject!");
|
2003-11-24 08:15:37 +01:00
|
|
|
X509_free(connssl->server_cert);
|
2001-05-12 11:29:56 +02:00
|
|
|
return CURLE_SSL_CONNECT_ERROR;
|
2001-02-20 18:35:51 +01:00
|
|
|
}
|
|
|
|
infof(data, "\t subject: %s\n", str);
|
|
|
|
CRYPTO_free(str);
|
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
certdate = X509_get_notBefore(connssl->server_cert);
|
2001-09-11 12:00:49 +02:00
|
|
|
Curl_ASN1_UTCTIME_output(conn, "\t start date: ", certdate);
|
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
certdate = X509_get_notAfter(connssl->server_cert);
|
2001-09-11 12:00:49 +02:00
|
|
|
Curl_ASN1_UTCTIME_output(conn, "\t expire date: ", certdate);
|
|
|
|
|
2003-10-07 23:46:47 +02:00
|
|
|
if(data->set.ssl.verifyhost) {
|
2003-11-24 08:15:37 +01:00
|
|
|
retcode = verifyhost(conn, connssl->server_cert);
|
2003-10-23 09:44:55 +02:00
|
|
|
if(retcode) {
|
2003-11-24 08:15:37 +01:00
|
|
|
X509_free(connssl->server_cert);
|
2003-10-07 23:46:47 +02:00
|
|
|
return retcode;
|
2003-10-23 09:44:55 +02:00
|
|
|
}
|
2001-08-08 09:16:47 +02:00
|
|
|
}
|
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
str = X509_NAME_oneline(X509_get_issuer_name(connssl->server_cert),
|
2003-10-07 23:46:47 +02:00
|
|
|
NULL, 0);
|
2001-02-20 18:35:51 +01:00
|
|
|
if(!str) {
|
|
|
|
failf(data, "SSL: couldn't get X509-issuer name!");
|
2003-10-23 09:44:55 +02:00
|
|
|
retcode = CURLE_SSL_CONNECT_ERROR;
|
2001-02-20 18:35:51 +01:00
|
|
|
}
|
2003-10-23 09:44:55 +02:00
|
|
|
else {
|
|
|
|
infof(data, "\t issuer: %s\n", str);
|
|
|
|
CRYPTO_free(str);
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2003-10-23 09:44:55 +02:00
|
|
|
/* We could do all sorts of certificate verification stuff here before
|
|
|
|
deallocating the certificate. */
|
2004-05-18 09:25:13 +02:00
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
data->set.ssl.certverifyresult=SSL_get_verify_result(connssl->handle);
|
2003-10-07 23:46:47 +02:00
|
|
|
if(data->set.ssl.certverifyresult != X509_V_OK) {
|
2003-10-23 09:44:55 +02:00
|
|
|
if(data->set.ssl.verifypeer) {
|
|
|
|
/* We probably never reach this, because SSL_connect() will fail
|
|
|
|
and we return earlyer if verifypeer is set? */
|
|
|
|
failf(data, "SSL certificate verify result: %d",
|
|
|
|
data->set.ssl.certverifyresult);
|
|
|
|
retcode = CURLE_SSL_PEER_CERTIFICATE;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
infof(data, "SSL certificate verify result: %d, continuing anyway.\n",
|
|
|
|
data->set.ssl.certverifyresult);
|
2001-08-08 09:16:47 +02:00
|
|
|
}
|
2003-10-23 09:44:55 +02:00
|
|
|
else
|
|
|
|
infof(data, "SSL certificate verify ok.\n");
|
2001-02-20 18:35:51 +01:00
|
|
|
}
|
1999-12-29 15:20:26 +01:00
|
|
|
|
2003-11-24 08:15:37 +01:00
|
|
|
X509_free(connssl->server_cert);
|
1999-12-29 15:20:26 +01:00
|
|
|
#else /* USE_SSLEAY */
|
2003-11-24 12:44:04 +01:00
|
|
|
(void)conn;
|
|
|
|
(void)sockindex;
|
1999-12-29 15:20:26 +01:00
|
|
|
#endif
|
2001-05-12 11:29:56 +02:00
|
|
|
return retcode;
|
1999-12-29 15:20:26 +01:00
|
|
|
}
|