Attachment #34182 for bug #60061

View | Details | Raw Unified | Return to bug 60061
Collapse All | Expand All

Lines 312-318 static apr_status_t ssl_cleanup_pre_conf Link Here

(-)apache2-2.4.23/modules/ssl/mod_ssl.c (+6 lines)
312	#if HAVE_ENGINE_LOAD_BUILTIN_ENGINES	312	#if HAVE_ENGINE_LOAD_BUILTIN_ENGINES
313	ENGINE_cleanup();	313	ENGINE_cleanup();
314	#endif	314	#endif
		315	#if OPENSSL_VERSION_NUMBER < 0x10100000L
315	ERR_remove_state(0);	316	ERR_remove_state(0);
		317	#endif
316		318
317	/* Don't call ERR_free_strings in earlier versions, ERR_load_*_strings only	319	/* Don't call ERR_free_strings in earlier versions, ERR_load_*_strings only
318	* actually loaded the error strings once per process due to static	320	* actually loaded the error strings once per process due to static
Lines 342-348 static int ssl_hook_pre_config(apr_pool_ Link Here
342	/* We must register the library in full, to ensure our configuration	344	/* We must register the library in full, to ensure our configuration
343	* code can successfully test the SSL environment.	345	* code can successfully test the SSL environment.
344	*/	346	*/
		347	#if OPENSSL_VERSION_NUMBER < 0x10100000L
345	CRYPTO_malloc_init();	348	CRYPTO_malloc_init();
		349	#endif
346	ERR_load_crypto_strings();	350	ERR_load_crypto_strings();
347	SSL_load_error_strings();	351	SSL_load_error_strings();
348	SSL_library_init();	352	SSL_library_init();
Lines 378-383 static int ssl_hook_pre_config(apr_pool_ Link Here
378	APR_LOCK_DEFAULT, 0);	382	APR_LOCK_DEFAULT, 0);
379	#endif	383	#endif
380		384
		385	ssl_engine_io_init();
		386
381	return OK;	387	return OK;
382	}	388	}
383		389

Lines 47-69 APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, Link Here

(-)apache2-2.4.23/modules/ssl/ssl_engine_init.c (-33 / +49 lines)
47	#define KEYTYPES "RSA or DSA"	47	#define KEYTYPES "RSA or DSA"
48	#endif	48	#endif
49		49
		50	#if OPENSSL_VERSION_NUMBER < 0x10100000L
		51	#define DH_bits(dh) BN_num_bits(dh->p)
		52	#endif
		53
50	/*	54	/*
51	* Grab well-defined DH parameters from OpenSSL, see the get_rfc*	55	* Grab well-defined DH parameters from OpenSSL, see the get_rfc*
52	* functions in <openssl/bn.h> for all available primes.	56	* functions in <openssl/bn.h> for all available primes.
53	*/	57	*/
54	static DH make_dh_params(BIGNUM (prime)(BIGNUM ), const char *gen)	58	static DH make_dh_params(BIGNUM (prime)(BIGNUM ), const char *gen)
55	{	59	{
56	DH *dh = DH_new();	60	DH *dh;
		61	BIGNUM p, g;
57		62
		63	p = prime(NULL);
		64	BN_dec2bn(&g, gen);
		65	if (!p \|\| !g) {
		66	return NULL;
		67	}
		68	dh = DH_new();
58	if (!dh) {	69	if (!dh) {
59	return NULL;	70	return NULL;
60	}	71	}
61	dh->p = prime(NULL);	72	#if OPENSSL_VERSION_NUMBER >= 0x10100000L
62	BN_dec2bn(&dh->g, gen);	73	if (!DH_set0_pqg(dh, p, NULL, g)) {
63	if (!dh->p \|\| !dh->g) {
64	DH_free(dh);	74	DH_free(dh);
65	return NULL;	75	return NULL;
66	}	76	}
		77	#else
		78	dh->p = p;
		79	dh->g = g;
		80	#endif
67	return dh;	81	return dh;
68	}	82	}
69		83
Lines 480-485 static apr_status_t ssl_init_ctx_protoco Link Here
480	MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;	494	MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
481	char *cp;	495	char *cp;
482	int protocol = mctx->protocol;	496	int protocol = mctx->protocol;
		497	int ssl_version = 0;
483	SSLSrvConfigRec *sc = mySrvConfig(s);	498	SSLSrvConfigRec *sc = mySrvConfig(s);
484		499
485	/*	500	/*
Lines 506-542 static apr_status_t ssl_init_ctx_protoco Link Here
506	ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,	521	ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
507	"Creating new SSL context (protocols: %s)", cp);	522	"Creating new SSL context (protocols: %s)", cp);
508		523
		524	method = mctx->pkp ?
		525	SSLv23_client_method() : /* proxy */
		526	SSLv23_server_method(); /* server */
		527	ctx = SSL_CTX_new(method);
		528
		529	#if OPENSSL_VERSION_NUMBER >= 0x10100000L
509	#ifndef OPENSSL_NO_SSL3	530	#ifndef OPENSSL_NO_SSL3
510	if (protocol == SSL_PROTOCOL_SSLV3) {	531	if (protocol == SSL_PROTOCOL_SSLV3)
511	method = mctx->pkp ?	532	ssl_version = SSL3_VERSION;
512	SSLv3_client_method() : /* proxy */
513	SSLv3_server_method(); /* server */
514	}
515	else	533	else
516	#endif	534	#endif
517	if (protocol == SSL_PROTOCOL_TLSV1) {	535	if (protocol == SSL_PROTOCOL_TLSV1)
518	method = mctx->pkp ?	536	ssl_version = TLS1_VERSION;
519	TLSv1_client_method() : /* proxy */	537	else if (protocol == SSL_PROTOCOL_TLSV1_1)
520	TLSv1_server_method(); /* server */	538	ssl_version = TLS1_1_VERSION;
521	}	539	else if (protocol == SSL_PROTOCOL_TLSV1_2)
522	#ifdef HAVE_TLSV1_X	540	ssl_version = TLS1_2_VERSION;
523	else if (protocol == SSL_PROTOCOL_TLSV1_1) {	541	SSL_CTX_set_min_proto_version(ctx, ssl_version);
524	method = mctx->pkp ?	542	SSL_CTX_set_max_proto_version(ctx, ssl_version);
525	TLSv1_1_client_method() : /* proxy */	543	#else /* OPENSSL_VERSION_NUMBER */
526	TLSv1_1_server_method(); /* server */	544	#ifndef OPENSSL_NO_SSL3
527	}	545	if (protocol == SSL_PROTOCOL_SSLV3)
528	else if (protocol == SSL_PROTOCOL_TLSV1_2) {	546	SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 \| SSL_OP_NO_TLSv1 \| SSL_OP_NO_TLSv1_1 \| SSL_OP_NO_TLSv1_2);
529	method = mctx->pkp ?	547	else
530	TLSv1_2_client_method() : /* proxy */
531	TLSv1_2_server_method(); /* server */
532	}
533	#endif	548	#endif
534	else { /* For multiple protocols, we need a flexible method */	549	if (protocol == SSL_PROTOCOL_TLSV1)
535	method = mctx->pkp ?	550	SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 \| SSL_OP_NO_SSLv3 \| SSL_OP_NO_TLSv1_1 \| SSL_OP_NO_TLSv1_2);
536	SSLv23_client_method() : /* proxy */	551	else if (protocol == SSL_PROTOCOL_TLSV1_1)
537	SSLv23_server_method(); /* server */	552	SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 \| SSL_OP_NO_SSLv3 \| SSL_OP_NO_TLSv1 \| SSL_OP_NO_TLSv1_2);
538	}	553	else if (protocol == SSL_PROTOCOL_TLSV1_2)
539	ctx = SSL_CTX_new(method);	554	SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 \| SSL_OP_NO_SSLv3 \| SSL_OP_NO_TLSv1 \| SSL_OP_NO_TLSv1_1);
		555	#endif /* OPENSSL_VERSION_NUMBER */
540		556
541	mctx->ssl_ctx = ctx;	557	mctx->ssl_ctx = ctx;
542		558
Lines 858-864 static int use_certificate_chain( Link Here
858	unsigned long err;	874	unsigned long err;
859	int n;	875	int n;
860		876
861	if ((bio = BIO_new(BIO_s_file_internal())) == NULL)	877	if ((bio = BIO_new(BIO_s_file())) == NULL)
862	return -1;	878	return -1;
863	if (BIO_read_filename(bio, file) <= 0) {	879	if (BIO_read_filename(bio, file) <= 0) {
864	BIO_free(bio);	880	BIO_free(bio);
Lines 1200-1206 static apr_status_t ssl_init_server_cert Link Here
1200	SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);	1216	SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
1201	ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)	1217	ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
1202	"Custom DH parameters (%d bits) for %s loaded from %s",	1218	"Custom DH parameters (%d bits) for %s loaded from %s",
1203	BN_num_bits(dhparams->p), vhost_id, certfile);	1219	DH_bits(dhparams), vhost_id, certfile);
1204	DH_free(dhparams);	1220	DH_free(dhparams);
1205	}	1221	}
1206		1222




                                    (conn_rec *c,SSL *ssl),
                                    (c,ssl),OK,DECLINED);

#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define BIO_get_data(bio) (bio->ptr)
#define BIO_set_data(bio, data) bio->ptr = data
#define BIO_get_shutdown(bio) (bio->shutdown)
#define BIO_set_shutdown(bio, shut) bio->shutdown = shut
#define BIO_set_init(bio, i) bio->init = i

static BIO_METHOD *BIO_meth_new(int type, const char *name)
{
    BIO_METHOD *bio = calloc(1, sizeof(BIO_METHOD));

    if (bio != NULL) {
        bio->type = type;
        bio->name = name;
    }
    return bio;
}

#define BIO_meth_set_write(bio, write_) bio->bwrite = write_
#define BIO_meth_set_read(bio, read_) bio->bread = read_
#define BIO_meth_set_puts(bio, puts_) bio->bputs = puts_
#define BIO_meth_set_gets(bio, gets_) bio->bgets = gets_
#define BIO_meth_set_ctrl(bio, ctrl_) bio->ctrl = ctrl_
#define BIO_meth_set_create(bio, create_) bio->create = create_
#define BIO_meth_set_destroy(bio, destroy_) bio->destroy = destroy_

#endif

/*  _________________________________________________________________
**
**  I/O Hooks

 * success, -1 on failure. */
static int bio_filter_out_flush(BIO *bio)
{
    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
    apr_bucket *e;

    AP_DEBUG_ASSERT(APR_BRIGADE_EMPTY(outctx->bb));


static int bio_filter_create(BIO *bio)
{
    BIO_set_shutdown(bio, 1);
    BIO_set_init(bio, 1);
    BIO_set_data(bio, NULL);
    bio->ptr = NULL;

    return 1;
}


static int bio_filter_out_write(BIO *bio, const char *in, int inl)
{
    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
    apr_bucket *e;
    int need_flush;


static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr)
{
    long ret = 1;
    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);

    switch (cmd) {
    case BIO_CTRL_RESET:

        ret = 0;
        break;
    case BIO_CTRL_GET_CLOSE:
        ret = (long)BIO_get_shutdown(bio);
        break;
      case BIO_CTRL_SET_CLOSE:
        BIO_set_shutdown(bio, (int)num);
        break;
      case BIO_CTRL_FLUSH:
        ret = bio_filter_out_flush(bio);

    return -1;
}

static BIO_METHOD *bio_filter_out_method;

static int create_bio_filter_out_method(void)
{
    bio_filter_out_method = BIO_meth_new(BIO_TYPE_MEM, "APR output filter");
    if (bio_filter_out_method == NULL)
        return 0;
    BIO_meth_set_write(bio_filter_out_method, bio_filter_out_write);
    BIO_meth_set_read(bio_filter_out_method, bio_filter_out_read); /* read is never called */
    BIO_meth_set_puts(bio_filter_out_method, bio_filter_out_puts); /* puts is never called */
    BIO_meth_set_gets(bio_filter_out_method, bio_filter_out_gets); /* gets is never called */
    BIO_meth_set_ctrl(bio_filter_out_method, bio_filter_out_ctrl);
    BIO_meth_set_create(bio_filter_out_method, bio_filter_create);
    BIO_meth_set_destroy(bio_filter_out_method, bio_filter_destroy);
    return 1;
}

typedef struct {
    int length;

static int bio_filter_in_read(BIO *bio, char *in, int inlen)
{
    apr_size_t inl = inlen;
    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
    apr_read_type_e block = inctx->block;

    inctx->rc = APR_SUCCESS;

}


static BIO_METHOD *bio_filter_in_method;
    BIO_TYPE_MEM,
    "APR input filter",
    NULL,                       /* write is never called */
    bio_filter_in_read,
    NULL,                       /* puts is never called */
    NULL,                       /* gets is never called */
    NULL,                       /* ctrl is never called */
    bio_filter_create,
    bio_filter_destroy,
    NULL
};

static int create_bio_filter_in_method(void)
{
    bio_filter_in_method = BIO_meth_new(BIO_TYPE_MEM, "APR input filter");
    if (bio_filter_in_method == NULL)
        return 0;
    BIO_meth_set_read(bio_filter_in_method, bio_filter_in_read);
    BIO_meth_set_create(bio_filter_in_method, bio_filter_create);
    BIO_meth_set_destroy(bio_filter_in_method, bio_filter_destroy);
    return 1;
}

static apr_status_t ssl_io_input_read(bio_filter_in_ctx_t *inctx,
                                      char *buf,

        return APR_EGENERAL;
    }

    outctx = (bio_filter_out_ctx_t *)BIO_get_data(filter_ctx->pbioWrite);
    res = SSL_write(filter_ctx->pssl, (unsigned char *)data, len);

    if (res < 0) {


    if ((n = SSL_accept(filter_ctx->pssl)) <= 0) {
        bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)
                                     BIO_get_data(filter_ctx->pbioRead);
        bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)
                                       BIO_get_data(filter_ctx->pbioWrite);
        apr_status_t rc = inctx->rc ? inctx->rc : outctx->rc ;
        ssl_err = SSL_get_error(filter_ctx->pssl, n);


        return ap_pass_brigade(f->next, bb);
    }

    inctx = (bio_filter_in_ctx_t *)BIO_get_data(filter_ctx->pbioRead);
    outctx = (bio_filter_out_ctx_t *)BIO_get_data(filter_ctx->pbioWrite);

    /* When we are the writer, we must initialize the inctx
     * mode so that we block for any required ssl input, because


    filter_ctx->pInputFilter = ap_add_input_filter(ssl_io_filter, inctx, r, c);

    filter_ctx->pbioRead = BIO_new(bio_filter_in_method);
    BIO_set_data(filter_ctx->pbioRead, inctx);

    inctx->ssl = ssl;
    inctx->bio_out = filter_ctx->pbioWrite;

    filter_ctx->pOutputFilter   = ap_add_output_filter(ssl_io_filter,
                                                       filter_ctx, r, c);

    filter_ctx->pbioWrite       = BIO_new(bio_filter_out_method);
    BIO_set_data(filter_ctx->pbioWrite, bio_filter_out_ctx_new(filter_ctx, c));

    /* write is non blocking for the benefit of async mpm */
    if (c->cs) {

    }
    return rc;
}

int ssl_engine_io_init(void)
{
    if (!create_bio_filter_out_method())
        return 0;
    if (!create_bio_filter_in_method())
        return 0;
    return 1;
}


Lines 33-38 Link Here

(-)apache2-2.4.23/modules/ssl/ssl_engine_kernel.c (-28 / +43 lines)
33	#include "util_md5.h"	33	#include "util_md5.h"
34	#include "scoreboard.h"	34	#include "scoreboard.h"
35		35
		36	#if OPENSSL_VERSION_NUMBER < 0x10100000L
		37	#define TLS_ST_OK SSL_ST_OK
		38	#endif
		39
36	static void ssl_configure_env(request_rec r, SSLConnRec sslconn);	40	static void ssl_configure_env(request_rec r, SSLConnRec sslconn);
37	#ifdef HAVE_TLSEXT	41	#ifdef HAVE_TLSEXT
38	static int ssl_find_vhost(void servername, conn_rec c, server_rec *s);	42	static int ssl_find_vhost(void servername, conn_rec c, server_rec *s);
Lines 80-86 static apr_status_t upgrade_connection(r Link Here
80	SSL_set_accept_state(ssl);	84	SSL_set_accept_state(ssl);
81	SSL_do_handshake(ssl);	85	SSL_do_handshake(ssl);
82		86
83	if (SSL_get_state(ssl) != SSL_ST_OK) {	87	if (SSL_get_state(ssl) != TLS_ST_OK) {
84	ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02030)	88	ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02030)
85	"TLS upgrade handshake failed");	89	"TLS upgrade handshake failed");
86	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);	90	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
Lines 432-438 int ssl_hook_Access(request_rec *r) Link Here
432	X509 *cert;	436	X509 *cert;
433	X509 *peercert;	437	X509 *peercert;
434	X509_STORE *cert_store = NULL;	438	X509_STORE *cert_store = NULL;
435	X509_STORE_CTX cert_store_ctx;	439	X509_STORE_CTX *cert_store_ctx;
436	STACK_OF(SSL_CIPHER) cipher_list_old = NULL, cipher_list = NULL;	440	STACK_OF(SSL_CIPHER) cipher_list_old = NULL, cipher_list = NULL;
437	const SSL_CIPHER *cipher = NULL;	441	const SSL_CIPHER *cipher = NULL;
438	int depth, verify_old, verify, n, is_slave = 0;	442	int depth, verify_old, verify, n, is_slave = 0;
Lines 456-462 int ssl_hook_Access(request_rec *r) Link Here
456	* forbidden in the latter case, let ap_die() handle	460	* forbidden in the latter case, let ap_die() handle
457	* this recursive (same) error.	461	* this recursive (same) error.
458	*/	462	*/
459	if (SSL_get_state(ssl) != SSL_ST_OK) {	463	if (SSL_get_state(ssl) != TLS_ST_OK) {
460	return HTTP_FORBIDDEN;	464	return HTTP_FORBIDDEN;
461	}	465	}
462	ctx = SSL_get_SSL_CTX(ssl);	466	ctx = SSL_get_SSL_CTX(ssl);
Lines 622-628 int ssl_hook_Access(request_rec *r) Link Here
622	!renegotiate && (n < sk_SSL_CIPHER_num(cipher_list));	626	!renegotiate && (n < sk_SSL_CIPHER_num(cipher_list));
623	n++)	627	n++)
624	{	628	{
625	SSL_CIPHER *value = sk_SSL_CIPHER_value(cipher_list, n);	629	const SSL_CIPHER *value = sk_SSL_CIPHER_value(cipher_list, n);
626		630
627	if (sk_SSL_CIPHER_find(cipher_list_old, value) < 0) {	631	if (sk_SSL_CIPHER_find(cipher_list_old, value) < 0) {
628	renegotiate = TRUE;	632	renegotiate = TRUE;
Lines 633-639 int ssl_hook_Access(request_rec *r) Link Here
633	!renegotiate && (n < sk_SSL_CIPHER_num(cipher_list_old));	637	!renegotiate && (n < sk_SSL_CIPHER_num(cipher_list_old));
634	n++)	638	n++)
635	{	639	{
636	SSL_CIPHER *value = sk_SSL_CIPHER_value(cipher_list_old, n);	640	const SSL_CIPHER *value = sk_SSL_CIPHER_value(cipher_list_old, n);
637		641
638	if (sk_SSL_CIPHER_find(cipher_list, value) < 0) {	642	if (sk_SSL_CIPHER_find(cipher_list, value) < 0) {
639	renegotiate = TRUE;	643	renegotiate = TRUE;
Lines 914-938 int ssl_hook_Access(request_rec *r) Link Here
914	cert = sk_X509_value(cert_stack, 0);	918	cert = sk_X509_value(cert_stack, 0);
915	}	919	}
916		920
917	X509_STORE_CTX_init(&cert_store_ctx, cert_store, cert, cert_stack);	921	cert_store_ctx = X509_STORE_CTX_new();
		922	X509_STORE_CTX_init(cert_store_ctx, cert_store, cert, cert_stack);
918	depth = SSL_get_verify_depth(ssl);	923	depth = SSL_get_verify_depth(ssl);
919		924
920	if (depth >= 0) {	925	if (depth >= 0) {
921	X509_STORE_CTX_set_depth(&cert_store_ctx, depth);	926	X509_STORE_CTX_set_depth(cert_store_ctx, depth);
922	}	927	}
923		928
924	X509_STORE_CTX_set_ex_data(&cert_store_ctx,	929	X509_STORE_CTX_set_ex_data(cert_store_ctx,
925	SSL_get_ex_data_X509_STORE_CTX_idx(),	930	SSL_get_ex_data_X509_STORE_CTX_idx(),
926	(char *)ssl);	931	(char *)ssl);
927		932
928	if (!X509_verify_cert(&cert_store_ctx)) {	933	if (!X509_verify_cert(cert_store_ctx)) {
929	ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02224)	934	ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02224)
930	"Re-negotiation verification step failed");	935	"Re-negotiation verification step failed");
931	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);	936	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
932	}	937	}
933		938
934	SSL_set_verify_result(ssl, cert_store_ctx.error);	939	SSL_set_verify_result(ssl, X509_STORE_CTX_get_error(cert_store_ctx));
935	X509_STORE_CTX_cleanup(&cert_store_ctx);	940	X509_STORE_CTX_free(cert_store_ctx);
936		941
937	if (cert_stack != SSL_get_peer_cert_chain(ssl)) {	942	if (cert_stack != SSL_get_peer_cert_chain(ssl)) {
938	/* we created this ourselves, so free it */	943	/* we created this ourselves, so free it */
Lines 983-989 int ssl_hook_Access(request_rec *r) Link Here
983	SSL_renegotiate(ssl);	988	SSL_renegotiate(ssl);
984	SSL_do_handshake(ssl);	989	SSL_do_handshake(ssl);
985		990
986	if (SSL_get_state(ssl) != SSL_ST_OK) {	991	if (SSL_get_state(ssl) != TLS_ST_OK) {
987	ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02225)	992	ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02225)
988	"Re-negotiation request failed");	993	"Re-negotiation request failed");
989	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);	994	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
Lines 995-1014 int ssl_hook_Access(request_rec *r) Link Here
995	ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(02226)	1000	ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(02226)
996	"Awaiting re-negotiation handshake");	1001	"Awaiting re-negotiation handshake");
997		1002
998	/* XXX: Should replace setting state with SSL_renegotiate(ssl);	1003	/* XXX: Why is this done twice? */
999	* However, this causes failures in perl-framework currently,	1004	SSL_renegotiate(ssl);
1000	* perhaps pre-test if we have already negotiated?	1005	/* XXX: Return value ignored, uses SSL_get_state instead? */
1001	*/
1002	#ifdef OPENSSL_NO_SSL_INTERN
1003	SSL_set_state(ssl, SSL_ST_ACCEPT);
1004	#else
1005	ssl->state = SSL_ST_ACCEPT;
1006	#endif
1007	SSL_do_handshake(ssl);	1006	SSL_do_handshake(ssl);
1008		1007
1009	sslconn->reneg_state = RENEG_REJECT;	1008	sslconn->reneg_state = RENEG_REJECT;
1010		1009
1011	if (SSL_get_state(ssl) != SSL_ST_OK) {	1010	if (SSL_get_state(ssl) != TLS_ST_OK) {
1012	ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261)	1011	ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261)
1013	"Re-negotiation handshake failed");	1012	"Re-negotiation handshake failed");
1014	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);	1013	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
Lines 1513-1519 DH ssl_callback_TmpDH(SSL ssl, int exp Link Here
1513	SSL_set_current_cert(ssl, SSL_CERT_SET_SERVER);	1512	SSL_set_current_cert(ssl, SSL_CERT_SET_SERVER);
1514	#endif	1513	#endif
1515	pkey = SSL_get_privatekey(ssl);	1514	pkey = SSL_get_privatekey(ssl);
1516	type = pkey ? EVP_PKEY_type(pkey->type) : EVP_PKEY_NONE;	1515	type = pkey ? EVP_PKEY_base_id(pkey) : EVP_PKEY_NONE;
1517		1516
1518	/*	1517	/*
1519	* OpenSSL will call us with either keylen == 512 or keylen == 1024	1518	* OpenSSL will call us with either keylen == 512 or keylen == 1024
Lines 1725-1735 static void modssl_proxy_info_log(conn_r Link Here
1725	* so we need to increment here to prevent them from	1724	* so we need to increment here to prevent them from
1726	* being freed.	1725	* being freed.
1727	*/	1726	*/
		1727
		1728	#if OPENSSL_VERSION_NUMBER >= 0x10100000L
		1729	#define modssl_set_cert_info(info, cert, pkey) \
		1730	*cert = info->x509; \
		1731	X509_up_ref(*cert); \
		1732	*pkey = info->x_pkey->dec_pkey; \
		1733	EVP_PKEY_up_ref(*pkey)
		1734	#else
1728	#define modssl_set_cert_info(info, cert, pkey) \	1735	#define modssl_set_cert_info(info, cert, pkey) \
1729	*cert = info->x509; \	1736	*cert = info->x509; \
1730	CRYPTO_add(&(*cert)->references, +1, CRYPTO_LOCK_X509); \	1737	CRYPTO_add(&(*cert)->references, +1, CRYPTO_LOCK_X509); \
1731	*pkey = info->x_pkey->dec_pkey; \	1738	*pkey = info->x_pkey->dec_pkey; \
1732	CRYPTO_add(&(*pkey)->references, +1, CRYPTO_LOCK_X509_PKEY)	1739	CRYPTO_add(&(*pkey)->references, +1, CRYPTO_LOCK_X509_PKEY)
		1740	#endif
1733		1741
1734	int ssl_callback_proxy_cert(SSL ssl, X509 x509, EVP_PKEY *pkey)	1742	int ssl_callback_proxy_cert(SSL ssl, X509 x509, EVP_PKEY *pkey)
1735	{	1743	{
Lines 1823-1829 int ssl_callback_proxy_cert(SSL *ssl, X5 Link Here
1823		1831
1824	static void ssl_session_log(server_rec *s,	1832	static void ssl_session_log(server_rec *s,
1825	const char *request,	1833	const char *request,
1826	unsigned char *id,	1834	const unsigned char *id,
1827	unsigned int idlen,	1835	unsigned int idlen,
1828	const char *status,	1836	const char *status,
1829	const char *result,	1837	const char *result,
Lines 1907-1913 int ssl_callback_NewSessionCacheEntry(SS Link Here
1907	* of our other Apache pre-forked server processes.	1915	* of our other Apache pre-forked server processes.
1908	*/	1916	*/
1909	SSL_SESSION ssl_callback_GetSessionCacheEntry(SSL ssl,	1917	SSL_SESSION ssl_callback_GetSessionCacheEntry(SSL ssl,
1910	unsigned char *id,	1918	const unsigned char *id,
1911	int idlen, int *do_copy)	1919	int idlen, int *do_copy)
1912	{	1920	{
1913	/* Get Apache context back through OpenSSL context */	1921	/* Get Apache context back through OpenSSL context */
Lines 2070-2077 void ssl_callback_Info(const SSL *ssl, i Link Here
2070	if ((where & SSL_CB_ACCEPT_LOOP) && scr->reneg_state == RENEG_REJECT) {	2078	if ((where & SSL_CB_ACCEPT_LOOP) && scr->reneg_state == RENEG_REJECT) {
2071	int state = SSL_get_state((SSL *)ssl);	2079	int state = SSL_get_state((SSL *)ssl);
2072		2080
		2081	#if OPENSSL_VERSION_NUMBER >= 0x10100000L
		2082	if (state == TLS_ST_SR_CLNT_HELLO) {
		2083	#else
2073	if (state == SSL3_ST_SR_CLNT_HELLO_A	2084	if (state == SSL3_ST_SR_CLNT_HELLO_A
2074	\|\| state == SSL23_ST_SR_CLNT_HELLO_A) {	2085	\|\| state == SSL23_ST_SR_CLNT_HELLO_A) {
		2086	#endif
2075	scr->reneg_state = RENEG_ABORT;	2087	scr->reneg_state = RENEG_ABORT;
2076	ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02042)	2088	ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02042)
2077	"rejecting client initiated renegotiation");	2089	"rejecting client initiated renegotiation");
Lines 2279-2285 int ssl_callback_SessionTicket(SSL *ssl, Link Here
2279	}	2291	}
2280		2292
2281	memcpy(keyname, ticket_key->key_name, 16);	2293	memcpy(keyname, ticket_key->key_name, 16);
2282	RAND_pseudo_bytes(iv, EVP_MAX_IV_LENGTH);	2294	/* XXX: Return value not checked. */
		2295	RAND_bytes(iv, EVP_MAX_IV_LENGTH);
2283	EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,	2296	EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
2284	ticket_key->aes_key, iv);	2297	ticket_key->aes_key, iv);
2285	HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);	2298	HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
Lines 2416-2433 int ssl_callback_SRPServerParams(SSL *ss Link Here
2416	SRP_user_pwd *u;	2429	SRP_user_pwd *u;
2417		2430
2418	if (username == NULL	2431	if (username == NULL
2419	\|\| (u = SRP_VBASE_get_by_user(mctx->srp_vbase, username)) == NULL) {	2432	\|\| (u = SRP_VBASE_get1_by_user(mctx->srp_vbase, username)) == NULL) {
2420	*ad = SSL_AD_UNKNOWN_PSK_IDENTITY;	2433	*ad = SSL_AD_UNKNOWN_PSK_IDENTITY;
2421	return SSL3_AL_FATAL;	2434	return SSL3_AL_FATAL;
2422	}	2435	}
2423		2436
2424	if (SSL_set_srp_server_param(ssl, u->N, u->g, u->s, u->v, u->info) < 0) {	2437	if (SSL_set_srp_server_param(ssl, u->N, u->g, u->s, u->v, u->info) < 0) {
		2438	SRP_user_pwd_free(u);
2425	*ad = SSL_AD_INTERNAL_ERROR;	2439	*ad = SSL_AD_INTERNAL_ERROR;
2426	return SSL3_AL_FATAL;	2440	return SSL3_AL_FATAL;
2427	}	2441	}
2428		2442
2429	/* reset all other options */	2443	/* reset all other options */
2430	SSL_set_verify(ssl, SSL_VERIFY_NONE, ssl_callback_SSLVerify);	2444	SSL_set_verify(ssl, SSL_VERIFY_NONE, ssl_callback_SSLVerify);
		2445	SRP_user_pwd_free(u);
2431	return SSL_ERROR_NONE;	2446	return SSL_ERROR_NONE;
2432	}	2447	}
2433		2448




{
    OCSP_REQUEST *req = OCSP_REQUEST_new();

    *certid = OCSP_cert_to_id(NULL, cert, X509_STORE_CTX_get0_current_issuer(ctx));
    if (!*certid || !OCSP_request_add0_id(req, *certid)) {
        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01921)
                     "could not retrieve certificate id");


    if (rc == V_OCSP_CERTSTATUS_GOOD) {
        /* TODO: allow flags configuration. */
        if (OCSP_basic_verify(basicResponse, NULL, X509_STORE_CTX_get0_store(ctx), 0) != 1) {
            ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01925)
                        "failed to verify the OCSP response");
            ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s);

                      "No cert available to check with OCSP");
        return 1;
    }
    else if (X509_check_issued(cert, cert) == X509_V_OK) {
        /* don't do OCSP checking for valid self-issued certs */
        ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,
                      "Skipping OCSP check for valid self-issued cert");

Lines 33-38 Link Here

(-)apache2-2.4.23/modules/ssl/ssl_engine_vars.c (-13 / +16 lines)
33		33
34	#include "apr_time.h"	34	#include "apr_time.h"
35		35
		36	#if OPENSSL_VERSION_NUMBER < 0x10100000L
		37	#define X509_get0_tbs_sigalg(x509) (xs->cert_info->signature)
		38	#endif
		39
36	/* _________________________________________________________________	40	/* _________________________________________________________________
37	**	41	**
38	** Variable Lookup	42	** Variable Lookup
Lines 529-541 static char *ssl_var_lookup_ssl_cert(apr Link Here
529	resdup = FALSE;	533	resdup = FALSE;
530	}	534	}
531	else if (strcEQ(var, "A_SIG")) {	535	else if (strcEQ(var, "A_SIG")) {
532	nid = OBJ_obj2nid((ASN1_OBJECT *)(xs->cert_info->signature->algorithm));	536	nid = OBJ_obj2nid(X509_get0_tbs_sigalg(xs)->algorithm);
533	result = apr_pstrdup(p,	537	result = apr_pstrdup(p,
534	(nid == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(nid));	538	(nid == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(nid));
535	resdup = FALSE;	539	resdup = FALSE;
536	}	540	}
537	else if (strcEQ(var, "A_KEY")) {	541	else if (strcEQ(var, "A_KEY")) {
538	nid = OBJ_obj2nid((ASN1_OBJECT *)(xs->cert_info->key->algor->algorithm));	542	X509_PUBKEY *pubkey = X509_get_X509_PUBKEY(xs);
		543	X509_ALGOR *algor;
		544	X509_PUBKEY_get0_param(NULL, NULL, NULL, &algor, pubkey);
		545	nid = OBJ_obj2nid(algor->algorithm);
539	result = apr_pstrdup(p,	546	result = apr_pstrdup(p,
540	(nid == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(nid));	547	(nid == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(nid));
541	resdup = FALSE;	548	resdup = FALSE;
Lines 597-609 static char *ssl_var_lookup_ssl_cert_dn( Link Here
597	for (i = 0; ssl_var_lookup_ssl_cert_dn_rec[i].name != NULL; i++) {	604	for (i = 0; ssl_var_lookup_ssl_cert_dn_rec[i].name != NULL; i++) {
598	if (strEQn(var, ssl_var_lookup_ssl_cert_dn_rec[i].name, varlen)	605	if (strEQn(var, ssl_var_lookup_ssl_cert_dn_rec[i].name, varlen)
599	&& strlen(ssl_var_lookup_ssl_cert_dn_rec[i].name) == varlen) {	606	&& strlen(ssl_var_lookup_ssl_cert_dn_rec[i].name) == varlen) {
600	for (j = 0; j < sk_X509_NAME_ENTRY_num((STACK_OF(X509_NAME_ENTRY) *)	607	for (j = 0; j < X509_NAME_entry_count(xsname); j++) {
601	xsname->entries);	608	xsne = X509_NAME_get_entry(xsname, j);
602	j++) {
603	xsne = sk_X509_NAME_ENTRY_value((STACK_OF(X509_NAME_ENTRY) *)
604	xsname->entries, j);
605		609
606	n =OBJ_obj2nid((ASN1_OBJECT *)X509_NAME_ENTRY_get_object(xsne));	610	n = OBJ_obj2nid(X509_NAME_ENTRY_get_object(xsne));
607		611
608	if (n == ssl_var_lookup_ssl_cert_dn_rec[i].nid && idx-- == 0) {	612	if (n == ssl_var_lookup_ssl_cert_dn_rec[i].nid && idx-- == 0) {
609	result = modssl_X509_NAME_ENTRY_to_string(p, xsne);	613	result = modssl_X509_NAME_ENTRY_to_string(p, xsne);
Lines 903-909 static char *ssl_var_lookup_ssl_version( Link Here
903	static void extract_dn(apr_table_t t, apr_hash_t nids, const char *pfx,	907	static void extract_dn(apr_table_t t, apr_hash_t nids, const char *pfx,
904	X509_NAME xn, apr_pool_t p)	908	X509_NAME xn, apr_pool_t p)
905	{	909	{
906	STACK_OF(X509_NAME_ENTRY) *ents = xn->entries;
907	X509_NAME_ENTRY *xsne;	910	X509_NAME_ENTRY *xsne;
908	apr_hash_t *count;	911	apr_hash_t *count;
909	int i, nid;	912	int i, nid;
Lines 913-926 static void extract_dn(apr_table_t *t, a Link Here
913	count = apr_hash_make(p);	916	count = apr_hash_make(p);
914		917
915	/* For each RDN... */	918	/* For each RDN... */
916	for (i = 0; i < sk_X509_NAME_ENTRY_num(ents); i++) {	919	for (i = 0; i < X509_NAME_entry_count(xn); i++) {
917	const char *tag;	920	const char *tag;
918		921
919	xsne = sk_X509_NAME_ENTRY_value(ents, i);	922	xsne = X509_NAME_get_entry(xn, i);
920		923
921	/* Retrieve the nid, and check whether this is one of the nids	924	/* Retrieve the nid, and check whether this is one of the nids
922	* which are to be extracted. */	925	* which are to be extracted. */
923	nid = OBJ_obj2nid((ASN1_OBJECT *)X509_NAME_ENTRY_get_object(xsne));	926	nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(xsne));
924		927
925	tag = apr_hash_get(nids, &nid, sizeof nid);	928	tag = apr_hash_get(nids, &nid, sizeof nid);
926	if (tag) {	929	if (tag) {
Lines 1090-1096 apr_array_header_t *ssl_ext_list(apr_poo Link Here
1090	for (j = 0; j < count; j++) {	1093	for (j = 0; j < count; j++) {
1091	X509_EXTENSION *ext = X509_get_ext(xs, j);	1094	X509_EXTENSION *ext = X509_get_ext(xs, j);
1092		1095
1093	if (OBJ_cmp(ext->object, oid) == 0) {	1096	if (OBJ_cmp(X509_EXTENSION_get_object(ext), oid) == 0) {
1094	BIO *bio = BIO_new(BIO_s_mem());	1097	BIO *bio = BIO_new(BIO_s_mem());
1095		1098
1096	/* We want to obtain a string representation of the extensions	1099	/* We want to obtain a string representation of the extensions




int          ssl_callback_SSLVerify_CRL(int, X509_STORE_CTX *, conn_rec *);
int          ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
int          ssl_callback_NewSessionCacheEntry(SSL *, SSL_SESSION *);
SSL_SESSION *ssl_callback_GetSessionCacheEntry(SSL *, const unsigned char *, int, int *);
void         ssl_callback_DelSessionCacheEntry(SSL_CTX *, SSL_SESSION *);
void         ssl_callback_Info(const SSL *, int, int);
#ifdef HAVE_TLSEXT

void         ssl_scache_kill(server_rec *);
BOOL         ssl_scache_store(server_rec *, UCHAR *, int,
                              apr_time_t, SSL_SESSION *, apr_pool_t *);
SSL_SESSION *ssl_scache_retrieve(server_rec *, const UCHAR *, int, apr_pool_t *);
void         ssl_scache_remove(server_rec *, UCHAR *, int,
                               apr_pool_t *);


void         ssl_io_filter_init(conn_rec *, request_rec *r, SSL *);
void         ssl_io_filter_register(apr_pool_t *);
long         ssl_io_data_cb(BIO *, int, const char *, int, long, long);
int          ssl_engine_io_init(void);

/* ssl_io_buffer_fill fills the setaside buffering of the HTTP request
 * to allow an SSL renegotiation to take place. */

Lines 144-150 BOOL ssl_scache_store(server_rec *s, UCH Link Here

(-)apache2-2.4.23/modules/ssl/ssl_scache.c (-1 / +1 lines)
144	return rv == APR_SUCCESS ? TRUE : FALSE;	144	return rv == APR_SUCCESS ? TRUE : FALSE;
145	}	145	}
146		146
147	SSL_SESSION ssl_scache_retrieve(server_rec s, UCHAR *id, int idlen,	147	SSL_SESSION ssl_scache_retrieve(server_rec s, const UCHAR *id, int idlen,
148	apr_pool_t *p)	148	apr_pool_t *p)
149	{	149	{
150	SSLModConfigRec *mc = myModConfig(s);	150	SSLModConfigRec *mc = myModConfig(s);

Lines 488-494 EC_GROUP *ssl_ec_GetParamFromFile(const Link Here

(-)apache2-2.4.23/modules/ssl/ssl_util_ssl.c (-1 / +1 lines)
488	** _________________________________________________________________	488	** _________________________________________________________________
489	*/	489	*/
490		490
491	char modssl_SSL_SESSION_id2sz(unsigned char id, int idlen,	491	char modssl_SSL_SESSION_id2sz(const unsigned char id, int idlen,
492	char *str, int strsize)	492	char *str, int strsize)
493	{	493	{
494	if (idlen > SSL_MAX_SSL_SESSION_ID_LENGTH)	494	if (idlen > SSL_MAX_SSL_SESSION_ID_LENGTH)

Lines 67-73 char *modssl_X509_NAME_ENTRY_to_st Link Here

(-)apache2-2.4.23/modules/ssl/ssl_util_ssl.h (-1 / +1 lines)
67	char modssl_X509_NAME_to_string(apr_pool_t , X509_NAME *, int);	67	char modssl_X509_NAME_to_string(apr_pool_t , X509_NAME *, int);
68	BOOL modssl_X509_getSAN(apr_pool_t , X509 , int, const char , int, apr_array_header_t *);	68	BOOL modssl_X509_getSAN(apr_pool_t , X509 , int, const char , int, apr_array_header_t *);
69	BOOL modssl_X509_match_name(apr_pool_t , X509 , const char , BOOL, server_rec );	69	BOOL modssl_X509_match_name(apr_pool_t , X509 , const char , BOOL, server_rec );
70	char modssl_SSL_SESSION_id2sz(unsigned char , int, char *, int);	70	char modssl_SSL_SESSION_id2sz(const unsigned char , int, char *, int);
71		71
72	#endif /* __SSL_UTIL_SSL_H__ */	72	#endif /* __SSL_UTIL_SSL_H__ */
73	/** @} */	73	/** @} */




    X509 *issuer = NULL;
    int i;
    X509_STORE *st = SSL_CTX_get_cert_store(mctx->ssl_ctx);
    X509_STORE_CTX *inctx;
    STACK_OF(X509) *extra_certs = NULL;

#ifdef OPENSSL_NO_SSL_INTERN

    for (i = 0; i < sk_X509_num(extra_certs); i++) {
        issuer = sk_X509_value(extra_certs, i);
        if (X509_check_issued(issuer, x) == X509_V_OK) {
#if OPENSSL_VERSION_NUMBER < 0x10100000L
            CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
#else
            X509_up_ref(issuer);
#endif
            return issuer;
        }
    }

    inctx = X509_STORE_CTX_new();
    if (!X509_STORE_CTX_init(inctx, st, NULL, NULL))
        return 0;
    if (X509_STORE_CTX_get1_issuer(&issuer, inctx, x) <= 0)
        issuer = NULL;
    X509_STORE_CTX_free(inctx);
    return issuer;

}


            if (bio) {
                int n;
                ASN1_INTEGER *serial;
		OCSP_id_get0_info(NULL, NULL, NULL, &serial, cinf->cid);
                if ((i2a_ASN1_INTEGER(bio, serial) != -1) &&
                    ((n = BIO_read(bio, snum, sizeof snum - 1)) > 0))
                    snum[n] = '\0';
                BIO_free(bio);




    fprintf(stderr, "    -h              Display usage information (this message)\n");
#ifdef USE_SSL

#ifndef OPENSSL_NO_SSL2
#define SSL2_HELP_MSG "SSL2, "
#else
#define SSL2_HELP_MSG ""
#endif

#ifndef OPENSSL_NO_SSL3
#define SSL3_HELP_MSG "SSL3, "
#else


    fprintf(stderr, "    -Z ciphersuite  Specify SSL/TLS cipher suite (See openssl ciphers)\n");
    fprintf(stderr, "    -f protocol     Specify SSL/TLS protocol\n");
    fprintf(stderr, "                    (" SSL3_HELP_MSG "TLS1" TLS1_X_HELP_MSG " or ALL)\n");
#endif
    exit(EINVAL);
}

    char c;
#ifdef USE_SSL
    AB_SSL_METHOD_CONST SSL_METHOD *meth = SSLv23_client_method();
    int ssl_version = 0;
#endif

    /* table defaults  */

                break;
            case 'f':
                if (strncasecmp(opt_arg, "ALL", 3) == 0) {
                    ssl_version = 0;
#ifndef OPENSSL_NO_SSL2
                } else if (strncasecmp(opt_arg, "SSL2", 4) == 0) {
                    meth = SSLv2_client_method();
#endif
#ifndef OPENSSL_NO_SSL3
                } else if (strncasecmp(opt_arg, "SSL3", 4) == 0) {
                    ssl_version = SSL3_VERSION;
#endif
#ifdef HAVE_TLSV1_X
                } else if (strncasecmp(opt_arg, "TLS1.1", 6) == 0) {
                    ssl_version = TLS1_1_VERSION;
                } else if (strncasecmp(opt_arg, "TLS1.2", 6) == 0) {
                    ssl_version = TLS1_2_VERSION;
#endif
                } else if (strncasecmp(opt_arg, "TLS1", 4) == 0) {
                    ssl_version = TLS1_VERSION;
                }
                break;
#endif

#ifdef RSAREF
    R_malloc_init();
#else
#if OPENSSL_VERSION_NUMBER < 0x1010000L
    CRYPTO_malloc_init();
#endif
#endif
    SSL_load_error_strings();
    SSL_library_init();
    bio_out=BIO_new_fp(stdout,BIO_NOCLOSE);

        ERR_print_errors(bio_err);
        exit(1);
    }
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    SSL_CTX_set_min_proto_version(ssl_ctx, ssl_version);
    SSL_CTX_set_max_proto_version(ssl_ctx, ssl_version);
#else
    switch (ssl_version) {
#ifndef OPENSSL_NO_SSL3
        case SSL3_VERSION:
	    SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2);
            break;
#endif
        case TLS1_VERSION:
	    SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2);
            break;
        case TLS1_1_VERSION:
	    SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_2);
            break;
        case TLS1_2_VERSION:
	    SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);
            break;
    }
#endif
    SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL);
#ifdef SSL_MODE_RELEASE_BUFFERS
    /* Keep memory usage as low as possible */

Return to bug 60061

Lines 36-41 APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, Link Here

(-)apache2-2.4.23/modules/ssl/ssl_engine_io.c (-43 / +83 lines)
36	(conn_rec c,SSL ssl),	36	(conn_rec c,SSL ssl),
37	(c,ssl),OK,DECLINED);	37	(c,ssl),OK,DECLINED);
38		38
		39	#if OPENSSL_VERSION_NUMBER < 0x10100000L
		40	#define BIO_get_data(bio) (bio->ptr)
		41	#define BIO_set_data(bio, data) bio->ptr = data
		42	#define BIO_get_shutdown(bio) (bio->shutdown)
		43	#define BIO_set_shutdown(bio, shut) bio->shutdown = shut
		44	#define BIO_set_init(bio, i) bio->init = i
		45
		46	static BIO_METHOD BIO_meth_new(int type, const char name)
		47	{
		48	BIO_METHOD *bio = calloc(1, sizeof(BIO_METHOD));
		49
		50	if (bio != NULL) {
		51	bio->type = type;
		52	bio->name = name;
		53	}
		54	return bio;
		55	}
		56
		57	#define BIO_meth_set_write(bio, write_) bio->bwrite = write_
		58	#define BIO_meth_set_read(bio, read_) bio->bread = read_
		59	#define BIO_meth_set_puts(bio, puts_) bio->bputs = puts_
		60	#define BIO_meth_set_gets(bio, gets_) bio->bgets = gets_
		61	#define BIO_meth_set_ctrl(bio, ctrl_) bio->ctrl = ctrl_
		62	#define BIO_meth_set_create(bio, create_) bio->create = create_
		63	#define BIO_meth_set_destroy(bio, destroy_) bio->destroy = destroy_
		64
		65	#endif
		66
39	/* _________________________________________________________________	67	/* _________________________________________________________________
40	**	68	**
41	** I/O Hooks	69	** I/O Hooks
Lines 149-155 static int bio_filter_out_pass(bio_filte Link Here
149	* success, -1 on failure. */	177	* success, -1 on failure. */
150	static int bio_filter_out_flush(BIO *bio)	178	static int bio_filter_out_flush(BIO *bio)
151	{	179	{
152	bio_filter_out_ctx_t outctx = (bio_filter_out_ctx_t )(bio->ptr);	180	bio_filter_out_ctx_t outctx = (bio_filter_out_ctx_t )BIO_get_data(bio);
153	apr_bucket *e;	181	apr_bucket *e;
154		182
155	AP_DEBUG_ASSERT(APR_BRIGADE_EMPTY(outctx->bb));	183	AP_DEBUG_ASSERT(APR_BRIGADE_EMPTY(outctx->bb));
Lines 162-171 static int bio_filter_out_flush(BIO *bio Link Here
162		190
163	static int bio_filter_create(BIO *bio)	191	static int bio_filter_create(BIO *bio)
164	{	192	{
165	bio->shutdown = 1;	193	BIO_set_shutdown(bio, 1);
166	bio->init = 1;	194	BIO_set_init(bio, 1);
167	bio->num = -1;	195	BIO_set_data(bio, NULL);
168	bio->ptr = NULL;
169		196
170	return 1;	197	return 1;
171	}	198	}
Lines 190-196 static int bio_filter_out_read(BIO *bio, Link Here
190		217
191	static int bio_filter_out_write(BIO bio, const char in, int inl)	218	static int bio_filter_out_write(BIO bio, const char in, int inl)
192	{	219	{
193	bio_filter_out_ctx_t outctx = (bio_filter_out_ctx_t )(bio->ptr);	220	bio_filter_out_ctx_t outctx = (bio_filter_out_ctx_t )BIO_get_data(bio);
194	apr_bucket *e;	221	apr_bucket *e;
195	int need_flush;	222	int need_flush;
196		223
Lines 241-247 static int bio_filter_out_write(BIO *bio Link Here
241	static long bio_filter_out_ctrl(BIO bio, int cmd, long num, void ptr)	268	static long bio_filter_out_ctrl(BIO bio, int cmd, long num, void ptr)
242	{	269	{
243	long ret = 1;	270	long ret = 1;
244	bio_filter_out_ctx_t outctx = (bio_filter_out_ctx_t )(bio->ptr);	271	bio_filter_out_ctx_t outctx = (bio_filter_out_ctx_t )BIO_get_data(bio);
245		272
246	switch (cmd) {	273	switch (cmd) {
247	case BIO_CTRL_RESET:	274	case BIO_CTRL_RESET:
Lines 257-266 static long bio_filter_out_ctrl(BIO *bio Link Here
257	ret = 0;	284	ret = 0;
258	break;	285	break;
259	case BIO_CTRL_GET_CLOSE:	286	case BIO_CTRL_GET_CLOSE:
260	ret = (long)bio->shutdown;	287	ret = (long)BIO_get_shutdown(bio);
261	break;	288	break;
262	case BIO_CTRL_SET_CLOSE:	289	case BIO_CTRL_SET_CLOSE:
263	bio->shutdown = (int)num;	290	BIO_set_shutdown(bio, (int)num);
264	break;	291	break;
265	case BIO_CTRL_FLUSH:	292	case BIO_CTRL_FLUSH:
266	ret = bio_filter_out_flush(bio);	293	ret = bio_filter_out_flush(bio);
Lines 294-311 static int bio_filter_out_puts(BIO *bio, Link Here
294	return -1;	321	return -1;
295	}	322	}
296		323
297	static BIO_METHOD bio_filter_out_method = {	324	static BIO_METHOD *bio_filter_out_method;
298	BIO_TYPE_MEM,	325
299	"APR output filter",	326	static int create_bio_filter_out_method(void)
300	bio_filter_out_write,	327	{
301	bio_filter_out_read, /* read is never called */	328	bio_filter_out_method = BIO_meth_new(BIO_TYPE_MEM, "APR output filter");
302	bio_filter_out_puts, /* puts is never called */	329	if (bio_filter_out_method == NULL)
303	bio_filter_out_gets, /* gets is never called */	330	return 0;
304	bio_filter_out_ctrl,	331	BIO_meth_set_write(bio_filter_out_method, bio_filter_out_write);
305	bio_filter_create,	332	BIO_meth_set_read(bio_filter_out_method, bio_filter_out_read); /* read is never called */
306	bio_filter_destroy,	333	BIO_meth_set_puts(bio_filter_out_method, bio_filter_out_puts); /* puts is never called */
307	NULL	334	BIO_meth_set_gets(bio_filter_out_method, bio_filter_out_gets); /* gets is never called */
308	};	335	BIO_meth_set_ctrl(bio_filter_out_method, bio_filter_out_ctrl);
		336	BIO_meth_set_create(bio_filter_out_method, bio_filter_create);
		337	BIO_meth_set_destroy(bio_filter_out_method, bio_filter_destroy);
		338	return 1;
		339	}
309		340
310	typedef struct {	341	typedef struct {
311	int length;	342	int length;
Lines 456-462 static apr_status_t brigade_consume(apr_ Link Here
456	static int bio_filter_in_read(BIO bio, char in, int inlen)	487	static int bio_filter_in_read(BIO bio, char in, int inlen)
457	{	488	{
458	apr_size_t inl = inlen;	489	apr_size_t inl = inlen;
459	bio_filter_in_ctx_t inctx = (bio_filter_in_ctx_t )(bio->ptr);	490	bio_filter_in_ctx_t inctx = (bio_filter_in_ctx_t )BIO_get_data(bio);
460	apr_read_type_e block = inctx->block;	491	apr_read_type_e block = inctx->block;
461		492
462	inctx->rc = APR_SUCCESS;	493	inctx->rc = APR_SUCCESS;
Lines 537-555 static int bio_filter_in_read(BIO *bio, Link Here
537	}	568	}
538		569
539		570
540	static BIO_METHOD bio_filter_in_method = {	571	static BIO_METHOD *bio_filter_in_method;
541	BIO_TYPE_MEM,
542	"APR input filter",
543	NULL, /* write is never called */
544	bio_filter_in_read,
545	NULL, /* puts is never called */
546	NULL, /* gets is never called */
547	NULL, /* ctrl is never called */
548	bio_filter_create,
549	bio_filter_destroy,
550	NULL
551	};
552		572
		573	static int create_bio_filter_in_method(void)
		574	{
		575	bio_filter_in_method = BIO_meth_new(BIO_TYPE_MEM, "APR input filter");
		576	if (bio_filter_in_method == NULL)
		577	return 0;
		578	BIO_meth_set_read(bio_filter_in_method, bio_filter_in_read);
		579	BIO_meth_set_create(bio_filter_in_method, bio_filter_create);
		580	BIO_meth_set_destroy(bio_filter_in_method, bio_filter_destroy);
		581	return 1;
		582	}
553		583
554	static apr_status_t ssl_io_input_read(bio_filter_in_ctx_t *inctx,	584	static apr_status_t ssl_io_input_read(bio_filter_in_ctx_t *inctx,
555	char *buf,	585	char *buf,
Lines 779-785 static apr_status_t ssl_filter_write(ap_ Link Here
779	return APR_EGENERAL;	809	return APR_EGENERAL;
780	}	810	}
781		811
782	outctx = (bio_filter_out_ctx_t *)filter_ctx->pbioWrite->ptr;	812	outctx = (bio_filter_out_ctx_t *)BIO_get_data(filter_ctx->pbioWrite);
783	res = SSL_write(filter_ctx->pssl, (unsigned char *)data, len);	813	res = SSL_write(filter_ctx->pssl, (unsigned char *)data, len);
784		814
785	if (res < 0) {	815	if (res < 0) {
Lines 1252-1260 static apr_status_t ssl_io_filter_handsh Link Here
1252		1282
1253	if ((n = SSL_accept(filter_ctx->pssl)) <= 0) {	1283	if ((n = SSL_accept(filter_ctx->pssl)) <= 0) {
1254	bio_filter_in_ctx_t inctx = (bio_filter_in_ctx_t )	1284	bio_filter_in_ctx_t inctx = (bio_filter_in_ctx_t )
1255	(filter_ctx->pbioRead->ptr);	1285	BIO_get_data(filter_ctx->pbioRead);
1256	bio_filter_out_ctx_t outctx = (bio_filter_out_ctx_t )	1286	bio_filter_out_ctx_t outctx = (bio_filter_out_ctx_t )
1257	(filter_ctx->pbioWrite->ptr);	1287	BIO_get_data(filter_ctx->pbioWrite);
1258	apr_status_t rc = inctx->rc ? inctx->rc : outctx->rc ;	1288	apr_status_t rc = inctx->rc ? inctx->rc : outctx->rc ;
1259	ssl_err = SSL_get_error(filter_ctx->pssl, n);	1289	ssl_err = SSL_get_error(filter_ctx->pssl, n);
1260		1290
Lines 1667-1674 static apr_status_t ssl_io_filter_output Link Here
1667	return ap_pass_brigade(f->next, bb);	1697	return ap_pass_brigade(f->next, bb);
1668	}	1698	}
1669		1699
1670	inctx = (bio_filter_in_ctx_t *)filter_ctx->pbioRead->ptr;	1700	inctx = (bio_filter_in_ctx_t *)BIO_get_data(filter_ctx->pbioRead);
1671	outctx = (bio_filter_out_ctx_t *)filter_ctx->pbioWrite->ptr;	1701	outctx = (bio_filter_out_ctx_t *)BIO_get_data(filter_ctx->pbioWrite);
1672		1702
1673	/* When we are the writer, we must initialize the inctx	1703	/* When we are the writer, we must initialize the inctx
1674	* mode so that we block for any required ssl input, because	1704	* mode so that we block for any required ssl input, because
Lines 1949-1956 static void ssl_io_input_add_filter(ssl_ Link Here
1949		1979
1950	filter_ctx->pInputFilter = ap_add_input_filter(ssl_io_filter, inctx, r, c);	1980	filter_ctx->pInputFilter = ap_add_input_filter(ssl_io_filter, inctx, r, c);
1951		1981
1952	filter_ctx->pbioRead = BIO_new(&bio_filter_in_method);	1982	filter_ctx->pbioRead = BIO_new(bio_filter_in_method);
1953	filter_ctx->pbioRead->ptr = (void *)inctx;	1983	BIO_set_data(filter_ctx->pbioRead, inctx);
1954		1984
1955	inctx->ssl = ssl;	1985	inctx->ssl = ssl;
1956	inctx->bio_out = filter_ctx->pbioWrite;	1986	inctx->bio_out = filter_ctx->pbioWrite;
Lines 1980-1987 void ssl_io_filter_init(conn_rec *c, req Link Here
1980	filter_ctx->pOutputFilter = ap_add_output_filter(ssl_io_filter,	2010	filter_ctx->pOutputFilter = ap_add_output_filter(ssl_io_filter,
1981	filter_ctx, r, c);	2011	filter_ctx, r, c);
1982		2012
1983	filter_ctx->pbioWrite = BIO_new(&bio_filter_out_method);	2013	filter_ctx->pbioWrite = BIO_new(bio_filter_out_method);
1984	filter_ctx->pbioWrite->ptr = (void *)bio_filter_out_ctx_new(filter_ctx, c);	2014	BIO_set_data(filter_ctx->pbioWrite, bio_filter_out_ctx_new(filter_ctx, c));
1985		2015
1986	/* write is non blocking for the benefit of async mpm */	2016	/* write is non blocking for the benefit of async mpm */
1987	if (c->cs) {	2017	if (c->cs) {
Lines 2130-2132 long ssl_io_data_cb(BIO *bio, int cmd, Link Here
2130	}	2160	}
2131	return rc;	2161	return rc;
2132	}	2162	}
		2163
		2164	int ssl_engine_io_init(void)
		2165	{
		2166	if (!create_bio_filter_out_method())
		2167	return 0;
		2168	if (!create_bio_filter_in_method())
		2169	return 0;
		2170	return 1;
		2171	}
		2172

Lines 109-115 static OCSP_REQUEST *create_request(X509 Link Here

(-)apache2-2.4.23/modules/ssl/ssl_engine_ocsp.c (-3 / +3 lines)
109	{	109	{
110	OCSP_REQUEST *req = OCSP_REQUEST_new();	110	OCSP_REQUEST *req = OCSP_REQUEST_new();
111		111
112	*certid = OCSP_cert_to_id(NULL, cert, ctx->current_issuer);	112	*certid = OCSP_cert_to_id(NULL, cert, X509_STORE_CTX_get0_current_issuer(ctx));
113	if (!certid \|\| !OCSP_request_add0_id(req, certid)) {	113	if (!certid \|\| !OCSP_request_add0_id(req, certid)) {
114	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01921)	114	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01921)
115	"could not retrieve certificate id");	115	"could not retrieve certificate id");
Lines 184-190 static int verify_ocsp_status(X509 *cert Link Here
184		184
185	if (rc == V_OCSP_CERTSTATUS_GOOD) {	185	if (rc == V_OCSP_CERTSTATUS_GOOD) {
186	/* TODO: allow flags configuration. */	186	/* TODO: allow flags configuration. */
187	if (OCSP_basic_verify(basicResponse, NULL, ctx->ctx, 0) != 1) {	187	if (OCSP_basic_verify(basicResponse, NULL, X509_STORE_CTX_get0_store(ctx), 0) != 1) {
188	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01925)	188	ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01925)
189	"failed to verify the OCSP response");	189	"failed to verify the OCSP response");
190	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s);	190	ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s);
Lines 262-268 int modssl_verify_ocsp(X509_STORE_CTX *c Link Here
262	"No cert available to check with OCSP");	262	"No cert available to check with OCSP");
263	return 1;	263	return 1;
264	}	264	}
265	else if (cert->valid && X509_check_issued(cert,cert) == X509_V_OK) {	265	else if (X509_check_issued(cert, cert) == X509_V_OK) {
266	/* don't do OCSP checking for valid self-issued certs */	266	/* don't do OCSP checking for valid self-issued certs */
267	ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,	267	ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,
268	"Skipping OCSP check for valid self-issued cert");	268	"Skipping OCSP check for valid self-issued cert");

Lines 810-816 int ssl_callback_SSLVerify(int, Link Here

(-)apache2-2.4.23/modules/ssl/ssl_private.h (-2 / +3 lines)
810	int ssl_callback_SSLVerify_CRL(int, X509_STORE_CTX , conn_rec );	810	int ssl_callback_SSLVerify_CRL(int, X509_STORE_CTX , conn_rec );
811	int ssl_callback_proxy_cert(SSL ssl, X509 x509, EVP_PKEY *pkey);	811	int ssl_callback_proxy_cert(SSL ssl, X509 x509, EVP_PKEY *pkey);
812	int ssl_callback_NewSessionCacheEntry(SSL , SSL_SESSION );	812	int ssl_callback_NewSessionCacheEntry(SSL , SSL_SESSION );
813	SSL_SESSION ssl_callback_GetSessionCacheEntry(SSL , unsigned char , int, int );	813	SSL_SESSION ssl_callback_GetSessionCacheEntry(SSL , const unsigned char , int, int );
814	void ssl_callback_DelSessionCacheEntry(SSL_CTX , SSL_SESSION );	814	void ssl_callback_DelSessionCacheEntry(SSL_CTX , SSL_SESSION );
815	void ssl_callback_Info(const SSL *, int, int);	815	void ssl_callback_Info(const SSL *, int, int);
816	#ifdef HAVE_TLSEXT	816	#ifdef HAVE_TLSEXT
Lines 833-839 void ssl_scache_status_register( Link Here
833	void ssl_scache_kill(server_rec *);	833	void ssl_scache_kill(server_rec *);
834	BOOL ssl_scache_store(server_rec , UCHAR , int,	834	BOOL ssl_scache_store(server_rec , UCHAR , int,
835	apr_time_t, SSL_SESSION , apr_pool_t );	835	apr_time_t, SSL_SESSION , apr_pool_t );
836	SSL_SESSION ssl_scache_retrieve(server_rec , UCHAR , int, apr_pool_t );	836	SSL_SESSION ssl_scache_retrieve(server_rec , const UCHAR , int, apr_pool_t );
837	void ssl_scache_remove(server_rec , UCHAR , int,	837	void ssl_scache_remove(server_rec , UCHAR , int,
838	apr_pool_t *);	838	apr_pool_t *);
839		839
Lines 866-871 int ssl_callback_SRPServerParam Link Here
866	void ssl_io_filter_init(conn_rec , request_rec r, SSL *);	866	void ssl_io_filter_init(conn_rec , request_rec r, SSL *);
867	void ssl_io_filter_register(apr_pool_t *);	867	void ssl_io_filter_register(apr_pool_t *);
868	long ssl_io_data_cb(BIO , int, const char , int, long, long);	868	long ssl_io_data_cb(BIO , int, const char , int, long, long);
		869	int ssl_engine_io_init(void);
869		870
870	/* ssl_io_buffer_fill fills the setaside buffering of the HTTP request	871	/* ssl_io_buffer_fill fills the setaside buffering of the HTTP request
871	* to allow an SSL renegotiation to take place. */	872	* to allow an SSL renegotiation to take place. */

Lines 79-85 static X509 *stapling_get_issuer(modssl_ Link Here

(-)apache2-2.4.23/modules/ssl/ssl_util_stapling.c (-5 / +12 lines)
79	X509 *issuer = NULL;	79	X509 *issuer = NULL;
80	int i;	80	int i;
81	X509_STORE *st = SSL_CTX_get_cert_store(mctx->ssl_ctx);	81	X509_STORE *st = SSL_CTX_get_cert_store(mctx->ssl_ctx);
82	X509_STORE_CTX inctx;	82	X509_STORE_CTX *inctx;
83	STACK_OF(X509) *extra_certs = NULL;	83	STACK_OF(X509) *extra_certs = NULL;
84		84
85	#ifdef OPENSSL_NO_SSL_INTERN	85	#ifdef OPENSSL_NO_SSL_INTERN
Lines 91-106 static X509 *stapling_get_issuer(modssl_ Link Here
91	for (i = 0; i < sk_X509_num(extra_certs); i++) {	91	for (i = 0; i < sk_X509_num(extra_certs); i++) {
92	issuer = sk_X509_value(extra_certs, i);	92	issuer = sk_X509_value(extra_certs, i);
93	if (X509_check_issued(issuer, x) == X509_V_OK) {	93	if (X509_check_issued(issuer, x) == X509_V_OK) {
		94	#if OPENSSL_VERSION_NUMBER < 0x10100000L
94	CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);	95	CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
		96	#else
		97	X509_up_ref(issuer);
		98	#endif
95	return issuer;	99	return issuer;
96	}	100	}
97	}	101	}
98		102
99	if (!X509_STORE_CTX_init(&inctx, st, NULL, NULL))	103	inctx = X509_STORE_CTX_new();
		104	if (!X509_STORE_CTX_init(inctx, st, NULL, NULL))
100	return 0;	105	return 0;
101	if (X509_STORE_CTX_get1_issuer(&issuer, &inctx, x) <= 0)	106	if (X509_STORE_CTX_get1_issuer(&issuer, inctx, x) <= 0)
102	issuer = NULL;	107	issuer = NULL;
103	X509_STORE_CTX_cleanup(&inctx);	108	X509_STORE_CTX_free(inctx);
104	return issuer;	109	return issuer;
105		110
106	}	111	}
Lines 398-404 static int stapling_check_response(serve Link Here
398		403
399	if (bio) {	404	if (bio) {
400	int n;	405	int n;
401	if ((i2a_ASN1_INTEGER(bio, cinf->cid->serialNumber) != -1) &&	406	ASN1_INTEGER *serial;
		407	OCSP_id_get0_info(NULL, NULL, NULL, &serial, cinf->cid);
		408	if ((i2a_ASN1_INTEGER(bio, serial) != -1) &&
402	((n = BIO_read(bio, snum, sizeof snum - 1)) > 0))	409	((n = BIO_read(bio, snum, sizeof snum - 1)) > 0))
403	snum[n] = '\0';	410	snum[n] = '\0';
404	BIO_free(bio);	411	BIO_free(bio);

Lines 1991-2002 static void usage(const char *progname) Link Here

(-)apache2-2.4.23/support/ab.c (-18 / +30 lines)
1991	fprintf(stderr, " -h Display usage information (this message)\n");	1991	fprintf(stderr, " -h Display usage information (this message)\n");
1992	#ifdef USE_SSL	1992	#ifdef USE_SSL
1993		1993
1994	#ifndef OPENSSL_NO_SSL2
1995	#define SSL2_HELP_MSG "SSL2, "
1996	#else
1997	#define SSL2_HELP_MSG ""
1998	#endif
1999
2000	#ifndef OPENSSL_NO_SSL3	1994	#ifndef OPENSSL_NO_SSL3
2001	#define SSL3_HELP_MSG "SSL3, "	1995	#define SSL3_HELP_MSG "SSL3, "
2002	#else	1996	#else
Lines 2011-2017 static void usage(const char *progname) Link Here
2011		2005
2012	fprintf(stderr, " -Z ciphersuite Specify SSL/TLS cipher suite (See openssl ciphers)\n");	2006	fprintf(stderr, " -Z ciphersuite Specify SSL/TLS cipher suite (See openssl ciphers)\n");
2013	fprintf(stderr, " -f protocol Specify SSL/TLS protocol\n");	2007	fprintf(stderr, " -f protocol Specify SSL/TLS protocol\n");
2014	fprintf(stderr, " (" SSL2_HELP_MSG SSL3_HELP_MSG "TLS1" TLS1_X_HELP_MSG " or ALL)\n");	2008	fprintf(stderr, " (" SSL3_HELP_MSG "TLS1" TLS1_X_HELP_MSG " or ALL)\n");
2015	#endif	2009	#endif
2016	exit(EINVAL);	2010	exit(EINVAL);
2017	}	2011	}
Lines 2135-2140 int main(int argc, const char * const ar Link Here
2135	char c;	2129	char c;
2136	#ifdef USE_SSL	2130	#ifdef USE_SSL
2137	AB_SSL_METHOD_CONST SSL_METHOD *meth = SSLv23_client_method();	2131	AB_SSL_METHOD_CONST SSL_METHOD *meth = SSLv23_client_method();
		2132	int ssl_version = 0;
2138	#endif	2133	#endif
2139		2134
2140	/* table defaults */	2135	/* table defaults */
Lines 2351-2373 int main(int argc, const char * const ar Link Here
2351	break;	2346	break;
2352	case 'f':	2347	case 'f':
2353	if (strncasecmp(opt_arg, "ALL", 3) == 0) {	2348	if (strncasecmp(opt_arg, "ALL", 3) == 0) {
2354	meth = SSLv23_client_method();	2349	ssl_version = 0;
2355	#ifndef OPENSSL_NO_SSL2
2356	} else if (strncasecmp(opt_arg, "SSL2", 4) == 0) {
2357	meth = SSLv2_client_method();
2358	#endif
2359	#ifndef OPENSSL_NO_SSL3	2350	#ifndef OPENSSL_NO_SSL3
2360	} else if (strncasecmp(opt_arg, "SSL3", 4) == 0) {	2351	} else if (strncasecmp(opt_arg, "SSL3", 4) == 0) {
2361	meth = SSLv3_client_method();	2352	ssl_version = SSL3_VERSION;
2362	#endif	2353	#endif
2363	#ifdef HAVE_TLSV1_X
2364	} else if (strncasecmp(opt_arg, "TLS1.1", 6) == 0) {	2354	} else if (strncasecmp(opt_arg, "TLS1.1", 6) == 0) {
2365	meth = TLSv1_1_client_method();	2355	ssl_version = TLS1_1_VERSION;
2366	} else if (strncasecmp(opt_arg, "TLS1.2", 6) == 0) {	2356	} else if (strncasecmp(opt_arg, "TLS1.2", 6) == 0) {
2367	meth = TLSv1_2_client_method();	2357	ssl_version = TLS1_2_VERSION;
2368	#endif
2369	} else if (strncasecmp(opt_arg, "TLS1", 4) == 0) {	2358	} else if (strncasecmp(opt_arg, "TLS1", 4) == 0) {
2370	meth = TLSv1_client_method();	2359	ssl_version = TLS1_VERSION;
2371	}	2360	}
2372	break;	2361	break;
2373	#endif	2362	#endif
Lines 2413-2420 int main(int argc, const char * const ar Link Here
2413	#ifdef RSAREF	2402	#ifdef RSAREF
2414	R_malloc_init();	2403	R_malloc_init();
2415	#else	2404	#else
		2405	#if OPENSSL_VERSION_NUMBER < 0x1010000L
2416	CRYPTO_malloc_init();	2406	CRYPTO_malloc_init();
2417	#endif	2407	#endif
		2408	#endif
2418	SSL_load_error_strings();	2409	SSL_load_error_strings();
2419	SSL_library_init();	2410	SSL_library_init();
2420	bio_out=BIO_new_fp(stdout,BIO_NOCLOSE);	2411	bio_out=BIO_new_fp(stdout,BIO_NOCLOSE);
Lines 2425-2430 int main(int argc, const char * const ar Link Here
2425	ERR_print_errors(bio_err);	2416	ERR_print_errors(bio_err);
2426	exit(1);	2417	exit(1);
2427	}	2418	}
		2419	#if OPENSSL_VERSION_NUMBER >= 0x10100000L
		2420	SSL_CTX_set_min_proto_version(ssl_ctx, ssl_version);
		2421	SSL_CTX_set_max_proto_version(ssl_ctx, ssl_version);
		2422	#else
		2423	switch (ssl_version) {
		2424	#ifndef OPENSSL_NO_SSL3
		2425	case SSL3_VERSION:
		2426	SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 \| SSL_OP_NO_TLSv1 \| SSL_OP_NO_TLSv1_1 \| SSL_OP_NO_TLSv1_2);
		2427	break;
		2428	#endif
		2429	case TLS1_VERSION:
		2430	SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 \| SSL_OP_NO_SSLv3 \| SSL_OP_NO_TLSv1_1 \| SSL_OP_NO_TLSv1_2);
		2431	break;
		2432	case TLS1_1_VERSION:
		2433	SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 \| SSL_OP_NO_SSLv3 \| SSL_OP_NO_TLSv1 \| SSL_OP_NO_TLSv1_2);
		2434	break;
		2435	case TLS1_2_VERSION:
		2436	SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 \| SSL_OP_NO_SSLv3 \| SSL_OP_NO_TLSv1 \| SSL_OP_NO_TLSv1_1);
		2437	break;
		2438	}
		2439	#endif
2428	SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL);	2440	SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL);
2429	#ifdef SSL_MODE_RELEASE_BUFFERS	2441	#ifdef SSL_MODE_RELEASE_BUFFERS
2430	/* Keep memory usage as low as possible */	2442	/* Keep memory usage as low as possible */