168
|
1 /*****************************************************************************/
|
|
2 /* sslcommon.c - interface to OpenSSL */
|
|
3 /* Copyright (C) 1998-2003 Brian Masney <masneyb@gftp.org> */
|
|
4 /* */
|
|
5 /* This program is free software; you can redistribute it and/or modify */
|
|
6 /* it under the terms of the GNU General Public License as published by */
|
|
7 /* the Free Software Foundation; either version 2 of the License, or */
|
|
8 /* (at your option) any later version. */
|
|
9 /* */
|
|
10 /* This program is distributed in the hope that it will be useful, */
|
|
11 /* but WITHOUT ANY WARRANTY; without even the implied warranty of */
|
|
12 /* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
|
|
13 /* GNU General Public License for more details. */
|
|
14 /* */
|
|
15 /* You should have received a copy of the GNU General Public License */
|
|
16 /* along with this program; if not, write to the Free Software */
|
|
17 /* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111 USA */
|
|
18 /*****************************************************************************/
|
|
19
|
|
20 #include "gftp.h"
|
|
21
|
|
22 static const char cvsid[] = "$Id$";
|
|
23
|
|
24 /* Some of the functions in here was taken either entirely or partially from
|
|
25 * the O'Reilly book Network Security with OpenSSL */
|
|
26
|
169
|
27 #ifdef USE_SSL
|
|
28
|
168
|
29 static SSL_CTX * ctx = NULL;
|
|
30
|
|
31 static volatile int gftp_ssl_initialized = 0;
|
|
32
|
|
33 static int
|
|
34 gftp_ssl_verify_callback (int ok, X509_STORE_CTX *store)
|
|
35 {
|
|
36 char data[256];
|
|
37
|
|
38 if (!ok)
|
|
39 {
|
|
40 X509 *cert = X509_STORE_CTX_get_current_cert (store);
|
|
41 int depth = X509_STORE_CTX_get_error_depth (store);
|
|
42 int err = X509_STORE_CTX_get_error (store);
|
|
43
|
|
44 fprintf (stderr, "-Error with certificate at depth: %i\n", depth);
|
|
45 X509_NAME_oneline (X509_get_issuer_name (cert), data, sizeof (data));
|
|
46 fprintf (stderr, " issuer = %s\n", data);
|
|
47 X509_NAME_oneline (X509_get_subject_name (cert), data, sizeof (data));
|
|
48 fprintf (stderr, " subject = %s\n", data);
|
|
49 fprintf (stderr, " err %i:%s\n", err, X509_verify_cert_error_string (err));
|
|
50 }
|
|
51
|
|
52 return ok;
|
|
53 }
|
|
54
|
|
55
|
|
56 static int
|
|
57 gftp_ssl_post_connection_check (gftp_request * request)
|
|
58 {
|
|
59 char data[256], *extstr;
|
|
60 int extcount, ok, i, j;
|
|
61 X509_EXTENSION *ext;
|
|
62 X509_NAME *subj;
|
|
63 X509 *cert;
|
|
64
|
|
65 ok = 0;
|
|
66 if (!(cert = SSL_get_peer_certificate (request->ssl)))
|
|
67 {
|
|
68 request->logging_function (gftp_logging_error, request->user_data,
|
|
69 _("Cannot get peer certificate\n"));
|
|
70 return (X509_V_ERR_APPLICATION_VERIFICATION);
|
|
71 }
|
|
72
|
|
73 if ((extcount = X509_get_ext_count (cert)) > 0)
|
|
74 {
|
|
75 for (i = 0; i < extcount; i++)
|
|
76 {
|
|
77 ext = X509_get_ext (cert, i);
|
|
78 extstr = (char *) OBJ_nid2sn (OBJ_obj2nid (X509_EXTENSION_get_object (ext)));
|
|
79
|
|
80 if (strcmp (extstr, "subjectAltName") == 0)
|
|
81 {
|
|
82 unsigned char *data;
|
|
83 STACK_OF(CONF_VALUE) *val;
|
|
84 CONF_VALUE *nval;
|
|
85 X509V3_EXT_METHOD *meth;
|
|
86 void *ext_str = NULL;
|
|
87
|
|
88 if (!(meth = X509V3_EXT_get(ext)))
|
|
89 break;
|
|
90 data = ext->value->data;
|
|
91
|
|
92 #if (OPENSSL_VERSION_NUMBER > 0x00907000L)
|
|
93 if (meth->it)
|
|
94 ext_str = ASN1_item_d2i(NULL, &data, ext->value->length,
|
|
95 ASN1_ITEM_ptr(meth->it));
|
|
96 else
|
|
97 ext_str = meth->d2i(NULL, &data, ext->value->length);
|
|
98 #else
|
|
99 ext_str = meth->d2i(NULL, &data, ext->value->length);
|
|
100 #endif
|
|
101 val = meth->i2v(meth, ext_str, NULL);
|
|
102 for (j = 0; j < sk_CONF_VALUE_num(val); j++)
|
|
103 {
|
|
104 nval = sk_CONF_VALUE_value(val, j);
|
|
105 if (strcmp(nval->name, "DNS") == 0 && strcmp(nval->value, request->hostname) == 0)
|
|
106 {
|
|
107 ok = 1;
|
|
108 break;
|
|
109 }
|
|
110 }
|
|
111 }
|
|
112 if (ok)
|
|
113 break;
|
|
114 }
|
|
115 }
|
|
116
|
|
117 /* FIXME
|
|
118 if (!ok && (subj = X509_get_subject_name (cert)) &&
|
|
119 X509_NAME_get_text_by_NID (subj, NID_commonName, data, 256) > 0)
|
|
120 {
|
|
121 data[sizeof (data) - 1] = '\0';
|
|
122 if (strcasecmp (data, request->hostname) != 0)
|
|
123 {
|
|
124 request->logging_function (gftp_logging_error, request->user_data,
|
|
125 _("The SSL certificate's host %s does not match the host %s that we connected to\n"),
|
|
126 data, request->hostname);
|
|
127 X509_free (cert);
|
|
128 return (X509_V_ERR_APPLICATION_VERIFICATION);
|
|
129 }
|
|
130 }
|
|
131 */
|
|
132
|
|
133 X509_free (cert);
|
|
134 return (SSL_get_verify_result(request->ssl));
|
|
135 }
|
|
136
|
|
137
|
|
138 int
|
|
139 gftp_ssl_startup (gftp_request * request)
|
|
140 {
|
173
|
141 if (gftp_ssl_initialized)
|
|
142 return (0);
|
|
143
|
168
|
144 gftp_ssl_initialized = 1;
|
|
145
|
|
146 /* FIXME _ thread setup */
|
|
147 /* FIXME - only call this from one place */
|
|
148 if (!SSL_library_init ())
|
|
149 {
|
173
|
150 request->logging_function (gftp_logging_error, request->user_data,
|
|
151 _("Cannot initialized the OpenSSL library\n"));
|
168
|
152 return (GFTP_EFATAL);
|
|
153 }
|
|
154
|
|
155 SSL_load_error_strings ();
|
|
156 RAND_load_file ("/dev/urandom", 1024); /* FIXME - be able to specify this file */
|
|
157
|
|
158 ctx = SSL_CTX_new (SSLv23_method ());
|
|
159
|
|
160 if (SSL_CTX_set_default_verify_paths (ctx) != 1)
|
|
161 {
|
|
162 request->logging_function (gftp_logging_error, request->user_data,
|
|
163 _("Error loading default SSL certificates\n"));
|
173
|
164 return (GFTP_EFATAL);
|
168
|
165 }
|
|
166
|
|
167 SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER, gftp_ssl_verify_callback);
|
|
168 SSL_CTX_set_verify_depth (ctx, 4);
|
|
169 SSL_CTX_set_options (ctx, SSL_OP_ALL|SSL_OP_NO_SSLv2);
|
|
170
|
|
171 if (SSL_CTX_set_cipher_list (ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH") != 1)
|
|
172 {
|
|
173 request->logging_function (gftp_logging_error, request->user_data,
|
|
174 _("Error setting cipher list (no valid ciphers)\n"));
|
|
175 return (GFTP_EFATAL);
|
|
176 }
|
|
177
|
|
178 return (0);
|
|
179 }
|
|
180
|
|
181
|
|
182 int
|
|
183 gftp_ssl_session_setup (gftp_request * request)
|
|
184 {
|
|
185 BIO * bio;
|
|
186 long ret;
|
|
187
|
169
|
188 g_return_val_if_fail (request->datafd > 0, GFTP_EFATAL);
|
168
|
189
|
|
190 if (!gftp_ssl_initialized)
|
|
191 {
|
|
192 request->logging_function (gftp_logging_error, request->user_data,
|
|
193 _("Error: SSL engine was not initialized\n"));
|
|
194 return (GFTP_EFATAL);
|
|
195 }
|
|
196
|
169
|
197 if (gftp_fd_set_sockblocking (request, request->datafd, 0) < 0) /* FIXME */
|
168
|
198 {
|
|
199 gftp_disconnect (request);
|
|
200 return (GFTP_ERETRYABLE);
|
|
201 }
|
|
202
|
|
203 if ((bio = BIO_new (BIO_s_socket ())) == NULL)
|
|
204 {
|
|
205 request->logging_function (gftp_logging_error, request->user_data,
|
|
206 _("Error setting up SSL connection (BIO object)\n"));
|
|
207 return (GFTP_EFATAL);
|
|
208 }
|
|
209
|
169
|
210 BIO_set_fd (bio, request->datafd, BIO_NOCLOSE);
|
168
|
211
|
|
212 if ((request->ssl = SSL_new (ctx)) == NULL)
|
|
213 {
|
|
214 request->logging_function (gftp_logging_error, request->user_data,
|
|
215 _("Error setting up SSL connection (SSL object)\n"));
|
|
216 return (GFTP_EFATAL);
|
|
217 }
|
|
218
|
|
219 SSL_set_bio (request->ssl, bio, bio);
|
|
220
|
|
221 if (SSL_connect (request->ssl) <= 0)
|
|
222 {
|
|
223 request->logging_function (gftp_logging_error, request->user_data,
|
|
224 _("Error connecting to SSL object\n"));
|
|
225 return (GFTP_EFATAL);
|
|
226 }
|
|
227
|
|
228 if ((ret = gftp_ssl_post_connection_check (request)) != X509_V_OK)
|
|
229 {
|
|
230 request->logging_function (gftp_logging_error, request->user_data,
|
|
231 _("Error with peer certificate: %s\n"),
|
|
232 X509_verify_cert_error_string (ret));
|
|
233 return (GFTP_EFATAL);
|
|
234 }
|
|
235
|
|
236 request->logging_function (gftp_logging_misc, request->user_data,
|
|
237 "SSL connection established using %s (%s)\n",
|
|
238 SSL_get_cipher_version (request->ssl),
|
|
239 SSL_get_cipher_name (request->ssl));
|
|
240
|
|
241 return (0);
|
|
242 }
|
|
243
|
|
244
|
|
245 ssize_t
|
|
246 gftp_ssl_read (gftp_request * request, void *ptr, size_t size, int fd)
|
|
247 {
|
|
248 ssize_t ret;
|
|
249 int err;
|
|
250
|
|
251 if (!gftp_ssl_initialized)
|
|
252 {
|
|
253 request->logging_function (gftp_logging_error, request->user_data,
|
|
254 _("Error: SSL engine was not initialized\n"));
|
|
255 return (GFTP_EFATAL);
|
|
256 }
|
|
257
|
|
258 errno = 0;
|
|
259 ret = 0;
|
|
260 do
|
|
261 {
|
|
262 if ((ret = SSL_read (request->ssl, ptr, size)) < 0)
|
|
263 {
|
|
264 err = SSL_get_error (request->ssl, ret);
|
|
265 printf ("error is %d\n", err);
|
|
266 if (errno == EINTR)
|
|
267 {
|
|
268 if (request != NULL && request->cancel)
|
|
269 break;
|
|
270 else
|
|
271 continue;
|
|
272 }
|
|
273
|
|
274 if (request != NULL)
|
|
275 {
|
|
276 request->logging_function (gftp_logging_error, request->user_data,
|
|
277 _("Error: Could not read from socket: %s\n"),
|
|
278 g_strerror (errno));
|
|
279 gftp_disconnect (request);
|
|
280 }
|
|
281 return (GFTP_ERETRYABLE);
|
|
282 }
|
|
283 }
|
|
284 while (errno == EINTR && !(request != NULL && request->cancel));
|
|
285
|
|
286 if (errno == EINTR && request != NULL && request->cancel)
|
|
287 {
|
|
288 gftp_disconnect (request);
|
|
289 return (GFTP_ERETRYABLE);
|
|
290 }
|
|
291
|
|
292 return (ret);
|
|
293 }
|
|
294
|
|
295
|
|
296 ssize_t
|
|
297 gftp_ssl_write (gftp_request * request, const char *ptr, size_t size, int fd)
|
|
298 {
|
|
299 size_t ret, w_ret;
|
|
300
|
|
301 if (!gftp_ssl_initialized)
|
|
302 {
|
|
303 request->logging_function (gftp_logging_error, request->user_data,
|
|
304 _("Error: SSL engine was not initialized\n"));
|
|
305 return (GFTP_EFATAL);
|
|
306 }
|
|
307
|
|
308 ret = 0;
|
|
309 do
|
|
310 {
|
|
311 w_ret = SSL_write (request->ssl, ptr, size);
|
|
312 if (w_ret <= 0)
|
|
313 {
|
|
314 if (errno == EINTR)
|
|
315 {
|
|
316 if (request != NULL && request->cancel)
|
|
317 break;
|
|
318 else
|
|
319 continue;
|
|
320 }
|
|
321
|
|
322 if (request != NULL)
|
|
323 {
|
|
324 request->logging_function (gftp_logging_error, request->user_data,
|
|
325 _("Error: Could not write to socket: %s\n"),
|
|
326 g_strerror (errno));
|
|
327 gftp_disconnect (request);
|
|
328 }
|
|
329 return (GFTP_ERETRYABLE);
|
|
330 }
|
|
331 ptr += w_ret;
|
|
332 size -= w_ret;
|
|
333 ret += w_ret;
|
|
334 }
|
|
335 while (size > 0);
|
|
336
|
|
337 if (errno == EINTR && request != NULL && request->cancel)
|
|
338 {
|
|
339 gftp_disconnect (request);
|
|
340 return (GFTP_ERETRYABLE);
|
|
341 }
|
|
342
|
|
343 return (ret);
|
|
344 }
|
|
345
|
|
346 #endif
|