Mercurial > gftp.yaz

comparison lib/sslcommon.c @ 168:c505d9ba9d53

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
2003-6-6 Brian Masney <masneyb@gftp.org> * lib/gftp.h - if USE_SSL is defined, include the OpenSSL headers. Added read_function, write_function and post_connect function pointers to gftp_request structure. Added SSL object to gftp_request structure if USE_SSL is defined. Added protocol number and init function declarations for the HTTPS protocol * lib/options.h - added HTTPS to the list of supported protocols * lib/protocols.c lib/cache.c lib/rfc2068.c lib/rfc959.c lib/sshv2.c - renamed gftp_read(), gftp_write() and gftp_set_sockblocking() to gftp_fd_read(), gftp_fd_write() and gftp_fd_set_sockblocking() respectively * lib/bookmark.c lib/local.c * lib/misc.c lib/rfc2068.c - moved base64_encode() to misc.c * lib/protocols.c - improved parsing of URLs. Rather than calling gftp_read() or gftp_write() directly, call the read_function or write_function that is set in the request structure. Expanded tabs to spaces. Cleanup for parsing of timestamps. In gftp_connect_server(), if a post_connect function pointer is set, call it after we are connected to the server. Improvements to gftp_get_line (). * lib/httpcommon.h lib/rfc2068.c - moved rfc2068_params structure to httpcommon.h. Fix for chunked file transfers, they were not handled at all before. Made the I/O calls a little more generic so that we can read from either a socket or a SSL connection. * lib/sslcommon.c - added generic SSL layer * lib/https.c - added support for the HTTPS protocol. It piggy backs off of the existing HTTP support and uses the generic SSL layer * src/gtk/bookmarks.c src/gtk/chmod_dialog.c src/gtk/gftp-gtk.c src/gtk/menu-items.c src/gtk/misc-gtk.c src/gtk/options_dialog.c src/gtk/view_dialog.c - set the window icon name to the gFTP <version> * configure.in - added lib back to SUBDIRS (oops) * lib/Makefile.am - added https.c, sslcommon.c and httpcommon.h
author masneyb
date Sun, 08 Jun 2003 15:04:40 +0000
parents
children d40f9db52cdf
comparison
equal deleted inserted replaced
167:4b767a186810 168:c505d9ba9d53
1 /*****************************************************************************/
2 /* sslcommon.c - interface to OpenSSL */
3 /* Copyright (C) 1998-2003 Brian Masney <masneyb@gftp.org> */
4 /* */
5 /* This program is free software; you can redistribute it and/or modify */
6 /* it under the terms of the GNU General Public License as published by */
7 /* the Free Software Foundation; either version 2 of the License, or */
8 /* (at your option) any later version. */
9 /* */
10 /* This program is distributed in the hope that it will be useful, */
11 /* but WITHOUT ANY WARRANTY; without even the implied warranty of */
12 /* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
13 /* GNU General Public License for more details. */
14 /* */
15 /* You should have received a copy of the GNU General Public License */
16 /* along with this program; if not, write to the Free Software */
17 /* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111 USA */
18 /*****************************************************************************/
19
20 #include "gftp.h"
21
22 static const char cvsid[] = "$Id$";
23
24 /* Some of the functions in here was taken either entirely or partially from
25 * the O'Reilly book Network Security with OpenSSL */
26
27 static SSL_CTX * ctx = NULL;
28
29 #ifdef USE_SSL
30
31 static volatile int gftp_ssl_initialized = 0;
32
33 static int
34 gftp_ssl_verify_callback (int ok, X509_STORE_CTX *store)
35 {
36 char data[256];
37
38 if (!ok)
39 {
40 X509 *cert = X509_STORE_CTX_get_current_cert (store);
41 int depth = X509_STORE_CTX_get_error_depth (store);
42 int err = X509_STORE_CTX_get_error (store);
43
44 fprintf (stderr, "-Error with certificate at depth: %i\n", depth);
45 X509_NAME_oneline (X509_get_issuer_name (cert), data, sizeof (data));
46 fprintf (stderr, " issuer = %s\n", data);
47 X509_NAME_oneline (X509_get_subject_name (cert), data, sizeof (data));
48 fprintf (stderr, " subject = %s\n", data);
49 fprintf (stderr, " err %i:%s\n", err, X509_verify_cert_error_string (err));
50 }
51
52 return ok;
53 }
54
55
56 static int
57 gftp_ssl_post_connection_check (gftp_request * request)
58 {
59 char data[256], *extstr;
60 int extcount, ok, i, j;
61 X509_EXTENSION *ext;
62 X509_NAME *subj;
63 X509 *cert;
64
65 ok = 0;
66 if (!(cert = SSL_get_peer_certificate (request->ssl)))
67 {
68 request->logging_function (gftp_logging_error, request->user_data,
69 _("Cannot get peer certificate\n"));
70 return (X509_V_ERR_APPLICATION_VERIFICATION);
71 }
72
73 if ((extcount = X509_get_ext_count (cert)) > 0)
74 {
75 for (i = 0; i < extcount; i++)
76 {
77 ext = X509_get_ext (cert, i);
78 extstr = (char *) OBJ_nid2sn (OBJ_obj2nid (X509_EXTENSION_get_object (ext)));
79
80 if (strcmp (extstr, "subjectAltName") == 0)
81 {
82 unsigned char *data;
83 STACK_OF(CONF_VALUE) *val;
84 CONF_VALUE *nval;
85 X509V3_EXT_METHOD *meth;
86 void *ext_str = NULL;
87
88 if (!(meth = X509V3_EXT_get(ext)))
89 break;
90 data = ext->value->data;
91
92 #if (OPENSSL_VERSION_NUMBER > 0x00907000L)
93 if (meth->it)
94 ext_str = ASN1_item_d2i(NULL, &data, ext->value->length,
95 ASN1_ITEM_ptr(meth->it));
96 else
97 ext_str = meth->d2i(NULL, &data, ext->value->length);
98 #else
99 ext_str = meth->d2i(NULL, &data, ext->value->length);
100 #endif
101 val = meth->i2v(meth, ext_str, NULL);
102 for (j = 0; j < sk_CONF_VALUE_num(val); j++)
103 {
104 nval = sk_CONF_VALUE_value(val, j);
105 if (strcmp(nval->name, "DNS") == 0 && strcmp(nval->value, request->hostname) == 0)
106 {
107 ok = 1;
108 break;
109 }
110 }
111 }
112 if (ok)
113 break;
114 }
115 }
116
117 /* FIXME
118 if (!ok && (subj = X509_get_subject_name (cert)) &&
119 X509_NAME_get_text_by_NID (subj, NID_commonName, data, 256) > 0)
120 {
121 data[sizeof (data) - 1] = '\0';
122 if (strcasecmp (data, request->hostname) != 0)
123 {
124 request->logging_function (gftp_logging_error, request->user_data,
125 _("The SSL certificate's host %s does not match the host %s that we connected to\n"),
126 data, request->hostname);
127 X509_free (cert);
128 return (X509_V_ERR_APPLICATION_VERIFICATION);
129 }
130 }
131 */
132
133 X509_free (cert);
134 return (SSL_get_verify_result(request->ssl));
135 }
136
137
138 int
139 gftp_ssl_startup (gftp_request * request)
140 {
141 gftp_ssl_initialized = 1;
142
143 /* FIXME _ thread setup */
144 /* FIXME - only call this from one place */
145 if (!SSL_library_init ())
146 {
147 if (request != NULL)
148 request->logging_function (gftp_logging_error, request->user_data,
149 _("Cannot initialized the OpenSSL library\n"));
150 return (GFTP_EFATAL);
151 }
152
153 SSL_load_error_strings ();
154 RAND_load_file ("/dev/urandom", 1024); /* FIXME - be able to specify this file */
155
156 ctx = SSL_CTX_new (SSLv23_method ());
157
158 if (SSL_CTX_set_default_verify_paths (ctx) != 1)
159 {
160 request->logging_function (gftp_logging_error, request->user_data,
161 _("Error loading default SSL certificates\n"));
162 return (GFTP_EFATAL);
163 }
164
165 SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER, gftp_ssl_verify_callback);
166 SSL_CTX_set_verify_depth (ctx, 4);
167 SSL_CTX_set_options (ctx, SSL_OP_ALL|SSL_OP_NO_SSLv2);
168
169 if (SSL_CTX_set_cipher_list (ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH") != 1)
170 {
171 request->logging_function (gftp_logging_error, request->user_data,
172 _("Error setting cipher list (no valid ciphers)\n"));
173 return (GFTP_EFATAL);
174 }
175
176
177 return (0);
178 }
179
180
181 int
182 gftp_ssl_session_setup (gftp_request * request)
183 {
184 BIO * bio;
185 long ret;
186
187 g_return_val_if_fail (request->sockfd > 0, GFTP_EFATAL);
188
189 if (!gftp_ssl_initialized)
190 {
191 request->logging_function (gftp_logging_error, request->user_data,
192 _("Error: SSL engine was not initialized\n"));
193 return (GFTP_EFATAL);
194 }
195
196 if (gftp_fd_set_sockblocking (request, request->sockfd, 0) < 0) /* FIXME */
197 {
198 gftp_disconnect (request);
199 return (GFTP_ERETRYABLE);
200 }
201
202 if ((bio = BIO_new (BIO_s_socket ())) == NULL)
203 {
204 request->logging_function (gftp_logging_error, request->user_data,
205 _("Error setting up SSL connection (BIO object)\n"));
206 return (GFTP_EFATAL);
207 }
208
209 BIO_set_fd (bio, request->sockfd, BIO_NOCLOSE);
210
211 if ((request->ssl = SSL_new (ctx)) == NULL)
212 {
213 request->logging_function (gftp_logging_error, request->user_data,
214 _("Error setting up SSL connection (SSL object)\n"));
215 return (GFTP_EFATAL);
216 }
217
218 SSL_set_bio (request->ssl, bio, bio);
219
220 if (SSL_connect (request->ssl) <= 0)
221 {
222 request->logging_function (gftp_logging_error, request->user_data,
223 _("Error connecting to SSL object\n"));
224 return (GFTP_EFATAL);
225 }
226
227 if ((ret = gftp_ssl_post_connection_check (request)) != X509_V_OK)
228 {
229 request->logging_function (gftp_logging_error, request->user_data,
230 _("Error with peer certificate: %s\n"),
231 X509_verify_cert_error_string (ret));
232 return (GFTP_EFATAL);
233 }
234
235 request->logging_function (gftp_logging_misc, request->user_data,
236 "SSL connection established using %s (%s)\n",
237 SSL_get_cipher_version (request->ssl),
238 SSL_get_cipher_name (request->ssl));
239
240 return (0);
241 }
242
243
244 ssize_t
245 gftp_ssl_read (gftp_request * request, void *ptr, size_t size, int fd)
246 {
247 ssize_t ret;
248 int err;
249
250 if (!gftp_ssl_initialized)
251 {
252 request->logging_function (gftp_logging_error, request->user_data,
253 _("Error: SSL engine was not initialized\n"));
254 return (GFTP_EFATAL);
255 }
256
257 errno = 0;
258 ret = 0;
259 do
260 {
261 if ((ret = SSL_read (request->ssl, ptr, size)) < 0)
262 {
263 err = SSL_get_error (request->ssl, ret);
264 printf ("error is %d\n", err);
265 if (errno == EINTR)
266 {
267 if (request != NULL && request->cancel)
268 break;
269 else
270 continue;
271 }
272
273 if (request != NULL)
274 {
275 request->logging_function (gftp_logging_error, request->user_data,
276 _("Error: Could not read from socket: %s\n"),
277 g_strerror (errno));
278 gftp_disconnect (request);
279 }
280 return (GFTP_ERETRYABLE);
281 }
282 }
283 while (errno == EINTR && !(request != NULL && request->cancel));
284
285 if (errno == EINTR && request != NULL && request->cancel)
286 {
287 gftp_disconnect (request);
288 return (GFTP_ERETRYABLE);
289 }
290
291 return (ret);
292 }
293
294
295 ssize_t
296 gftp_ssl_write (gftp_request * request, const char *ptr, size_t size, int fd)
297 {
298 size_t ret, w_ret;
299
300 if (!gftp_ssl_initialized)
301 {
302 request->logging_function (gftp_logging_error, request->user_data,
303 _("Error: SSL engine was not initialized\n"));
304 return (GFTP_EFATAL);
305 }
306
307 ret = 0;
308 do
309 {
310 w_ret = SSL_write (request->ssl, ptr, size);
311 if (w_ret <= 0)
312 {
313 if (errno == EINTR)
314 {
315 if (request != NULL && request->cancel)
316 break;
317 else
318 continue;
319 }
320
321 if (request != NULL)
322 {
323 request->logging_function (gftp_logging_error, request->user_data,
324 _("Error: Could not write to socket: %s\n"),
325 g_strerror (errno));
326 gftp_disconnect (request);
327 }
328 return (GFTP_ERETRYABLE);
329 }
330 ptr += w_ret;
331 size -= w_ret;
332 ret += w_ret;
333 }
334 while (size > 0);
335
336 if (errno == EINTR && request != NULL && request->cancel)
337 {
338 gftp_disconnect (request);
339 return (GFTP_ERETRYABLE);
340 }
341
342 return (ret);
343 }
344
345 #endif