From eec181b58d2eebe3eb2111dea7e1cc52c2ef60f5 Mon Sep 17 00:00:00 2001 From: Art Cancro Date: Sat, 30 Dec 2017 19:01:00 -0500 Subject: [PATCH] serv_crypto.c: minor style cleanups before we try to make it work with openssl 1.1 --- citadel/modules/crypto/serv_crypto.c | 125 +++++++++------------------ 1 file changed, 39 insertions(+), 86 deletions(-) diff --git a/citadel/modules/crypto/serv_crypto.c b/citadel/modules/crypto/serv_crypto.c index 6296e5dc3..37bcecba8 100644 --- a/citadel/modules/crypto/serv_crypto.c +++ b/citadel/modules/crypto/serv_crypto.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1987-2015 by the citadel.org team + * Copyright (c) 1987-2017 by the citadel.org team * * This program is open source software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 3. @@ -51,8 +51,6 @@ #include "ctdl_module.h" -/* TODO: should we use the standard module init stuff to start this? */ -/* TODO: should we register an event handler to call destruct_ssl? */ #ifdef HAVE_OPENSSL SSL_CTX *ssl_ctx; /* SSL context */ @@ -86,13 +84,12 @@ void init_ssl(void) RAND_egd(EGD_POOL); if (!RAND_status()) { - syslog(LOG_CRIT, "PRNG not adequately seeded, won't do SSL/TLS"); + syslog(LOG_ERR, "PRNG not adequately seeded, won't do SSL/TLS"); return; } - SSLCritters = - malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t *)); + SSLCritters = malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t *)); if (!SSLCritters) { - syslog(LOG_EMERG, "citserver: can't allocate memory!!"); + syslog(LOG_ERR, "citserver: can't allocate memory!!"); /* Nothing's been initialized, just die */ exit(1); } else { @@ -116,51 +113,19 @@ void init_ssl(void) SSL_load_error_strings(); ssl_method = SSLv23_server_method(); if (!(ssl_ctx = SSL_CTX_new(ssl_method))) { - syslog(LOG_CRIT, "SSL_CTX_new failed: %s", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "SSL_CTX_new failed: %s", ERR_reason_error_string(ERR_get_error())); return; } if (!(SSL_CTX_set_cipher_list(ssl_ctx, CIT_CIPHERS))) { - syslog(LOG_CRIT, "SSL: No ciphers available"); + syslog(LOG_ERR, "SSL: No ciphers available"); SSL_CTX_free(ssl_ctx); ssl_ctx = NULL; return; } -#if 0 -#if SSLEAY_VERSION_NUMBER >= 0x00906000L - SSL_CTX_set_mode(ssl_ctx, SSL_CTX_get_mode(ssl_ctx) | - SSL_MODE_AUTO_RETRY); -#endif -#endif CRYPTO_set_locking_callback(ssl_lock); CRYPTO_set_id_callback(id_callback); -#if 0 // this doesn't work in newer openssl - /* Load DH parameters into the context */ - DH *dh = DH_new(); - if (!dh) { - syslog(LOG_CRIT, "init_ssl() can't allocate a DH object: %s", ERR_reason_error_string(ERR_get_error())); - SSL_CTX_free(ssl_ctx); - ssl_ctx = NULL; - return; - } - if (!(BN_hex2bn(&(dh->p), DH_P))) { - syslog(LOG_CRIT, "init_ssl() can't assign DH_P: %s", ERR_reason_error_string(ERR_get_error())); - SSL_CTX_free(ssl_ctx); - ssl_ctx = NULL; - return; - } - if (!(BN_hex2bn(&(dh->g), DH_G))) { - syslog(LOG_CRIT, "init_ssl() can't assign DH_G: %s", ERR_reason_error_string(ERR_get_error())); - SSL_CTX_free(ssl_ctx); - ssl_ctx = NULL; - return; - } - dh->length = DH_L; - SSL_CTX_set_tmp_dh(ssl_ctx, dh); - DH_free(dh); -#endif // this doesn't work in newer openssl - /* Get our certificates in order. * First, create the key/cert directory if it's not there already... */ @@ -176,7 +141,7 @@ void init_ssl(void) NULL, /* no callback */ NULL); /* no callback */ if (rsa == NULL) { - syslog(LOG_CRIT, "Key generation failed: %s", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "Key generation failed: %s", ERR_reason_error_string(ERR_get_error())); } if (rsa != NULL) { fp = fopen(file_crpt_file_key, "w"); @@ -190,7 +155,7 @@ void init_ssl(void) NULL, /* no callbk */ NULL /* no callbk */ ) != 1) { - syslog(LOG_CRIT, "Cannot write key: %s", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "Cannot write key: %s", ERR_reason_error_string(ERR_get_error())); unlink(file_crpt_file_key); } fclose(fp); @@ -243,7 +208,7 @@ void init_ssl(void) /* Sign the CSR */ if (!X509_REQ_sign(req, pk, EVP_md5())) { - syslog(LOG_CRIT, "X509_REQ_sign(): error"); + syslog(LOG_ERR, "X509_REQ_sign(): error"); } else { /* Write it to disk. */ @@ -263,12 +228,11 @@ void init_ssl(void) } else { - syslog(LOG_CRIT, "Unable to read private key."); + syslog(LOG_ERR, "Unable to read private key."); } } - /* * Generate a self-signed certificate if we don't have one. */ @@ -313,7 +277,7 @@ void init_ssl(void) /* Sign the cert */ if (!X509_sign(cer, pk, EVP_md5())) { - syslog(LOG_CRIT, "X509_sign(): error"); + syslog(LOG_ERR, "X509_sign(): error"); } else { /* Write it to disk. */ @@ -339,13 +303,12 @@ void init_ssl(void) SSL_CTX_use_certificate_chain_file(ssl_ctx, file_crpt_file_cer); SSL_CTX_use_PrivateKey_file(ssl_ctx, file_crpt_file_key, SSL_FILETYPE_PEM); if ( !SSL_CTX_check_private_key(ssl_ctx) ) { - syslog(LOG_CRIT, "Cannot install certificate: %s", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "Cannot install certificate: %s", ERR_reason_error_string(ERR_get_error())); } /* Finally let the server know we're here */ CtdlRegisterProtoHook(cmd_stls, "STLS", "Start SSL/TLS session"); - CtdlRegisterProtoHook(cmd_gtls, "GTLS", - "Get SSL/TLS session status"); + CtdlRegisterProtoHook(cmd_gtls, "GTLS", "Get SSL/TLS session status"); CtdlRegisterSessionHook(endtls, EVT_STOP, PRIO_STOP + 10); } @@ -436,27 +399,23 @@ int client_readline_sslbuffer(StrBuf *Line, StrBuf *IOBuf, const char **Pos, int int nSuccessLess = 0; const char *pch = NULL; - if ((Line == NULL) || - (Pos == NULL) || - (IOBuf == NULL)) + if ((Line == NULL) || (Pos == NULL) || (IOBuf == NULL)) { if (Pos != NULL) + { *Pos = NULL; -// *Error = ErrRBLF_PreConditionFailed; + } return -1; } pos = *Pos; - if ((StrLength(IOBuf) > 0) && - (pos != NULL) && - (pos < ChrPtr(IOBuf) + StrLength(IOBuf))) + if ((StrLength(IOBuf) > 0) && (pos != NULL) && (pos < ChrPtr(IOBuf) + StrLength(IOBuf))) { pch = pos; pch = strchr(pch, '\n'); if (pch == NULL) { - StrBufAppendBufPlain(Line, pos, - StrLength(IOBuf) - (pos - ChrPtr(IOBuf)), 0); + StrBufAppendBufPlain(Line, pos, StrLength(IOBuf) - (pos - ChrPtr(IOBuf)), 0); FlushStrBuf(IOBuf); *Pos = NULL; } @@ -486,9 +445,6 @@ int client_readline_sslbuffer(StrBuf *Line, StrBuf *IOBuf, const char **Pos, int rlen = client_read_sslbuffer(IOBuf, timeout); if (rlen < 1) { -// *Error = strerror(errno); -// close(*fd); -// *fd = -1; return -1; } else if (rlen > 0) { @@ -510,12 +466,10 @@ int client_readline_sslbuffer(StrBuf *Line, StrBuf *IOBuf, const char **Pos, int *Pos = pLF + 1; return StrLength(Line); } -// *Error = ErrRBLF_NotEnoughSentFromServer; return -1; } - int client_read_sslblob(StrBuf *Target, long bytes, int timeout) { long baselen; @@ -532,17 +486,19 @@ int client_read_sslblob(StrBuf *Target, long bytes, int timeout) const char *pchs; if (CCC->RecvBuf.ReadWritePointer == NULL) + { CCC->RecvBuf.ReadWritePointer = ChrPtr(CCC->RecvBuf.Buf); + } pchs = ChrPtr(CCC->RecvBuf.Buf); TotalLen = StrLength(CCC->RecvBuf.Buf); RemainLen = TotalLen - (pchs - CCC->RecvBuf.ReadWritePointer); if (RemainLen > bytes) + { RemainLen = bytes; + } if (RemainLen > 0) { - StrBufAppendBufPlain(Target, - CCC->RecvBuf.ReadWritePointer, - RemainLen, 0); + StrBufAppendBufPlain(Target, CCC->RecvBuf.ReadWritePointer, RemainLen, 0); CCC->RecvBuf.ReadWritePointer += RemainLen; } if ((ChrPtr(CCC->RecvBuf.Buf) + StrLength(CCC->RecvBuf.Buf)) <= CCC->RecvBuf.ReadWritePointer) @@ -553,12 +509,13 @@ int client_read_sslblob(StrBuf *Target, long bytes, int timeout) } if (StrLength(Target) >= bytes + baselen) + { return 1; + } CCC->RecvBuf.ReadWritePointer = NULL; - while ((StrLength(Target) < bytes + baselen) && - (retval >= 0)) + while ((StrLength(Target) < bytes + baselen) && (retval >= 0)) { retval = client_read_sslbuffer(CCC->RecvBuf.Buf, timeout); if (retval >= 0) { @@ -591,24 +548,23 @@ int client_read_sslblob(StrBuf *Target, long bytes, int timeout) * must be supplied with pre-generated strings for responses of "ok," "no * support for TLS," and "error" so that we can use this in any protocol. */ -void CtdlStartTLS(char *ok_response, char *nosup_response, - char *error_response) { - +void CtdlStartTLS(char *ok_response, char *nosup_response, char *error_response) +{ int retval, bits, alg_bits; if (!ssl_ctx) { - syslog(LOG_CRIT, "SSL failed: no ssl_ctx exists?"); + syslog(LOG_ERR, "SSL failed: no ssl_ctx exists?"); if (nosup_response != NULL) cprintf("%s", nosup_response); return; } if (!(CC->ssl = SSL_new(ssl_ctx))) { - syslog(LOG_CRIT, "SSL_new failed: %s", + syslog(LOG_ERR, "SSL_new failed: %s", ERR_reason_error_string(ERR_get_error())); if (error_response != NULL) cprintf("%s", error_response); return; } if (!(SSL_set_fd(CC->ssl, CC->client_socket))) { - syslog(LOG_CRIT, "SSL_set_fd failed: %s", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "SSL_set_fd failed: %s", ERR_reason_error_string(ERR_get_error())); SSL_free(CC->ssl); CC->ssl = NULL; if (error_response != NULL) cprintf("%s", error_response); @@ -626,7 +582,7 @@ void CtdlStartTLS(char *ok_response, char *nosup_response, char error_string[128]; errval = SSL_get_error(CC->ssl, retval); - syslog(LOG_CRIT, "SSL_accept failed: retval=%d, errval=%ld, err=%s", + syslog(LOG_ERR, "SSL_accept failed: retval=%d, errval=%ld, err=%s", retval, errval, ERR_error_string(errval, error_string) @@ -656,15 +612,9 @@ void cmd_stls(char *params) unbuffer_output(); - sprintf(ok_response, - "%d Begin TLS negotiation now\n", - CIT_OK); - sprintf(nosup_response, - "%d TLS not supported here\n", - ERROR + CMD_NOT_SUPPORTED); - sprintf(error_response, - "%d TLS negotiation error\n", - ERROR + INTERNAL_ERROR); + sprintf(ok_response, "%d Begin TLS negotiation now\n", CIT_OK); + sprintf(nosup_response, "%d TLS not supported here\n", ERROR + CMD_NOT_SUPPORTED); + sprintf(error_response, "%d TLS negotiation error\n", ERROR + INTERNAL_ERROR); CtdlStartTLS(ok_response, nosup_response, error_response); } @@ -718,8 +668,11 @@ void endtls(void) void ssl_lock(int mode, int n, const char *file, int line) { if (mode & CRYPTO_LOCK) + { pthread_mutex_lock(SSLCritters[n]); - else + } + else { pthread_mutex_unlock(SSLCritters[n]); + } } #endif /* HAVE_OPENSSL */ -- 2.30.2