X-Git-Url: https://code.citadel.org/?a=blobdiff_plain;f=citadel%2Fmodules%2Fcrypto%2Fserv_crypto.c;h=77b5b1914fefad0b59023dd0c611ee73807e2159;hb=7a9b0685e406cc83597171cc39d008c7e5459ca8;hp=21ccd82517b20e0f55fb3a489a3be215b1b89bdd;hpb=8c47559cb5ae97ec0fa35660ee16fd61a9451c72;p=citadel.git diff --git a/citadel/modules/crypto/serv_crypto.c b/citadel/modules/crypto/serv_crypto.c index 21ccd8251..77b5b1914 100644 --- a/citadel/modules/crypto/serv_crypto.c +++ b/citadel/modules/crypto/serv_crypto.c @@ -1,20 +1,13 @@ -/* $Id$ - * - * Copyright (c) 1987-2009 by the citadel.org team - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. +/* + * Copyright (c) 1987-2018 by the citadel.org team * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * This program is open source software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 3. * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. */ #include @@ -29,16 +22,7 @@ #include #endif -#if TIME_WITH_SYS_TIME -# include -# include -#else -# if HAVE_SYS_TIME_H -# include -# else -# include -# endif -#endif +#include #ifdef HAVE_PTHREAD_H #include @@ -58,8 +42,6 @@ #include "ctdl_module.h" -/* TODO: should we use the standard module init stuff to start this? */ -/* TODO: should we register an event handler to call destruct_ssl? */ #ifdef HAVE_OPENSSL SSL_CTX *ssl_ctx; /* SSL context */ @@ -78,11 +60,64 @@ void destruct_ssl(void) free (SSLCritters); } + +void generate_key(char *keyfilename) +{ + int ret = 0; + RSA *rsa = NULL; + BIGNUM *bne = NULL; + int bits = 2048; + unsigned long e = RSA_F4; + FILE *fp; + + if (access(keyfilename, R_OK) == 0) { + return; + } + + syslog(LOG_INFO, "crypto: generating RSA key pair"); + + // generate rsa key + bne = BN_new(); + ret = BN_set_word(bne,e); + if (ret != 1) { + goto free_all; + } + + rsa = RSA_new(); + ret = RSA_generate_key_ex(rsa, bits, bne, NULL); + if (ret != 1) { + goto free_all; + } + + // write the key file + fp = fopen(keyfilename, "w"); + if (fp != NULL) { + chmod(keyfilename, 0600); + if (PEM_write_RSAPrivateKey(fp, /* the file */ + rsa, /* the key */ + NULL, /* no enc */ + NULL, /* no passphr */ + 0, /* no passphr */ + NULL, /* no callbk */ + NULL /* no callbk */ + ) != 1) { + syslog(LOG_ERR, "crypto: cannot write key: %s", ERR_reason_error_string(ERR_get_error())); + unlink(keyfilename); + } + fclose(fp); + } + + // 4. free +free_all: + RSA_free(rsa); + BN_free(bne); +} + + void init_ssl(void) { - SSL_METHOD *ssl_method; - DH *dh; - RSA *rsa=NULL; + const SSL_METHOD *ssl_method; + RSA *rsa = NULL; X509_REQ *req = NULL; X509 *cer = NULL; EVP_PKEY *pk = NULL; @@ -90,30 +125,18 @@ void init_ssl(void) X509_NAME *name = NULL; FILE *fp; - if (!access(EGD_POOL, F_OK)) - RAND_egd(EGD_POOL); - - if (!RAND_status()) { - CtdlLogPrintf(CTDL_CRIT, - "PRNG not adequately seeded, won't do SSL/TLS\n"); - return; - } - SSLCritters = - malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t *)); + SSLCritters = malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t *)); if (!SSLCritters) { - CtdlLogPrintf(CTDL_EMERG, "citserver: can't allocate memory!!\n"); - /* Nothing's been initialized, just die */ - exit(1); + syslog(LOG_ERR, "crypto: can't allocate memory!"); + exit(CTDLEXIT_CRYPTO); } else { int a; for (a = 0; a < CRYPTO_num_locks(); a++) { SSLCritters[a] = malloc(sizeof(pthread_mutex_t)); if (!SSLCritters[a]) { - CtdlLogPrintf(CTDL_EMERG, - "citserver: can't allocate memory!!\n"); - /* Nothing's been initialized, just die */ - exit(1); + syslog(LOG_ERR, "crypto: can't allocate memory!!"); + exit(CTDLEXIT_CRYPTO); } pthread_mutex_init(SSLCritters[a], NULL); } @@ -126,92 +149,21 @@ void init_ssl(void) SSL_load_error_strings(); ssl_method = SSLv23_server_method(); if (!(ssl_ctx = SSL_CTX_new(ssl_method))) { - CtdlLogPrintf(CTDL_CRIT, "SSL_CTX_new failed: %s\n", - ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "crypto: SSL_CTX_new failed: %s", ERR_reason_error_string(ERR_get_error())); return; } if (!(SSL_CTX_set_cipher_list(ssl_ctx, CIT_CIPHERS))) { - CtdlLogPrintf(CTDL_CRIT, "SSL: No ciphers available\n"); + syslog(LOG_ERR, "crypto: No ciphers available"); SSL_CTX_free(ssl_ctx); ssl_ctx = NULL; return; } -#if 0 -#if SSLEAY_VERSION_NUMBER >= 0x00906000L - SSL_CTX_set_mode(ssl_ctx, SSL_CTX_get_mode(ssl_ctx) | - SSL_MODE_AUTO_RETRY); -#endif -#endif CRYPTO_set_locking_callback(ssl_lock); CRYPTO_set_id_callback(id_callback); - /* Load DH parameters into the context */ - dh = DH_new(); - if (!dh) { - CtdlLogPrintf(CTDL_CRIT, "init_ssl() can't allocate a DH object: %s\n", - ERR_reason_error_string(ERR_get_error())); - SSL_CTX_free(ssl_ctx); - ssl_ctx = NULL; - return; - } - if (!(BN_hex2bn(&(dh->p), DH_P))) { - CtdlLogPrintf(CTDL_CRIT, "init_ssl() can't assign DH_P: %s\n", - ERR_reason_error_string(ERR_get_error())); - SSL_CTX_free(ssl_ctx); - ssl_ctx = NULL; - return; - } - if (!(BN_hex2bn(&(dh->g), DH_G))) { - CtdlLogPrintf(CTDL_CRIT, "init_ssl() can't assign DH_G: %s\n", - ERR_reason_error_string(ERR_get_error())); - SSL_CTX_free(ssl_ctx); - ssl_ctx = NULL; - return; - } - dh->length = DH_L; - SSL_CTX_set_tmp_dh(ssl_ctx, dh); - DH_free(dh); - - /* Get our certificates in order. - * First, create the key/cert directory if it's not there already... - */ - mkdir(ctdl_key_dir, 0700); - - /* - * Generate a key pair if we don't have one. - */ - if (access(file_crpt_file_key, R_OK) != 0) { - CtdlLogPrintf(CTDL_INFO, "Generating RSA key pair.\n"); - rsa = RSA_generate_key(1024, /* modulus size */ - 65537, /* exponent */ - NULL, /* no callback */ - NULL); /* no callback */ - if (rsa == NULL) { - CtdlLogPrintf(CTDL_CRIT, "Key generation failed: %s\n", - ERR_reason_error_string(ERR_get_error())); - } - if (rsa != NULL) { - fp = fopen(file_crpt_file_key, "w"); - if (fp != NULL) { - chmod(file_crpt_file_key, 0600); - if (PEM_write_RSAPrivateKey(fp, /* the file */ - rsa, /* the key */ - NULL, /* no enc */ - NULL, /* no passphr */ - 0, /* no passphr */ - NULL, /* no callbk */ - NULL /* no callbk */ - ) != 1) { - CtdlLogPrintf(CTDL_CRIT, "Cannot write key: %s\n", - ERR_reason_error_string(ERR_get_error())); - unlink(file_crpt_file_key); - } - fclose(fp); - } - RSA_free(rsa); - } - } + mkdir(ctdl_key_dir, 0700); // If the keys directory does not exist, create it + generate_key(file_crpt_file_key); // If a private key does not exist, create it /* * If there is no certificate file on disk, we will be generating a self-signed certificate @@ -219,7 +171,7 @@ void init_ssl(void) * the CSR in this step so that the next step may commence. */ if ( (access(file_crpt_file_cer, R_OK) != 0) && (access(file_crpt_file_csr, R_OK) != 0) ) { - CtdlLogPrintf(CTDL_INFO, "Generating a certificate signing request.\n"); + syslog(LOG_INFO, "crypto: generating a generic certificate signing request."); /* * Read our key from the file. No, we don't just keep this @@ -247,36 +199,17 @@ void init_ssl(void) name = X509_REQ_get_subject_name(req); /* Tell it who we are */ - - /* - X509_NAME_add_entry_by_txt(name, "C", - MBSTRING_ASC, "US", -1, -1, 0); - - X509_NAME_add_entry_by_txt(name, "ST", - MBSTRING_ASC, "New York", -1, -1, 0); - - X509_NAME_add_entry_by_txt(name, "L", - MBSTRING_ASC, "Mount Kisco", -1, -1, 0); - */ - - X509_NAME_add_entry_by_txt(name, "O", - MBSTRING_ASC, config.c_humannode, -1, -1, 0); - - X509_NAME_add_entry_by_txt(name, "OU", - MBSTRING_ASC, "Citadel server", -1, -1, 0); - - /* X509_NAME_add_entry_by_txt(name, "CN", - MBSTRING_ASC, config.c_fqdn, -1, -1, 0); - */ - - X509_NAME_add_entry_by_txt(name, "CN", - MBSTRING_ASC, "*", -1, -1, 0); - + X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, (unsigned const char *)"ZZ", -1, -1, 0); + X509_NAME_add_entry_by_txt(name, "ST", MBSTRING_ASC, (unsigned const char *)"The World", -1, -1, 0); + X509_NAME_add_entry_by_txt(name, "L", MBSTRING_ASC, (unsigned const char *)"My Location", -1, -1, 0); + X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, (unsigned const char *)"Generic certificate", -1, -1, 0); + X509_NAME_add_entry_by_txt(name, "OU", MBSTRING_ASC, (unsigned const char *)"Citadel server", -1, -1, 0); + X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned const char *)"*", -1, -1, 0); X509_REQ_set_subject_name(req, name); /* Sign the CSR */ if (!X509_REQ_sign(req, pk, EVP_md5())) { - CtdlLogPrintf(CTDL_CRIT, "X509_REQ_sign(): error\n"); + syslog(LOG_ERR, "crypto: X509_REQ_sign(): error"); } else { /* Write it to disk. */ @@ -296,17 +229,16 @@ void init_ssl(void) } else { - CtdlLogPrintf(CTDL_CRIT, "Unable to read private key.\n"); + syslog(LOG_ERR, "crypto: unable to read private key."); } } - /* * Generate a self-signed certificate if we don't have one. */ if (access(file_crpt_file_cer, R_OK) != 0) { - CtdlLogPrintf(CTDL_INFO, "Generating a self-signed certificate.\n"); + syslog(LOG_INFO, "crypto: generating a generic self-signed certificate."); /* Same deal as before: always read the key from disk because * it may or may not have just been generated. @@ -334,10 +266,9 @@ void init_ssl(void) if (req) { if (cer = X509_new(), cer != NULL) { - ASN1_INTEGER_set(X509_get_serialNumber(cer), 0); - X509_set_issuer_name(cer, req->req_info->subject); - X509_set_subject_name(cer, req->req_info->subject); + X509_set_issuer_name(cer, X509_REQ_get_subject_name(req)); + X509_set_subject_name(cer, X509_REQ_get_subject_name(req)); X509_gmtime_adj(X509_get_notBefore(cer),0); X509_gmtime_adj(X509_get_notAfter(cer),(long)60*60*24*SIGN_DAYS); req_pkey = X509_REQ_get_pubkey(req); @@ -346,7 +277,7 @@ void init_ssl(void) /* Sign the cert */ if (!X509_sign(cer, pk, EVP_md5())) { - CtdlLogPrintf(CTDL_CRIT, "X509_sign(): error\n"); + syslog(LOG_ERR, "crypto: X509_sign() error"); } else { /* Write it to disk. */ @@ -372,22 +303,20 @@ void init_ssl(void) SSL_CTX_use_certificate_chain_file(ssl_ctx, file_crpt_file_cer); SSL_CTX_use_PrivateKey_file(ssl_ctx, file_crpt_file_key, SSL_FILETYPE_PEM); if ( !SSL_CTX_check_private_key(ssl_ctx) ) { - CtdlLogPrintf(CTDL_CRIT, "Cannot install certificate: %s\n", - ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "crypto: cannot install certificate: %s", ERR_reason_error_string(ERR_get_error())); } /* Finally let the server know we're here */ CtdlRegisterProtoHook(cmd_stls, "STLS", "Start SSL/TLS session"); - CtdlRegisterProtoHook(cmd_gtls, "GTLS", - "Get SSL/TLS session status"); - CtdlRegisterSessionHook(endtls, EVT_STOP); + CtdlRegisterProtoHook(cmd_gtls, "GTLS", "Get SSL/TLS session status"); + CtdlRegisterSessionHook(endtls, EVT_STOP, PRIO_STOP + 10); } /* * client_write_ssl() Send binary data to the client encrypted. */ -void client_write_ssl(char *buf, int nbytes) +void client_write_ssl(const char *buf, int nbytes) { int retval; int nremain; @@ -398,7 +327,7 @@ void client_write_ssl(char *buf, int nbytes) while (nremain > 0) { if (SSL_want_write(CC->ssl)) { if ((SSL_read(CC->ssl, junk, 0)) < 1) { - CtdlLogPrintf(CTDL_DEBUG, "SSL_read in client_write: %s\n", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_DEBUG, "crypto: SSL_read in client_write: %s", ERR_reason_error_string(ERR_get_error())); } } retval = @@ -412,9 +341,10 @@ void client_write_ssl(char *buf, int nbytes) sleep(1); continue; } - CtdlLogPrintf(CTDL_DEBUG, "SSL_write got error %ld, ret %d\n", errval, retval); - if (retval == -1) - CtdlLogPrintf(CTDL_DEBUG, "errno is %d\n", errno); + syslog(LOG_DEBUG, "crypto: SSL_write got error %ld, ret %d", errval, retval); + if (retval == -1) { + syslog(LOG_DEBUG, "crypto: errno is %d", errno); + } endtls(); client_write(&buf[nbytes - nremain], nremain); return; @@ -425,62 +355,192 @@ void client_write_ssl(char *buf, int nbytes) /* - * client_read_ssl() - read data from the encrypted layer. + * read data from the encrypted layer. */ -int client_read_ssl(char *buf, int bytes, int timeout) +int client_read_sslbuffer(StrBuf *buf, int timeout) { -#if 0 - fd_set rfds; - struct timeval tv; - int retval; - int s; -#endif - int len, rlen; + char sbuf[16384]; /* OpenSSL communicates in 16k blocks, so let's speak its native tongue. */ + int rlen; char junk[1]; + SSL *pssl = CC->ssl; - len = 0; - while (len < bytes) { -#if 0 - /* - * This code is disabled because we don't need it when - * using blocking reads (which we are). -IO - */ - FD_ZERO(&rfds); - s = BIO_get_fd(CC->ssl->rbio, NULL); - FD_SET(s, &rfds); - tv.tv_sec = timeout; - tv.tv_usec = 0; - - retval = select(s + 1, &rfds, NULL, NULL, &tv); + if (pssl == NULL) return(-1); - if (FD_ISSET(s, &rfds) == 0) { - return (0); - } - -#endif - if (SSL_want_read(CC->ssl)) { - if ((SSL_write(CC->ssl, junk, 0)) < 1) { - CtdlLogPrintf(CTDL_DEBUG, "SSL_write in client_read: %s\n", ERR_reason_error_string(ERR_get_error())); + while (1) { + if (SSL_want_read(pssl)) { + if ((SSL_write(pssl, junk, 0)) < 1) { + syslog(LOG_DEBUG, "crypto: SSL_write in client_read"); } } - rlen = SSL_read(CC->ssl, &buf[len], bytes - len); + rlen = SSL_read(pssl, sbuf, sizeof(sbuf)); if (rlen < 1) { long errval; - errval = SSL_get_error(CC->ssl, rlen); - if (errval == SSL_ERROR_WANT_READ || - errval == SSL_ERROR_WANT_WRITE) { + errval = SSL_get_error(pssl, rlen); + if (errval == SSL_ERROR_WANT_READ || errval == SSL_ERROR_WANT_WRITE) { sleep(1); continue; } - CtdlLogPrintf(CTDL_DEBUG, "SSL_read got error %ld\n", errval); + syslog(LOG_DEBUG, "crypto: SSL_read got error %ld", errval); endtls(); - return (client_read_to - (&buf[len], bytes - len, timeout)); + return (-1); } - len += rlen; + StrBufAppendBufPlain(buf, sbuf, rlen, 0); + return rlen; } - return (1); + return (0); +} + +int client_readline_sslbuffer(StrBuf *Line, StrBuf *IOBuf, const char **Pos, int timeout) +{ + CitContext *CCC = CC; + const char *pos = NULL; + const char *pLF; + int len, rlen; + int nSuccessLess = 0; + const char *pch = NULL; + + if ((Line == NULL) || (Pos == NULL) || (IOBuf == NULL)) + { + if (Pos != NULL) + { + *Pos = NULL; + } + return -1; + } + + pos = *Pos; + if ((StrLength(IOBuf) > 0) && (pos != NULL) && (pos < ChrPtr(IOBuf) + StrLength(IOBuf))) + { + pch = pos; + pch = strchr(pch, '\n'); + + if (pch == NULL) { + StrBufAppendBufPlain(Line, pos, StrLength(IOBuf) - (pos - ChrPtr(IOBuf)), 0); + FlushStrBuf(IOBuf); + *Pos = NULL; + } + else { + int n = 0; + if ((pch > ChrPtr(IOBuf)) && + (*(pch - 1) == '\r')) { + n = 1; + } + StrBufAppendBufPlain(Line, pos, + (pch - pos - n), 0); + + if (StrLength(IOBuf) <= (pch - ChrPtr(IOBuf) + 1)) { + FlushStrBuf(IOBuf); + *Pos = NULL; + } + else + *Pos = pch + 1; + return StrLength(Line); + } + } + + pLF = NULL; + while ((nSuccessLess < timeout) && + (pLF == NULL) && + (CCC->ssl != NULL)) { + + rlen = client_read_sslbuffer(IOBuf, timeout); + if (rlen < 1) { + return -1; + } + else if (rlen > 0) { + pLF = strchr(ChrPtr(IOBuf), '\n'); + } + } + *Pos = NULL; + if (pLF != NULL) { + pos = ChrPtr(IOBuf); + len = pLF - pos; + if (len > 0 && (*(pLF - 1) == '\r') ) + len --; + StrBufAppendBufPlain(Line, pos, len, 0); + if (pLF + 1 >= ChrPtr(IOBuf) + StrLength(IOBuf)) + { + FlushStrBuf(IOBuf); + } + else + *Pos = pLF + 1; + return StrLength(Line); + } + return -1; +} + + +int client_read_sslblob(StrBuf *Target, long bytes, int timeout) +{ + long baselen; + long RemainRead; + int retval = 0; + CitContext *CCC = CC; + + baselen = StrLength(Target); + + if (StrLength(CCC->RecvBuf.Buf) > 0) + { + long RemainLen; + long TotalLen; + const char *pchs; + + if (CCC->RecvBuf.ReadWritePointer == NULL) + { + CCC->RecvBuf.ReadWritePointer = ChrPtr(CCC->RecvBuf.Buf); + } + pchs = ChrPtr(CCC->RecvBuf.Buf); + TotalLen = StrLength(CCC->RecvBuf.Buf); + RemainLen = TotalLen - (pchs - CCC->RecvBuf.ReadWritePointer); + if (RemainLen > bytes) + { + RemainLen = bytes; + } + if (RemainLen > 0) + { + StrBufAppendBufPlain(Target, CCC->RecvBuf.ReadWritePointer, RemainLen, 0); + CCC->RecvBuf.ReadWritePointer += RemainLen; + } + if ((ChrPtr(CCC->RecvBuf.Buf) + StrLength(CCC->RecvBuf.Buf)) <= CCC->RecvBuf.ReadWritePointer) + { + CCC->RecvBuf.ReadWritePointer = NULL; + FlushStrBuf(CCC->RecvBuf.Buf); + } + } + + if (StrLength(Target) >= bytes + baselen) + { + return 1; + } + + CCC->RecvBuf.ReadWritePointer = NULL; + + while ((StrLength(Target) < bytes + baselen) && (retval >= 0)) + { + retval = client_read_sslbuffer(CCC->RecvBuf.Buf, timeout); + if (retval >= 0) { + RemainRead = bytes - (StrLength (Target) - baselen); + if (RemainRead < StrLength(CCC->RecvBuf.Buf)) + { + StrBufAppendBufPlain( + Target, + ChrPtr(CCC->RecvBuf.Buf), + RemainRead, 0); + CCC->RecvBuf.ReadWritePointer = ChrPtr(CCC->RecvBuf.Buf) + RemainRead; + break; + } + StrBufAppendBuf(Target, CCC->RecvBuf.Buf, 0); /* todo: Buf > bytes? */ + FlushStrBuf(CCC->RecvBuf.Buf); + } + else + { + FlushStrBuf(CCC->RecvBuf.Buf); + return -1; + + } + } + return 1; } @@ -489,25 +549,24 @@ int client_read_ssl(char *buf, int bytes, int timeout) * must be supplied with pre-generated strings for responses of "ok," "no * support for TLS," and "error" so that we can use this in any protocol. */ -void CtdlStartTLS(char *ok_response, char *nosup_response, - char *error_response) { - +void CtdlStartTLS(char *ok_response, char *nosup_response, char *error_response) +{ int retval, bits, alg_bits; if (!ssl_ctx) { - CtdlLogPrintf(CTDL_CRIT, "SSL failed: no ssl_ctx exists?\n"); + syslog(LOG_ERR, "crypto: SSL failed: no ssl_ctx exists?"); if (nosup_response != NULL) cprintf("%s", nosup_response); return; } if (!(CC->ssl = SSL_new(ssl_ctx))) { - CtdlLogPrintf(CTDL_CRIT, "SSL_new failed: %s\n", - ERR_reason_error_string(ERR_get_error())); - if (error_response != NULL) cprintf("%s", error_response); + syslog(LOG_ERR, "crypto: SSL_new failed: %s", ERR_reason_error_string(ERR_get_error())); + if (error_response != NULL) { + cprintf("%s", error_response); + } return; } if (!(SSL_set_fd(CC->ssl, CC->client_socket))) { - CtdlLogPrintf(CTDL_CRIT, "SSL_set_fd failed: %s\n", - ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "crypto: SSL_set_fd failed: %s", ERR_reason_error_string(ERR_get_error())); SSL_free(CC->ssl); CC->ssl = NULL; if (error_response != NULL) cprintf("%s", error_response); @@ -525,7 +584,7 @@ void CtdlStartTLS(char *ok_response, char *nosup_response, char error_string[128]; errval = SSL_get_error(CC->ssl, retval); - CtdlLogPrintf(CTDL_CRIT, "SSL_accept failed: retval=%d, errval=%ld, err=%s\n", + syslog(LOG_ERR, "crypto: SSL_accept failed: retval=%d, errval=%ld, err=%s", retval, errval, ERR_error_string(errval, error_string) @@ -534,12 +593,13 @@ void CtdlStartTLS(char *ok_response, char *nosup_response, CC->ssl = NULL; return; } - BIO_set_close(CC->ssl->rbio, BIO_NOCLOSE); + // BIO_set_close(CC->ssl->rbio, BIO_NOCLOSE); not needed anymore in openssl 1.1 ? bits = SSL_CIPHER_get_bits(SSL_get_current_cipher(CC->ssl), &alg_bits); - CtdlLogPrintf(CTDL_INFO, "SSL/TLS using %s on %s (%d of %d bits)\n", + syslog(LOG_INFO, "crypto: SSL/TLS using %s on %s (%d of %d bits)", SSL_CIPHER_get_name(SSL_get_current_cipher(CC->ssl)), SSL_CIPHER_get_version(SSL_get_current_cipher(CC->ssl)), - bits, alg_bits); + bits, alg_bits + ); CC->redirect_ssl = 1; } @@ -555,15 +615,9 @@ void cmd_stls(char *params) unbuffer_output(); - sprintf(ok_response, - "%d Begin TLS negotiation now\n", - CIT_OK); - sprintf(nosup_response, - "%d TLS not supported here\n", - ERROR + CMD_NOT_SUPPORTED); - sprintf(error_response, - "%d TLS negotiation error\n", - ERROR + INTERNAL_ERROR); + sprintf(ok_response, "%d Begin TLS negotiation now\n", CIT_OK); + sprintf(nosup_response, "%d TLS not supported here\n", ERROR + CMD_NOT_SUPPORTED); + sprintf(error_response, "%d TLS negotiation error\n", ERROR + INTERNAL_ERROR); CtdlStartTLS(ok_response, nosup_response, error_response); } @@ -603,7 +657,7 @@ void endtls(void) return; } - CtdlLogPrintf(CTDL_INFO, "Ending SSL/TLS\n"); + syslog(LOG_INFO, "crypto: ending SSL/TLS"); SSL_shutdown(CC->ssl); SSL_free(CC->ssl); CC->ssl = NULL; @@ -617,8 +671,11 @@ void endtls(void) void ssl_lock(int mode, int n, const char *file, int line) { if (mode & CRYPTO_LOCK) + { pthread_mutex_lock(SSLCritters[n]); - else + } + else { pthread_mutex_unlock(SSLCritters[n]); + } } #endif /* HAVE_OPENSSL */