Archives/SSLproxy
2
0
Fork 0
mirror of https://github.com/sonertari/SSLproxy synced 2024-11-06 09:20:26 +00:00
Code Issues Packages Projects Releases Wiki Activity
859da0ac4c
SSLproxy/ssl.h

231 lines
8.0 KiB
C
Raw Normal View History

Update with SSLsplit 0.5.2 and develop branch changes as of 270218
2018-02-27 19:20:58 +00:00
/*-
Update copyright, license and tagline - Update copyright to 2015 - Remove the non-standard "unmodified" from the 2-clause BSD license - Remove scalable from the tagline to avoid misinterpretations
2015-02-24 18:19:20 +00:00
* SSLsplit - transparent SSL/TLS interception
Update with SSLsplit 0.5.2 and develop branch changes as of 270218
2018-02-27 19:20:58 +00:00
* https://www.roe.ch/SSLsplit
*
* Copyright (c) 2009-2018, Daniel Roethlisberger <daniel@roe.ch>.
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
Update with SSLsplit 0.5.2 and develop branch changes as of 270218
2018-02-27 19:20:58 +00:00
* modification, are permitted provided that the following conditions are met:
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
*
Update with SSLsplit 0.5.2 and develop branch changes as of 270218
2018-02-27 19:20:58 +00:00
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS ``AS IS''
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
*/
#ifndef SSL_H
#define SSL_H
#include "attrib.h"
#include <openssl/opensslv.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#if (OPENSSL_VERSION_NUMBER < 0x10000000L) && !defined(OPENSSL_NO_THREADID)
#define OPENSSL_NO_THREADID
#endif
Update with SSLsplit 0.5.1 changes, fix LibreSSL version issues Add VerifyPeer and AllowWrongHost options
2018-01-18 00:18:53 +00:00
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#if (OPENSSL_VERSION_NUMBER < 0x0090806FL) && !defined(OPENSSL_NO_TLSEXT)
#define OPENSSL_NO_TLSEXT
#endif
Update with SSLsplit 0.5.1 changes, fix LibreSSL version issues Add VerifyPeer and AllowWrongHost options
2018-01-18 00:18:53 +00:00
/*
* ECDH is disabled when building against OpenSSL < 1.0.0e due to issues with
* thread-safety and security in server mode ephemereal ECDH cipher suites.
* http://www.openssl.org/news/secadv_20110906.txt
*/
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#if (OPENSSL_VERSION_NUMBER < 0x1000005FL) && !defined(OPENSSL_NO_ECDH)
#define OPENSSL_NO_ECDH
#endif
Update with SSLsplit 0.5.1 changes, fix LibreSSL version issues Add VerifyPeer and AllowWrongHost options
2018-01-18 00:18:53 +00:00
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#if (OPENSSL_VERSION_NUMBER < 0x0090802FL) && !defined(OPENSSL_NO_ECDSA)
#define OPENSSL_NO_ECDSA
#endif
Update with SSLsplit 0.5.1 changes, fix LibreSSL version issues Add VerifyPeer and AllowWrongHost options
2018-01-18 00:18:53 +00:00
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#if (OPENSSL_VERSION_NUMBER < 0x0090802FL) && !defined(OPENSSL_NO_EC)
#define OPENSSL_NO_EC
#endif
Update with SSLsplit 0.5.1 changes, fix LibreSSL version issues Add VerifyPeer and AllowWrongHost options
2018-01-18 00:18:53 +00:00
/*
* SHA0 was removed in OpenSSL 1.1.0, including OPENSSL_NO_SHA0.
*/
Remove most of defined(LIBRESSL_VERSION_NUMBER), LibreSSL behaves more like OPENSSL_VERSION_NUMBER >= 0x10100000L now
2018-08-03 13:07:54 +00:00
#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(OPENSSL_NO_SHA0)
Update with SSLsplit 0.5.1 changes, fix LibreSSL version issues Add VerifyPeer and AllowWrongHost options
2018-01-18 00:18:53 +00:00
#define OPENSSL_NO_SHA0
#endif
Remove most of defined(LIBRESSL_VERSION_NUMBER), LibreSSL behaves more like OPENSSL_VERSION_NUMBER >= 0x10100000L now
2018-08-03 13:07:54 +00:00
#if OPENSSL_VERSION_NUMBER < 0x10100000L
Update with SSLsplit 0.5.1 changes, fix LibreSSL version issues Add VerifyPeer and AllowWrongHost options
2018-01-18 00:18:53 +00:00
#define ASN1_STRING_get0_data(value) ASN1_STRING_data(value)
#define SSL_is_server(ssl) (ssl->type != SSL_ST_CONNECT)
#define X509_get_signature_nid(x509) (OBJ_obj2nid(x509->sig_alg->algorithm))
int DH_set0_pqg(DH *, BIGNUM *, BIGNUM *, BIGNUM *);
#endif
Fix SSL_METHOD* const mismatch on OpenSSL < 1.0.0
2014-11-19 21:38:21 +00:00
/*
* The constructors returning a SSL_METHOD * were changed to return
* a const SSL_METHOD * between 0.9.8 and 1.0.0.
*/
#if (OPENSSL_VERSION_NUMBER < 0x1000000fL)
#define CONST_SSL_METHOD SSL_METHOD
#else /* >= OpenSSL 1.0.0 */
#define CONST_SSL_METHOD const SSL_METHOD
#endif /* >= OpensSL 1.0.0 */
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
/*
Use SSL_get_certificate() hack for OpenSSL 0.9.8y OpenSSL 0.9.8y also crashes in OpenSSL's SSL_get_certificate() on a NULL pointer dereference. Fix by also using the direct access hack developed for OpenSSL 1.0.0k and 1.0.1e with OpenSSL 0.9.8y.
2014-11-19 19:01:42 +00:00
* Workaround for bug in OpenSSL 0.9.8y, 1.0.0k and 1.0.1e
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
* http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703031
* http://openssl.6102.n7.nabble.com/NULL-ptr-deref-when-calling-SSL-get-certificate-with-1-0-0k-td43636.html
*/
Use SSL_get_certificate() hack for OpenSSL 0.9.8y OpenSSL 0.9.8y also crashes in OpenSSL's SSL_get_certificate() on a NULL pointer dereference. Fix by also using the direct access hack developed for OpenSSL 1.0.0k and 1.0.1e with OpenSSL 0.9.8y.
2014-11-19 19:01:42 +00:00
#if (OPENSSL_VERSION_NUMBER == 0x0090819fL) || \
(OPENSSL_VERSION_NUMBER == 0x100000bfL) || \
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
(OPENSSL_VERSION_NUMBER == 0x1000105fL)
#define SSL_get_certificate(x) ssl_ssl_cert_get(x)
X509 * ssl_ssl_cert_get(SSL *);
Use SSL_get_certificate() hack for OpenSSL 0.9.8y OpenSSL 0.9.8y also crashes in OpenSSL's SSL_get_certificate() on a NULL pointer dereference. Fix by also using the direct access hack developed for OpenSSL 1.0.0k and 1.0.1e with OpenSSL 0.9.8y.
2014-11-19 19:01:42 +00:00
#endif /* OpenSSL 0.9.8y or 1.0.0k or 1.0.1e */
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
Refactor and unify ClientHello parsers Refactor and unify ssl_tls_clienthello_identify() and the earlier ssl_tls_clienthello_parse_sni() into a single ssl_tls_clienthello_parse() function that handles parsing ClientHello messages for different purposes. As a result, rename the debug knob DEBUG_SNI_PARSER into DEBUG_CLIENTHELLO_PARSER.
2015-05-17 18:23:25 +00:00
#ifdef OPENSSL_NO_TLSEXT
#ifndef TLSEXT_MAXLEN_host_name
#define TLSEXT_MAXLEN_host_name 255
#endif /* !TLSEXT_MAXLEN_host_name */
#endif /* OPENSSL_NO_TLSEXT */
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
/*
* SSL_OP_NO_* is used as an indication that OpenSSL is sufficiently recent
* to have the respective protocol implemented.
*
* OPENSSL_NO_SSL2 indicates the complete removal of SSL 2.0 support.
*
* OPENSSL_NO_SSL3 indicates that no SSL 3.0 connections will be made by
* default, but support is still present, unless OPENSSL_NO_SSL3_METHOD is
* also defined.
*/
#if defined(SSL_OP_NO_SSLv2) && !defined(OPENSSL_NO_SSL2) && \
defined(WITH_SSLV2)
#define HAVE_SSLV2
#endif /* SSL_OP_NO_SSLv2 && !OPENSSL_NO_SSL2 && WITH_SSLV2 */
#if defined(SSL_OP_NO_SSLv3) && !defined(OPENSSL_NO_SSL3_METHOD)
#define HAVE_SSLV3
#endif /* SSL_OP_NO_SSLv2 && !OPENSSL_NO_SSL3_METHOD */
#ifdef SSL_OP_NO_TLSv1
#define HAVE_TLSV10
#endif /* SSL_OP_NO_TLSv1 */
#ifdef SSL_OP_NO_TLSv1_1
#define HAVE_TLSV11
#endif /* SSL_OP_NO_TLSv1_1 */
#ifdef SSL_OP_NO_TLSv1_2
#define HAVE_TLSV12
#endif /* SSL_OP_NO_TLSv1_2 */
#ifdef HAVE_SSLV2
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define SSL2_S "ssl2 "
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#else /* !HAVE_SSLV2 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define SSL2_S ""
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#endif /* !HAVE_SSLV2 */
#ifdef HAVE_SSLV3
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define SSL3_S "ssl3 "
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#else /* !HAVE_SSLV3 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define SSL3_S ""
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#endif /* !HAVE_SSLV3 */
#ifdef HAVE_TLSV10
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS10_S "tls10 "
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#else /* !HAVE_TLSV10 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS10_S ""
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#endif /* !HAVE_TLSV10 */
#ifdef HAVE_TLSV11
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS11_S "tls11 "
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#else /* !HAVE_TLSV11 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS11_S ""
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#endif /* !HAVE_TLSV11 */
#ifdef HAVE_TLSV12
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS12_S "tls12 "
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#else /* !HAVE_TLSV12 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define TLS12_S ""
Rewrite protocol version macros and refactoring Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and HAVE_TLSV12 to indicate that support for the respective protocol is available in OpenSSL. This was necessary due to the increased complexity of testing version support following the phasing out of SSLv2 and SSLv3 from OpenSSL implementations. This fixes the build with OpenSSL versions which have SSLv3 support removed. While here, de-duplicate code for setting SSL_CTX options and do not set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit in the context of splitting SSL/TLS for analysis. Reported by: Jérémie Courrèges-Anglas
2015-07-28 21:23:53 +00:00
#endif /* !HAVE_TLSV12 */
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#define SSL_PROTO_SUPPORT_S SSL2_S SSL3_S TLS10_S TLS11_S TLS12_S
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
void ssl_openssl_version(void);
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
int ssl_init(void) WUNRES;
Import sslsplit-devel changes Add stats logs, initial Add SSLproxy_SrcAddr header field Clean-up
2017-07-25 13:07:39 +00:00
int ssl_reinit(void) WUNRES;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
void ssl_fini(void);
Add convenience functions for printing SHA1 values
2014-12-12 22:50:55 +00:00
char * ssl_sha1_to_str(unsigned char *, int) NONNULL(1) MALLOC;
Tidy and clean logs up Add DEBUG_PROXY directive around all log_dbg_level_printf() and related lines Log stats to syslog, similar to error logs, so that it is simpler to rotate and parse -O w/o -g is failing bufferevent_socket_connect for parent dst, so either enable -O w/ -g, or disable -O w/o -g (-O2 is failing too) Refactoring
2017-08-13 01:36:33 +00:00
char * ssl_ssl_state_to_str(SSL *, const char *) NONNULL(1) MALLOC;
Update with SSLsplit 0.5.1 changes, fix LibreSSL version issues Add VerifyPeer and AllowWrongHost options
2018-01-18 00:18:53 +00:00
char * ssl_ssl_masterkey_to_str(SSL *) NONNULL(1) MALLOC;
Print status of free'd SSL structs in debug mode
2014-01-11 16:28:41 +00:00
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#ifndef OPENSSL_NO_DH
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
DH * ssl_tmp_dh_callback(SSL *, int, int) NONNULL(1) MALLOC;
DH * ssl_dh_load(const char *) NONNULL(1) MALLOC;
void ssl_dh_refcount_inc(DH *) NONNULL(1);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !OPENSSL_NO_DH */
Generic EC loading, new default curve 'secp160r2'
2012-05-11 15:39:12 +00:00
#ifndef OPENSSL_NO_EC
EC_KEY * ssl_ec_by_name(const char *) MALLOC;
#endif /* !OPENSSL_NO_EC */
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
EVP_PKEY * ssl_key_load(const char *) NONNULL(1) MALLOC;
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
EVP_PKEY * ssl_key_genrsa(const int) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
void ssl_key_refcount_inc(EVP_PKEY *) NONNULL(1);
Add ssl_key_identifier_sha1() utility function Issue: #67
2014-12-12 16:38:34 +00:00
#define SSL_KEY_IDSZ 20
int ssl_key_identifier_sha1(EVP_PKEY *, unsigned char *) NONNULL(1,2);
Add convenience functions for printing SHA1 values
2014-12-12 22:50:55 +00:00
char * ssl_key_identifier(EVP_PKEY *, int) NONNULL(1) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#ifndef OPENSSL_NO_TLSEXT
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_x509_v3ext_add(X509V3_CTX *, X509 *, char *, char *) NONNULL(1,2,3,4);
int ssl_x509_v3ext_copy_by_nid(X509 *, X509 *, int) NONNULL(1,2);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !OPENSSL_NO_TLSEXT */
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_x509_serial_copyrand(X509 *, X509 *) NONNULL(1,2);
Update with SSLsplit 0.5.1 changes, fix LibreSSL version issues Add VerifyPeer and AllowWrongHost options
2018-01-18 00:18:53 +00:00
X509 * ssl_x509_forge(X509 *, EVP_PKEY *, X509 *, EVP_PKEY *,
const char *, const char *)
NONNULL(1,2,3,4) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
X509 * ssl_x509_load(const char *) NONNULL(1) MALLOC;
char * ssl_x509_subject(X509 *) NONNULL(1) MALLOC;
char * ssl_x509_subject_cn(X509 *, size_t *) NONNULL(1,2) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#define SSL_X509_FPRSZ 20
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_x509_fingerprint_sha1(X509 *, unsigned char *) NONNULL(1,2);
Add convenience functions for printing SHA1 values
2014-12-12 22:50:55 +00:00
char * ssl_x509_fingerprint(X509 *, int) NONNULL(1) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
char ** ssl_x509_names(X509 *) NONNULL(1) MALLOC;
int ssl_x509_names_match(X509 *, const char *) NONNULL(1,2);
char * ssl_x509_names_to_str(X509 *) NONNULL(1) MALLOC;
Add OCSP URL parsing
2012-04-17 21:03:59 +00:00
char ** ssl_x509_aias(X509 *, const int) NONNULL(1) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
char ** ssl_x509_ocsps(X509 *) NONNULL(1) MALLOC;
int ssl_x509_is_valid(X509 *) NONNULL(1) WUNRES;
char * ssl_x509_to_str(X509 *) NONNULL(1) MALLOC;
char * ssl_x509_to_pem(X509 *) NONNULL(1) MALLOC;
void ssl_x509_refcount_inc(X509 *) NONNULL(1);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
int ssl_x509chain_load(X509 **, STACK_OF(X509) **, const char *) NONNULL(2,3);
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
void ssl_x509chain_use(SSL_CTX *, X509 *, STACK_OF(X509) *) NONNULL(1,2,3);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
char * ssl_session_to_str(SSL_SESSION *) NONNULL(1) MALLOC;
int ssl_session_is_valid(SSL_SESSION *) NONNULL(1);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_is_ocspreq(const unsigned char *, size_t) NONNULL(1) WUNRES;
Add facility to recognize OCSP requests
2012-04-22 16:02:58 +00:00
Refactor and unify ClientHello parsers Refactor and unify ssl_tls_clienthello_identify() and the earlier ssl_tls_clienthello_parse_sni() into a single ssl_tls_clienthello_parse() function that handles parsing ClientHello messages for different purposes. As a result, rename the debug knob DEBUG_SNI_PARSER into DEBUG_CLIENTHELLO_PARSER.
2015-05-17 18:23:25 +00:00
int ssl_tls_clienthello_parse(const unsigned char *, ssize_t, int,
const unsigned char **, char **)
NONNULL(1,4) WUNRES;
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
int ssl_dnsname_match(const char *, size_t, const char *, size_t)
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
NONNULL(1,3) WUNRES;
char * ssl_wildcardify(const char *) NONNULL(1) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !SSL_H */
/* vim: set noet ft=c: */
Reference in New Issue Copy Permalink