Archives/SSLproxy
2
0
Fork 0
mirror of https://github.com/sonertari/SSLproxy synced 2024-11-16 06:12:44 +00:00
Code Issues Packages Projects Releases Wiki Activity
da47cd3fe1
SSLproxy/ssl.h

178 lines
6.5 KiB
C
Raw Normal View History

Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
/*
Update copyright, license and tagline - Update copyright to 2015 - Remove the non-standard "unmodified" from the 2-clause BSD license - Remove scalable from the tagline to avoid misinterpretations
2015-02-24 18:19:20 +00:00
* SSLsplit - transparent SSL/TLS interception
* Copyright (c) 2009-2015, Daniel Roethlisberger <daniel@roe.ch>
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
* All rights reserved.
* http://www.roe.ch/SSLsplit
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
Update copyright, license and tagline - Update copyright to 2015 - Remove the non-standard "unmodified" from the 2-clause BSD license - Remove scalable from the tagline to avoid misinterpretations
2015-02-24 18:19:20 +00:00
* notice, this list of conditions, and the following disclaimer.
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef SSL_H
#define SSL_H
#include "attrib.h"
#include <openssl/opensslv.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
State why ECDH is disabled with OpenSSL < 1.0.0e
2012-05-11 16:03:07 +00:00
/*
* ECDH is disabled when building against OpenSSL < 1.0.0e due to issues with
* thread-safety and security in server mode ephemereal ECDH cipher suites.
* http://www.openssl.org/news/secadv_20110906.txt
*/
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#if (OPENSSL_VERSION_NUMBER < 0x10000000L) && !defined(OPENSSL_NO_THREADID)
#define OPENSSL_NO_THREADID
#endif
#if (OPENSSL_VERSION_NUMBER < 0x0090806FL) && !defined(OPENSSL_NO_TLSEXT)
#define OPENSSL_NO_TLSEXT
#endif
#if (OPENSSL_VERSION_NUMBER < 0x1000005FL) && !defined(OPENSSL_NO_ECDH)
#define OPENSSL_NO_ECDH
#endif
#if (OPENSSL_VERSION_NUMBER < 0x0090802FL) && !defined(OPENSSL_NO_ECDSA)
#define OPENSSL_NO_ECDSA
#endif
#if (OPENSSL_VERSION_NUMBER < 0x0090802FL) && !defined(OPENSSL_NO_EC)
#define OPENSSL_NO_EC
#endif
Fix SSL_METHOD* const mismatch on OpenSSL < 1.0.0
2014-11-19 21:38:21 +00:00
/*
* The constructors returning a SSL_METHOD * were changed to return
* a const SSL_METHOD * between 0.9.8 and 1.0.0.
*/
#if (OPENSSL_VERSION_NUMBER < 0x1000000fL)
#define CONST_SSL_METHOD SSL_METHOD
#else /* >= OpenSSL 1.0.0 */
#define CONST_SSL_METHOD const SSL_METHOD
#endif /* >= OpensSL 1.0.0 */
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
/*
Use SSL_get_certificate() hack for OpenSSL 0.9.8y OpenSSL 0.9.8y also crashes in OpenSSL's SSL_get_certificate() on a NULL pointer dereference. Fix by also using the direct access hack developed for OpenSSL 1.0.0k and 1.0.1e with OpenSSL 0.9.8y.
2014-11-19 19:01:42 +00:00
* Workaround for bug in OpenSSL 0.9.8y, 1.0.0k and 1.0.1e
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
* http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703031
* http://openssl.6102.n7.nabble.com/NULL-ptr-deref-when-calling-SSL-get-certificate-with-1-0-0k-td43636.html
*/
Use SSL_get_certificate() hack for OpenSSL 0.9.8y OpenSSL 0.9.8y also crashes in OpenSSL's SSL_get_certificate() on a NULL pointer dereference. Fix by also using the direct access hack developed for OpenSSL 1.0.0k and 1.0.1e with OpenSSL 0.9.8y.
2014-11-19 19:01:42 +00:00
#if (OPENSSL_VERSION_NUMBER == 0x0090819fL) || \
(OPENSSL_VERSION_NUMBER == 0x100000bfL) || \
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
(OPENSSL_VERSION_NUMBER == 0x1000105fL)
#define SSL_get_certificate(x) ssl_ssl_cert_get(x)
X509 * ssl_ssl_cert_get(SSL *);
Use SSL_get_certificate() hack for OpenSSL 0.9.8y OpenSSL 0.9.8y also crashes in OpenSSL's SSL_get_certificate() on a NULL pointer dereference. Fix by also using the direct access hack developed for OpenSSL 1.0.0k and 1.0.1e with OpenSSL 0.9.8y.
2014-11-19 19:01:42 +00:00
#endif /* OpenSSL 0.9.8y or 1.0.0k or 1.0.1e */
Improve workaround for OpenSSL 1.0.0k/1.0.1e Extend and improve the workaround introduced in commit 20b3f66120. Automatically replace SSL_get_certificate() with a drop-in replacement if a version of OpenSSL known to be broken is used. This now covers the use of SSL_get_certificate() within the connection manager as well and resolves one more case where OpenSSL could crash.
2013-04-24 15:08:55 +00:00
Allow more control over used SSL/TLS versions Add -r to force a specific SSL/TLS protocol version. Add -R to disable one or several SSL/TLS protocol versions. Replace WANT_SSLV2_CLIENT and WANT_SSLV2_SERVER to WITH_SSLV2. Issue: #30 Reported by: @Apollo2342
2014-11-05 19:06:11 +00:00
#if defined(SSL_OP_NO_SSLv2) && defined(WITH_SSLV2)
#define SSL2_S "ssl2 "
#else /* !(SSL_OP_NO_SSLv2 && WITH_SSLV2) */
#define SSL2_S ""
#endif /* !(SSL_OP_NO_SSLv2 && WITH_SSLV2) */
#ifdef SSL_OP_NO_SSLv3
#define SSL3_S "ssl3 "
#else /* !SSL_OP_NO_SSLv3 */
#define SSL3_S ""
#endif /* !SSL_OP_NO_SSLv3 */
#ifdef SSL_OP_NO_TLSv1
#define TLS10_S "tls10 "
#else /* !SSL_OP_NO_TLSv1 */
#define TLS10_S ""
#endif /* !SSL_OP_NO_TLSv1 */
#ifdef SSL_OP_NO_TLSv1_1
#define TLS11_S "tls11 "
#else /* !SSL_OP_NO_TLSv1_1 */
#define TLS11_S ""
#endif /* !SSL_OP_NO_TLSv1_1 */
#ifdef SSL_OP_NO_TLSv1_2
#define TLS12_S "tls12 "
#else /* !SSL_OP_NO_TLSv1_2 */
#define TLS12_S ""
#endif /* !SSL_OP_NO_TLSv1_2 */
#define SSL_PROTO_SUPPORT_S SSL2_S SSL3_S TLS10_S TLS11_S TLS12_S
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
void ssl_openssl_version(void);
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
int ssl_init(void) WUNRES;
Reinitialize SSL mutexes after fork See issue #5.
2012-10-16 22:11:53 +00:00
void ssl_reinit(void);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
void ssl_fini(void);
Add convenience functions for printing SHA1 values
2014-12-12 22:50:55 +00:00
char * ssl_sha1_to_str(unsigned char *, int) NONNULL(1) MALLOC;
Print status of free'd SSL structs in debug mode
2014-01-11 16:28:41 +00:00
char * ssl_ssl_state_to_str(SSL *) NONNULL(1) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#ifndef OPENSSL_NO_DH
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
DH * ssl_tmp_dh_callback(SSL *, int, int) NONNULL(1) MALLOC;
DH * ssl_dh_load(const char *) NONNULL(1) MALLOC;
void ssl_dh_refcount_inc(DH *) NONNULL(1);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !OPENSSL_NO_DH */
Generic EC loading, new default curve 'secp160r2'
2012-05-11 15:39:12 +00:00
#ifndef OPENSSL_NO_EC
EC_KEY * ssl_ec_by_name(const char *) MALLOC;
#endif /* !OPENSSL_NO_EC */
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
EVP_PKEY * ssl_key_load(const char *) NONNULL(1) MALLOC;
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
EVP_PKEY * ssl_key_genrsa(const int) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
void ssl_key_refcount_inc(EVP_PKEY *) NONNULL(1);
Add ssl_key_identifier_sha1() utility function Issue: #67
2014-12-12 16:38:34 +00:00
#define SSL_KEY_IDSZ 20
int ssl_key_identifier_sha1(EVP_PKEY *, unsigned char *) NONNULL(1,2);
Add convenience functions for printing SHA1 values
2014-12-12 22:50:55 +00:00
char * ssl_key_identifier(EVP_PKEY *, int) NONNULL(1) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#ifndef OPENSSL_NO_TLSEXT
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_x509_v3ext_add(X509V3_CTX *, X509 *, char *, char *) NONNULL(1,2,3,4);
int ssl_x509_v3ext_copy_by_nid(X509 *, X509 *, int) NONNULL(1,2);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !OPENSSL_NO_TLSEXT */
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_x509_serial_copyrand(X509 *, X509 *) NONNULL(1,2);
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
X509 * ssl_x509_forge(X509 *, EVP_PKEY *, X509 *, const char *, EVP_PKEY *)
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
NONNULL(1,2,3,5) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
X509 * ssl_x509_load(const char *) NONNULL(1) MALLOC;
char * ssl_x509_subject(X509 *) NONNULL(1) MALLOC;
char * ssl_x509_subject_cn(X509 *, size_t *) NONNULL(1,2) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#define SSL_X509_FPRSZ 20
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_x509_fingerprint_sha1(X509 *, unsigned char *) NONNULL(1,2);
Add convenience functions for printing SHA1 values
2014-12-12 22:50:55 +00:00
char * ssl_x509_fingerprint(X509 *, int) NONNULL(1) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
char ** ssl_x509_names(X509 *) NONNULL(1) MALLOC;
int ssl_x509_names_match(X509 *, const char *) NONNULL(1,2);
char * ssl_x509_names_to_str(X509 *) NONNULL(1) MALLOC;
Add OCSP URL parsing
2012-04-17 21:03:59 +00:00
char ** ssl_x509_aias(X509 *, const int) NONNULL(1) MALLOC;
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
char ** ssl_x509_ocsps(X509 *) NONNULL(1) MALLOC;
int ssl_x509_is_valid(X509 *) NONNULL(1) WUNRES;
char * ssl_x509_to_str(X509 *) NONNULL(1) MALLOC;
char * ssl_x509_to_pem(X509 *) NONNULL(1) MALLOC;
void ssl_x509_refcount_inc(X509 *) NONNULL(1);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
int ssl_x509chain_load(X509 **, STACK_OF(X509) **, const char *) NONNULL(2,3);
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
void ssl_x509chain_use(SSL_CTX *, X509 *, STACK_OF(X509) *) NONNULL(1,2,3);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
char * ssl_session_to_str(SSL_SESSION *) NONNULL(1) MALLOC;
int ssl_session_is_valid(SSL_SESSION *) NONNULL(1);
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
int ssl_is_ocspreq(const unsigned char *, size_t) NONNULL(1) WUNRES;
Add facility to recognize OCSP requests
2012-04-22 16:02:58 +00:00
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#ifndef OPENSSL_NO_TLSEXT
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
char * ssl_tls_clienthello_parse_sni(const unsigned char *, ssize_t *)
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
NONNULL(1,2) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !OPENSSL_NO_TLSEXT */
Use WUNRES and MALLOC attribs and fix sloppy code
2012-04-22 22:35:17 +00:00
int ssl_dnsname_match(const char *, size_t, const char *, size_t)
Always explicitly name the non-null arguments Always explicitly name which arguments are non-null, even if all arguments are non-null. This is to avoid bugs where newly added arguments are automatically non-null by accident, possibly leading to optimisation errors. This also fixes a few potential errors related to non-null arguments; specifically it prevents the compiler optimising away a test for sni being NULL in cachedsess_mkkey(). Issue: #14 Reported by: kythyria
2014-01-06 13:28:33 +00:00
NONNULL(1,3) WUNRES;
char * ssl_wildcardify(const char *) NONNULL(1) MALLOC;
Initial import of sslsplit-0.4.2
2012-04-13 12:47:30 +00:00
#endif /* !SSL_H */
/* vim: set noet ft=c: */
Reference in New Issue Copy Permalink