1 /* Copyright 2002-2004 Justin Erenkrantz and Greg Stein
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
17 * For the OpenSSL thread-safety locking code:
19 * Licensed to the Apache Software Foundation (ASF) under one or more
20 * contributor license agreements. See the NOTICE file distributed with
21 * this work for additional information regarding copyright ownership.
22 * The ASF licenses this file to You under the Apache License, Version 2.0
23 * (the "License"); you may not use this file except in compliance with
24 * the License. You may obtain a copy of the License at
26 * http://www.apache.org/licenses/LICENSE-2.0
28 * Unless required by applicable law or agreed to in writing, software
29 * distributed under the License is distributed on an "AS IS" BASIS,
30 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
31 * See the License for the specific language governing permissions and
32 * limitations under the License.
34 * Originally developed by Aaron Bannert and Justin Erenkrantz, eBuilt.
37 #include <apr_pools.h>
38 #include <apr_network_io.h>
39 #include <apr_portable.h>
40 #include <apr_strings.h>
41 #include <apr_base64.h>
42 #include <apr_version.h>
43 #include <apr_atomic.h>
46 #include "serf_private.h"
47 #include "serf_bucket_util.h"
49 #include <openssl/bio.h>
50 #include <openssl/ssl.h>
51 #include <openssl/err.h>
52 #include <openssl/pkcs12.h>
53 #include <openssl/x509v3.h>
55 #ifndef APR_VERSION_AT_LEAST /* Introduced in APR 1.3.0 */
56 #define APR_VERSION_AT_LEAST(major,minor,patch) \
57 (((major) < APR_MAJOR_VERSION) \
58 || ((major) == APR_MAJOR_VERSION && (minor) < APR_MINOR_VERSION) \
59 || ((major) == APR_MAJOR_VERSION && (minor) == APR_MINOR_VERSION && \
60 (patch) <= APR_PATCH_VERSION))
61 #endif /* APR_VERSION_AT_LEAST */
63 #ifndef APR_ARRAY_PUSH
64 #define APR_ARRAY_PUSH(ary,type) (*((type *)apr_array_push(ary)))
69 * Here's an overview of the SSL bucket's relationship to OpenSSL and serf.
71 * HTTP request: SSLENCRYPT(REQUEST)
72 * [context.c reads from SSLENCRYPT and writes out to the socket]
73 * HTTP response: RESPONSE(SSLDECRYPT(SOCKET))
74 * [handler function reads from RESPONSE which in turn reads from SSLDECRYPT]
76 * HTTP request read call path:
79 * |- serf_bucket_read on SSLENCRYPT
81 * |- serf_databuf_read
82 * |- common_databuf_prep
84 * |- 1. Try to read pending encrypted data; If available, return.
85 * |- 2. Try to read from ctx->stream [REQUEST bucket]
86 * |- 3. Call SSL_write with read data
88 * |- bio_bucket_read can be called
89 * |- bio_bucket_write with encrypted data
91 * |- 4. If successful, read pending encrypted data and return.
92 * |- 5. If fails, place read data back in ctx->stream
94 * HTTP response read call path:
96 * read_from_connection
100 * |- serf_bucket_read(SSLDECRYPT)
102 * |- serf_databuf_read
104 * |- 1. SSL_read() for pending decrypted data; if any, return.
105 * |- 2. Try to read from ctx->stream [SOCKET bucket]
106 * |- 3. Append data to ssl_ctx->source
107 * |- 4. Call SSL_read()
109 * |- bio_bucket_write can be called
111 * |- read data from ssl_ctx->source
112 * |- If data read, return it.
113 * |- If an error, set the STATUS value and return.
117 typedef struct bucket_list {
118 serf_bucket_t *bucket;
119 struct bucket_list *next;
123 /* Helper to read data. Wraps stream. */
124 serf_databuf_t databuf;
126 /* Our source for more data. */
127 serf_bucket_t *stream;
129 /* The next set of buckets */
130 bucket_list_t *stream_next;
132 /* The status of the last thing we read. */
134 apr_status_t exhausted;
137 /* Data we've read but not processed. */
138 serf_bucket_t *pending;
141 struct serf_ssl_context_t {
142 /* How many open buckets refer to this context. */
145 /* The pool that this context uses. */
148 /* The allocator associated with the above pool. */
149 serf_bucket_alloc_t *allocator;
151 /* Internal OpenSSL parameters */
156 serf_ssl_stream_t encrypt;
157 serf_ssl_stream_t decrypt;
159 /* Client cert callbacks */
160 serf_ssl_need_client_cert_t cert_callback;
162 apr_pool_t *cert_cache_pool;
163 const char *cert_file_success;
165 /* Client cert PW callbacks */
166 serf_ssl_need_cert_password_t cert_pw_callback;
167 void *cert_pw_userdata;
168 apr_pool_t *cert_pw_cache_pool;
169 const char *cert_pw_success;
171 /* Server cert callbacks */
172 serf_ssl_need_server_cert_t server_cert_callback;
173 serf_ssl_server_cert_chain_cb_t server_cert_chain_callback;
174 void *server_cert_userdata;
176 const char *cert_path;
179 EVP_PKEY *cached_cert_pw;
181 apr_status_t pending_err;
183 /* Status of a fatal error, returned on subsequent encrypt or decrypt
185 apr_status_t fatal_err;
189 /* The bucket-independent ssl context that this bucket is associated with */
190 serf_ssl_context_t *ssl_ctx;
192 /* Pointer to the 'right' databuf. */
193 serf_databuf_t *databuf;
195 /* Pointer to our stream, so we can find it later. */
196 serf_bucket_t **our_stream;
199 struct serf_ssl_certificate_t {
204 static void disable_compression(serf_ssl_context_t *ssl_ctx);
206 pstrdup_escape_nul_bytes(const char *buf, int len, apr_pool_t *pool);
209 /* Log all ssl alerts that we receive from the server. */
211 apps_ssl_info_callback(const SSL *s, int where, int ret)
215 w = where & ~SSL_ST_MASK;
217 if (w & SSL_ST_CONNECT)
219 else if (w & SSL_ST_ACCEPT)
224 if (where & SSL_CB_LOOP) {
225 serf__log(SSL_VERBOSE, __FILE__, "%s:%s\n", str,
226 SSL_state_string_long(s));
228 else if (where & SSL_CB_ALERT) {
229 str = (where & SSL_CB_READ) ? "read" : "write";
230 serf__log(SSL_VERBOSE, __FILE__, "SSL3 alert %s:%s:%s\n",
232 SSL_alert_type_string_long(ret),
233 SSL_alert_desc_string_long(ret));
235 else if (where & SSL_CB_EXIT) {
237 serf__log(SSL_VERBOSE, __FILE__, "%s:failed in %s\n", str,
238 SSL_state_string_long(s));
240 serf__log(SSL_VERBOSE, __FILE__, "%s:error in %s\n", str,
241 SSL_state_string_long(s));
247 /* Returns the amount read. */
248 static int bio_bucket_read(BIO *bio, char *in, int inlen)
250 serf_ssl_context_t *ctx = bio->ptr;
255 serf__log(SSL_VERBOSE, __FILE__, "bio_bucket_read called for %d bytes\n",
258 if (ctx->encrypt.status == SERF_ERROR_WAIT_CONN
259 && BIO_should_read(ctx->bio)) {
260 serf__log(SSL_VERBOSE, __FILE__,
261 "bio_bucket_read waiting: (%d %d %d)\n",
262 BIO_should_retry(ctx->bio), BIO_should_read(ctx->bio),
263 BIO_get_retry_flags(ctx->bio));
264 /* Falling back... */
265 ctx->encrypt.exhausted_reset = 1;
266 BIO_clear_retry_flags(bio);
269 status = serf_bucket_read(ctx->decrypt.pending, inlen, &data, &len);
271 ctx->decrypt.status = status;
273 serf__log(SSL_VERBOSE, __FILE__, "bio_bucket_read received %d bytes (%d)\n",
276 if (!SERF_BUCKET_READ_ERROR(status)) {
279 memcpy(in, data, len);
282 if (APR_STATUS_IS_EOF(status)) {
283 BIO_set_retry_read(bio);
291 /* Returns the amount written. */
292 static int bio_bucket_write(BIO *bio, const char *in, int inl)
294 serf_ssl_context_t *ctx = bio->ptr;
297 serf__log(SSL_VERBOSE, __FILE__, "bio_bucket_write called for %d bytes\n",
300 if (ctx->encrypt.status == SERF_ERROR_WAIT_CONN
301 && !BIO_should_read(ctx->bio)) {
302 serf__log(SSL_VERBOSE, __FILE__,
303 "bio_bucket_write waiting: (%d %d %d)\n",
304 BIO_should_retry(ctx->bio), BIO_should_read(ctx->bio),
305 BIO_get_retry_flags(ctx->bio));
306 /* Falling back... */
307 ctx->encrypt.exhausted_reset = 1;
308 BIO_clear_retry_flags(bio);
311 tmp = serf_bucket_simple_copy_create(in, inl,
312 ctx->encrypt.pending->allocator);
314 serf_bucket_aggregate_append(ctx->encrypt.pending, tmp);
319 /* Returns the amount read. */
320 static int bio_file_read(BIO *bio, char *in, int inlen)
322 apr_file_t *file = bio->ptr;
326 BIO_clear_retry_flags(bio);
329 status = apr_file_read(file, in, &len);
331 if (!SERF_BUCKET_READ_ERROR(status)) {
333 if (APR_STATUS_IS_EOF(status)) {
334 BIO_set_retry_read(bio);
344 /* Returns the amount written. */
345 static int bio_file_write(BIO *bio, const char *in, int inl)
347 apr_file_t *file = bio->ptr;
350 BIO_clear_retry_flags(bio);
353 apr_file_write(file, in, &nbytes);
358 static int bio_file_gets(BIO *bio, char *in, int inlen)
360 return bio_file_read(bio, in, inlen);
363 static int bio_bucket_create(BIO *bio)
373 static int bio_bucket_destroy(BIO *bio)
375 /* Did we already free this? */
383 static long bio_bucket_ctrl(BIO *bio, int cmd, long num, void *ptr)
392 /* At this point we can't force a flush. */
402 static BIO_METHOD bio_bucket_method = {
404 "Serf SSL encryption and decryption buckets",
407 NULL, /* Is this called? */
408 NULL, /* Is this called? */
412 #ifdef OPENSSL_VERSION_NUMBER
413 NULL /* sslc does not have the callback_ctrl field */
417 static BIO_METHOD bio_file_method = {
419 "Wrapper around APR file structures",
422 NULL, /* Is this called? */
423 bio_file_gets, /* Is this called? */
427 #ifdef OPENSSL_VERSION_NUMBER
428 NULL /* sslc does not have the callback_ctrl field */
432 typedef enum san_copy_t {
433 EscapeNulAndCopy = 0,
439 get_subject_alt_names(apr_array_header_t **san_arr, X509 *ssl_cert,
440 san_copy_t copy_action, apr_pool_t *pool)
442 STACK_OF(GENERAL_NAME) *names;
444 /* assert: copy_action == ErrorOnNul || (san_arr && pool) */
450 /* Get subjectAltNames */
451 names = X509_get_ext_d2i(ssl_cert, NID_subject_alt_name, NULL, NULL);
453 int names_count = sk_GENERAL_NAME_num(names);
457 *san_arr = apr_array_make(pool, names_count, sizeof(char*));
458 for (name_idx = 0; name_idx < names_count; name_idx++) {
460 GENERAL_NAME *nm = sk_GENERAL_NAME_value(names, name_idx);
464 if (copy_action == ErrorOnNul &&
465 strlen(nm->d.ia5->data) != nm->d.ia5->length)
466 return SERF_ERROR_SSL_CERT_FAILED;
467 if (san_arr && *san_arr)
468 p = pstrdup_escape_nul_bytes((const char *)nm->d.ia5->data,
473 /* Don't know what to do - skip. */
478 APR_ARRAY_PUSH(*san_arr, char*) = p;
481 sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
487 static apr_status_t validate_cert_hostname(X509 *server_cert, apr_pool_t *pool)
493 ret = get_subject_alt_names(NULL, server_cert, ErrorOnNul, NULL);
497 /* Fail if the subject's CN field contains \0 characters. */
498 X509_NAME *subject = X509_get_subject_name(server_cert);
500 return SERF_ERROR_SSL_CERT_FAILED;
502 length = X509_NAME_get_text_by_NID(subject, NID_commonName, buf, 1024);
504 if (strlen(buf) != length)
505 return SERF_ERROR_SSL_CERT_FAILED;
512 validate_server_certificate(int cert_valid, X509_STORE_CTX *store_ctx)
515 serf_ssl_context_t *ctx;
521 ssl = X509_STORE_CTX_get_ex_data(store_ctx,
522 SSL_get_ex_data_X509_STORE_CTX_idx());
523 ctx = SSL_get_app_data(ssl);
525 server_cert = X509_STORE_CTX_get_current_cert(store_ctx);
526 depth = X509_STORE_CTX_get_error_depth(store_ctx);
528 /* If the certification was found invalid, get the error and convert it to
529 something our caller will understand. */
531 err = X509_STORE_CTX_get_error(store_ctx);
534 case X509_V_ERR_CERT_NOT_YET_VALID:
535 failures |= SERF_SSL_CERT_NOTYETVALID;
537 case X509_V_ERR_CERT_HAS_EXPIRED:
538 failures |= SERF_SSL_CERT_EXPIRED;
540 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
541 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
542 failures |= SERF_SSL_CERT_SELF_SIGNED;
544 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
545 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
546 case X509_V_ERR_CERT_UNTRUSTED:
547 case X509_V_ERR_INVALID_CA:
548 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
549 failures |= SERF_SSL_CERT_UNKNOWNCA;
551 case X509_V_ERR_CERT_REVOKED:
552 failures |= SERF_SSL_CERT_REVOKED;
555 failures |= SERF_SSL_CERT_UNKNOWN_FAILURE;
560 /* Validate hostname */
561 status = validate_cert_hostname(server_cert, ctx->pool);
563 failures |= SERF_SSL_CERT_UNKNOWN_FAILURE;
565 /* Check certificate expiry dates. */
566 if (X509_cmp_current_time(X509_get_notBefore(server_cert)) >= 0) {
567 failures |= SERF_SSL_CERT_NOTYETVALID;
569 else if (X509_cmp_current_time(X509_get_notAfter(server_cert)) <= 0) {
570 failures |= SERF_SSL_CERT_EXPIRED;
573 if (ctx->server_cert_callback &&
574 (depth == 0 || failures)) {
575 serf_ssl_certificate_t *cert;
578 apr_pool_create(&subpool, ctx->pool);
580 cert = apr_palloc(subpool, sizeof(serf_ssl_certificate_t));
581 cert->ssl_cert = server_cert;
584 /* Callback for further verification. */
585 status = ctx->server_cert_callback(ctx->server_cert_userdata,
587 if (status == APR_SUCCESS)
590 /* Even if openssl found the certificate valid, the application
591 told us to reject it. */
593 /* Pass the error back to the caller through the context-run. */
594 ctx->pending_err = status;
596 apr_pool_destroy(subpool);
599 if (ctx->server_cert_chain_callback
600 && (depth == 0 || failures)) {
601 STACK_OF(X509) *chain;
602 const serf_ssl_certificate_t **certs;
606 apr_pool_create(&subpool, ctx->pool);
608 /* Borrow the chain to pass to the callback. */
609 chain = X509_STORE_CTX_get_chain(store_ctx);
611 /* If the chain can't be retrieved, just pass the current
613 /* ### can this actually happen with _get_chain() ? */
615 serf_ssl_certificate_t *cert = apr_palloc(subpool, sizeof(*cert));
617 cert->ssl_cert = server_cert;
620 /* Room for the server_cert and a trailing NULL. */
621 certs = apr_palloc(subpool, sizeof(*certs) * 2);
628 certs_len = sk_X509_num(chain);
630 /* Room for all the certs and a trailing NULL. */
631 certs = apr_palloc(subpool, sizeof(*certs) * (certs_len + 1));
632 for (i = 0; i < certs_len; ++i) {
633 serf_ssl_certificate_t *cert;
635 cert = apr_palloc(subpool, sizeof(*cert));
636 cert->ssl_cert = sk_X509_value(chain, i);
642 certs[certs_len] = NULL;
644 /* Callback for further verification. */
645 status = ctx->server_cert_chain_callback(ctx->server_cert_userdata,
648 if (status == APR_SUCCESS) {
651 /* Even if openssl found the certificate valid, the application
652 told us to reject it. */
654 /* Pass the error back to the caller through the context-run. */
655 ctx->pending_err = status;
658 apr_pool_destroy(subpool);
661 /* Return a specific error if the server certificate is not accepted by
662 OpenSSL and the application has not set callbacks to override this. */
664 !ctx->server_cert_chain_callback &&
665 !ctx->server_cert_callback)
667 ctx->pending_err = SERF_ERROR_SSL_CERT_FAILED;
673 /* This function reads an encrypted stream and returns the decrypted stream. */
674 static apr_status_t ssl_decrypt(void *baton, apr_size_t bufsize,
675 char *buf, apr_size_t *len)
677 serf_ssl_context_t *ctx = baton;
684 return ctx->fatal_err;
686 serf__log(SSL_VERBOSE, __FILE__, "ssl_decrypt: begin %d\n", bufsize);
688 /* Is there some data waiting to be read? */
689 ssl_len = SSL_read(ctx->ssl, buf, bufsize);
691 serf__log(SSL_VERBOSE, __FILE__,
692 "ssl_decrypt: %d bytes (%d); status: %d; flags: %d\n",
693 ssl_len, bufsize, ctx->decrypt.status,
694 BIO_get_retry_flags(ctx->bio));
699 status = serf_bucket_read(ctx->decrypt.stream, bufsize, &data, &priv_len);
701 if (!SERF_BUCKET_READ_ERROR(status) && priv_len) {
704 serf__log(SSL_VERBOSE, __FILE__,
705 "ssl_decrypt: read %d bytes (%d); status: %d\n",
706 priv_len, bufsize, status);
708 tmp = serf_bucket_simple_copy_create(data, priv_len,
709 ctx->decrypt.pending->allocator);
711 serf_bucket_aggregate_append(ctx->decrypt.pending, tmp);
713 ssl_len = SSL_read(ctx->ssl, buf, bufsize);
717 ssl_err = SSL_get_error(ctx->ssl, ssl_len);
719 case SSL_ERROR_SYSCALL:
721 /* Return the underlying network error that caused OpenSSL
722 to fail. ### This can be a crypt error! */
723 status = ctx->decrypt.status;
725 case SSL_ERROR_WANT_READ:
726 case SSL_ERROR_WANT_WRITE:
732 if (ctx->pending_err) {
733 status = ctx->pending_err;
734 ctx->pending_err = 0;
736 ctx->fatal_err = status = SERF_ERROR_SSL_COMM_FAILED;
741 ctx->fatal_err = status = SERF_ERROR_SSL_COMM_FAILED;
744 } else if (ssl_len == 0) {
745 /* The server shut down the connection. */
746 int ssl_err, shutdown;
749 /* Check for SSL_RECEIVED_SHUTDOWN */
750 shutdown = SSL_get_shutdown(ctx->ssl);
751 /* Check for SSL_ERROR_ZERO_RETURN */
752 ssl_err = SSL_get_error(ctx->ssl, ssl_len);
754 if (shutdown == SSL_RECEIVED_SHUTDOWN &&
755 ssl_err == SSL_ERROR_ZERO_RETURN) {
756 /* The server closed the SSL session. While this doesn't
757 necessary mean the connection is closed, let's close
759 We can optimize this later. */
760 serf__log(SSL_VERBOSE, __FILE__,
761 "ssl_decrypt: SSL read error: server"
762 " shut down connection!\n");
765 /* A fatal error occurred. */
766 ctx->fatal_err = status = SERF_ERROR_SSL_COMM_FAILED;
770 serf__log(SSL_MSG_VERBOSE, __FILE__,
771 "---\n%.*s\n-(%d)-\n", *len, buf, *len);
777 serf__log(SSL_VERBOSE, __FILE__,
778 "ssl_decrypt: %d %d %d\n", status, *len,
779 BIO_get_retry_flags(ctx->bio));
784 /* This function reads a decrypted stream and returns an encrypted stream. */
785 static apr_status_t ssl_encrypt(void *baton, apr_size_t bufsize,
786 char *buf, apr_size_t *len)
789 apr_size_t interim_bufsize;
790 serf_ssl_context_t *ctx = baton;
794 return ctx->fatal_err;
796 serf__log(SSL_VERBOSE, __FILE__, "ssl_encrypt: begin %d\n", bufsize);
798 /* Try to read already encrypted but unread data first. */
799 status = serf_bucket_read(ctx->encrypt.pending, bufsize, &data, len);
800 if (SERF_BUCKET_READ_ERROR(status)) {
804 /* Aha, we read something. Return that now. */
806 memcpy(buf, data, *len);
807 if (APR_STATUS_IS_EOF(status)) {
808 status = APR_SUCCESS;
811 serf__log(SSL_VERBOSE, __FILE__, "ssl_encrypt: %d %d %d (quick read)\n",
812 status, *len, BIO_get_retry_flags(ctx->bio));
817 if (BIO_should_retry(ctx->bio) && BIO_should_write(ctx->bio)) {
818 serf__log(SSL_VERBOSE, __FILE__,
819 "ssl_encrypt: %d %d %d (should write exit)\n",
820 status, *len, BIO_get_retry_flags(ctx->bio));
825 /* If we were previously blocked, unblock ourselves now. */
826 if (BIO_should_read(ctx->bio)) {
827 serf__log(SSL_VERBOSE, __FILE__, "ssl_encrypt: reset %d %d (%d %d %d)\n",
828 status, ctx->encrypt.status,
829 BIO_should_retry(ctx->bio), BIO_should_read(ctx->bio),
830 BIO_get_retry_flags(ctx->bio));
832 ctx->encrypt.status = APR_SUCCESS;
833 ctx->encrypt.exhausted_reset = 0;
836 /* Oh well, read from our stream now. */
837 interim_bufsize = bufsize;
839 apr_size_t interim_len;
841 if (!ctx->encrypt.status) {
842 struct iovec vecs[64];
845 status = serf_bucket_read_iovec(ctx->encrypt.stream,
846 interim_bufsize, 64, vecs,
849 if (!SERF_BUCKET_READ_ERROR(status) && vecs_read) {
851 int i, cur, vecs_data_len;
854 /* Combine the buffers of the iovec into one buffer, as
855 that is with SSL_write requires. */
857 for (i = 0; i < vecs_read; i++) {
858 vecs_data_len += vecs[i].iov_len;
861 vecs_data = serf_bucket_mem_alloc(ctx->allocator,
865 for (i = 0; i < vecs_read; i++) {
866 memcpy(vecs_data + cur, vecs[i].iov_base, vecs[i].iov_len);
867 cur += vecs[i].iov_len;
870 interim_bufsize -= vecs_data_len;
871 interim_len = vecs_data_len;
873 serf__log(SSL_VERBOSE, __FILE__,
874 "ssl_encrypt: bucket read %d bytes; "\
875 "status %d\n", interim_len, status);
876 serf__log(SSL_MSG_VERBOSE, __FILE__, "---\n%.*s\n-(%d)-\n",
877 interim_len, vecs_data, interim_len);
879 /* Stash our status away. */
880 ctx->encrypt.status = status;
882 ssl_len = SSL_write(ctx->ssl, vecs_data, interim_len);
884 serf__log(SSL_VERBOSE, __FILE__,
885 "ssl_encrypt: SSL write: %d\n", ssl_len);
887 /* If we failed to write... */
891 /* Ah, bugger. We need to put that data back.
892 Note: use the copy here, we do not own the original iovec
893 data buffer so it will be freed on next read. */
894 serf_bucket_t *vecs_copy =
895 serf_bucket_simple_own_create(vecs_data,
898 serf_bucket_aggregate_prepend(ctx->encrypt.stream,
901 ssl_err = SSL_get_error(ctx->ssl, ssl_len);
903 serf__log(SSL_VERBOSE, __FILE__,
904 "ssl_encrypt: SSL write error: %d\n", ssl_err);
906 if (ssl_err == SSL_ERROR_SYSCALL) {
907 /* Return the underlying network error that caused OpenSSL
908 to fail. ### This can be a decrypt error! */
909 status = ctx->encrypt.status;
910 if (SERF_BUCKET_READ_ERROR(status)) {
916 if (ssl_err == SSL_ERROR_WANT_READ) {
917 status = SERF_ERROR_WAIT_CONN;
920 ctx->fatal_err = status =
921 SERF_ERROR_SSL_COMM_FAILED;
925 serf__log(SSL_VERBOSE, __FILE__,
926 "ssl_encrypt: SSL write error: %d %d\n",
929 /* We're done with this data. */
930 serf_bucket_mem_free(ctx->allocator, vecs_data);
937 status = ctx->encrypt.status;
940 } while (!status && interim_bufsize);
942 /* Okay, we exhausted our underlying stream. */
943 if (!SERF_BUCKET_READ_ERROR(status)) {
944 apr_status_t agg_status;
945 struct iovec vecs[64];
948 /* We read something! */
949 agg_status = serf_bucket_read_iovec(ctx->encrypt.pending, bufsize,
950 64, vecs, &vecs_read);
952 for (i = 0; i < vecs_read; i++) {
953 memcpy(buf + *len, vecs[i].iov_base, vecs[i].iov_len);
954 *len += vecs[i].iov_len;
957 serf__log(SSL_VERBOSE, __FILE__,
958 "ssl_encrypt read agg: %d %d %d %d\n", status, agg_status,
959 ctx->encrypt.status, *len);
966 if (status == SERF_ERROR_WAIT_CONN
967 && BIO_should_retry(ctx->bio) && BIO_should_read(ctx->bio)) {
968 ctx->encrypt.exhausted = ctx->encrypt.status;
969 ctx->encrypt.status = SERF_ERROR_WAIT_CONN;
972 serf__log(SSL_VERBOSE, __FILE__,
973 "ssl_encrypt finished: %d %d (%d %d %d)\n", status, *len,
974 BIO_should_retry(ctx->bio), BIO_should_read(ctx->bio),
975 BIO_get_retry_flags(ctx->bio));
981 static apr_pool_t *ssl_pool;
982 static apr_thread_mutex_t **ssl_locks;
984 typedef struct CRYPTO_dynlock_value {
985 apr_thread_mutex_t *lock;
986 } CRYPTO_dynlock_value;
988 static CRYPTO_dynlock_value *ssl_dyn_create(const char* file, int line)
990 CRYPTO_dynlock_value *l;
993 l = apr_palloc(ssl_pool, sizeof(CRYPTO_dynlock_value));
994 rv = apr_thread_mutex_create(&l->lock, APR_THREAD_MUTEX_DEFAULT, ssl_pool);
995 if (rv != APR_SUCCESS) {
996 /* FIXME: return error here */
1001 static void ssl_dyn_lock(int mode, CRYPTO_dynlock_value *l, const char *file,
1004 if (mode & CRYPTO_LOCK) {
1005 apr_thread_mutex_lock(l->lock);
1007 else if (mode & CRYPTO_UNLOCK) {
1008 apr_thread_mutex_unlock(l->lock);
1012 static void ssl_dyn_destroy(CRYPTO_dynlock_value *l, const char *file,
1015 apr_thread_mutex_destroy(l->lock);
1018 static void ssl_lock(int mode, int n, const char *file, int line)
1020 if (mode & CRYPTO_LOCK) {
1021 apr_thread_mutex_lock(ssl_locks[n]);
1023 else if (mode & CRYPTO_UNLOCK) {
1024 apr_thread_mutex_unlock(ssl_locks[n]);
1028 static unsigned long ssl_id(void)
1030 /* FIXME: This is lame and not portable. -aaron */
1031 return (unsigned long) apr_os_thread_current();
1034 static apr_status_t cleanup_ssl(void *data)
1036 CRYPTO_set_locking_callback(NULL);
1037 CRYPTO_set_id_callback(NULL);
1038 CRYPTO_set_dynlock_create_callback(NULL);
1039 CRYPTO_set_dynlock_lock_callback(NULL);
1040 CRYPTO_set_dynlock_destroy_callback(NULL);
1047 #if !APR_VERSION_AT_LEAST(1,0,0)
1048 #define apr_atomic_cas32(mem, with, cmp) apr_atomic_cas(mem, with, cmp)
1053 INIT_UNINITIALIZED = 0,
1058 static volatile apr_uint32_t have_init_ssl = INIT_UNINITIALIZED;
1060 static void init_ssl_libraries(void)
1064 val = apr_atomic_cas32(&have_init_ssl, INIT_BUSY, INIT_UNINITIALIZED);
1072 /* Warn when compile-time and run-time version of OpenSSL differ in
1073 major/minor version number. */
1074 long libver = SSLeay();
1076 if ((libver ^ OPENSSL_VERSION_NUMBER) & 0xFFF00000) {
1077 serf__log(SSL_VERBOSE, __FILE__,
1078 "Warning: OpenSSL library version mismatch, compile-time "
1079 "was %lx, runtime is %lx.\n",
1080 OPENSSL_VERSION_NUMBER, libver);
1084 CRYPTO_malloc_init();
1085 ERR_load_crypto_strings();
1086 SSL_load_error_strings();
1088 OpenSSL_add_all_algorithms();
1091 numlocks = CRYPTO_num_locks();
1092 apr_pool_create(&ssl_pool, NULL);
1093 ssl_locks = apr_palloc(ssl_pool, sizeof(apr_thread_mutex_t*)*numlocks);
1094 for (i = 0; i < numlocks; i++) {
1097 /* Intraprocess locks don't /need/ a filename... */
1098 rv = apr_thread_mutex_create(&ssl_locks[i],
1099 APR_THREAD_MUTEX_DEFAULT, ssl_pool);
1100 if (rv != APR_SUCCESS) {
1101 /* FIXME: error out here */
1104 CRYPTO_set_locking_callback(ssl_lock);
1105 CRYPTO_set_id_callback(ssl_id);
1106 CRYPTO_set_dynlock_create_callback(ssl_dyn_create);
1107 CRYPTO_set_dynlock_lock_callback(ssl_dyn_lock);
1108 CRYPTO_set_dynlock_destroy_callback(ssl_dyn_destroy);
1110 apr_pool_cleanup_register(ssl_pool, NULL, cleanup_ssl, cleanup_ssl);
1112 apr_atomic_cas32(&have_init_ssl, INIT_DONE, INIT_BUSY);
1116 /* Make sure we don't continue before the initialization in another
1117 thread has completed */
1118 while (val != INIT_DONE) {
1119 apr_sleep(APR_USEC_PER_SEC / 1000);
1121 val = apr_atomic_cas32(&have_init_ssl,
1123 INIT_UNINITIALIZED);
1128 static int ssl_need_client_cert(SSL *ssl, X509 **cert, EVP_PKEY **pkey)
1130 serf_ssl_context_t *ctx = SSL_get_app_data(ssl);
1131 apr_status_t status;
1133 if (ctx->cached_cert) {
1134 *cert = ctx->cached_cert;
1135 *pkey = ctx->cached_cert_pw;
1139 while (ctx->cert_callback) {
1140 const char *cert_path;
1141 apr_file_t *cert_file;
1145 int retrying_success = 0;
1147 if (ctx->cert_file_success) {
1148 status = APR_SUCCESS;
1149 cert_path = ctx->cert_file_success;
1150 ctx->cert_file_success = NULL;
1151 retrying_success = 1;
1153 status = ctx->cert_callback(ctx->cert_userdata, &cert_path);
1156 if (status || !cert_path) {
1160 /* Load the x.509 cert file stored in PKCS12 */
1161 status = apr_file_open(&cert_file, cert_path, APR_READ, APR_OS_DEFAULT,
1168 bio = BIO_new(&bio_file_method);
1169 bio->ptr = cert_file;
1171 ctx->cert_path = cert_path;
1172 p12 = d2i_PKCS12_bio(bio, NULL);
1173 apr_file_close(cert_file);
1175 i = PKCS12_parse(p12, NULL, pkey, cert, NULL);
1179 ctx->cached_cert = *cert;
1180 ctx->cached_cert_pw = *pkey;
1181 if (!retrying_success && ctx->cert_cache_pool) {
1184 c = apr_pstrdup(ctx->cert_cache_pool, ctx->cert_path);
1186 apr_pool_userdata_setn(c, "serf:ssl:cert",
1187 apr_pool_cleanup_null,
1188 ctx->cert_cache_pool);
1193 int err = ERR_get_error();
1195 if (ERR_GET_LIB(err) == ERR_LIB_PKCS12 &&
1196 ERR_GET_REASON(err) == PKCS12_R_MAC_VERIFY_FAILURE) {
1197 if (ctx->cert_pw_callback) {
1198 const char *password;
1200 if (ctx->cert_pw_success) {
1201 status = APR_SUCCESS;
1202 password = ctx->cert_pw_success;
1203 ctx->cert_pw_success = NULL;
1205 status = ctx->cert_pw_callback(ctx->cert_pw_userdata,
1210 if (!status && password) {
1211 i = PKCS12_parse(p12, password, pkey, cert, NULL);
1214 ctx->cached_cert = *cert;
1215 ctx->cached_cert_pw = *pkey;
1216 if (!retrying_success && ctx->cert_cache_pool) {
1219 c = apr_pstrdup(ctx->cert_cache_pool,
1222 apr_pool_userdata_setn(c, "serf:ssl:cert",
1223 apr_pool_cleanup_null,
1224 ctx->cert_cache_pool);
1226 if (!retrying_success && ctx->cert_pw_cache_pool) {
1229 c = apr_pstrdup(ctx->cert_pw_cache_pool,
1232 apr_pool_userdata_setn(c, "serf:ssl:certpw",
1233 apr_pool_cleanup_null,
1234 ctx->cert_pw_cache_pool);
1244 printf("OpenSSL cert error: %d %d %d\n", ERR_GET_LIB(err),
1246 ERR_GET_REASON(err));
1256 void serf_ssl_client_cert_provider_set(
1257 serf_ssl_context_t *context,
1258 serf_ssl_need_client_cert_t callback,
1262 context->cert_callback = callback;
1263 context->cert_userdata = data;
1264 context->cert_cache_pool = cache_pool;
1265 if (context->cert_cache_pool) {
1266 apr_pool_userdata_get((void**)&context->cert_file_success,
1267 "serf:ssl:cert", cache_pool);
1272 void serf_ssl_client_cert_password_set(
1273 serf_ssl_context_t *context,
1274 serf_ssl_need_cert_password_t callback,
1278 context->cert_pw_callback = callback;
1279 context->cert_pw_userdata = data;
1280 context->cert_pw_cache_pool = cache_pool;
1281 if (context->cert_pw_cache_pool) {
1282 apr_pool_userdata_get((void**)&context->cert_pw_success,
1283 "serf:ssl:certpw", cache_pool);
1288 void serf_ssl_server_cert_callback_set(
1289 serf_ssl_context_t *context,
1290 serf_ssl_need_server_cert_t callback,
1293 context->server_cert_callback = callback;
1294 context->server_cert_userdata = data;
1297 void serf_ssl_server_cert_chain_callback_set(
1298 serf_ssl_context_t *context,
1299 serf_ssl_need_server_cert_t cert_callback,
1300 serf_ssl_server_cert_chain_cb_t cert_chain_callback,
1303 context->server_cert_callback = cert_callback;
1304 context->server_cert_chain_callback = cert_chain_callback;
1305 context->server_cert_userdata = data;
1308 static serf_ssl_context_t *ssl_init_context(serf_bucket_alloc_t *allocator)
1310 serf_ssl_context_t *ssl_ctx;
1312 init_ssl_libraries();
1314 ssl_ctx = serf_bucket_mem_alloc(allocator, sizeof(*ssl_ctx));
1316 ssl_ctx->refcount = 0;
1317 ssl_ctx->pool = serf_bucket_allocator_get_pool(allocator);
1318 ssl_ctx->allocator = allocator;
1320 /* Use the best possible protocol version, but disable the broken SSLv2/3 */
1321 ssl_ctx->ctx = SSL_CTX_new(SSLv23_client_method());
1322 SSL_CTX_set_options(ssl_ctx->ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
1324 SSL_CTX_set_client_cert_cb(ssl_ctx->ctx, ssl_need_client_cert);
1325 ssl_ctx->cached_cert = 0;
1326 ssl_ctx->cached_cert_pw = 0;
1327 ssl_ctx->pending_err = APR_SUCCESS;
1328 ssl_ctx->fatal_err = APR_SUCCESS;
1330 ssl_ctx->cert_callback = NULL;
1331 ssl_ctx->cert_pw_callback = NULL;
1332 ssl_ctx->server_cert_callback = NULL;
1333 ssl_ctx->server_cert_chain_callback = NULL;
1335 SSL_CTX_set_verify(ssl_ctx->ctx, SSL_VERIFY_PEER,
1336 validate_server_certificate);
1337 SSL_CTX_set_options(ssl_ctx->ctx, SSL_OP_ALL);
1338 /* Disable SSL compression by default. */
1339 disable_compression(ssl_ctx);
1341 ssl_ctx->ssl = SSL_new(ssl_ctx->ctx);
1342 ssl_ctx->bio = BIO_new(&bio_bucket_method);
1343 ssl_ctx->bio->ptr = ssl_ctx;
1345 SSL_set_bio(ssl_ctx->ssl, ssl_ctx->bio, ssl_ctx->bio);
1347 SSL_set_connect_state(ssl_ctx->ssl);
1349 SSL_set_app_data(ssl_ctx->ssl, ssl_ctx);
1352 SSL_CTX_set_info_callback(ssl_ctx->ctx, apps_ssl_info_callback);
1355 ssl_ctx->encrypt.stream = NULL;
1356 ssl_ctx->encrypt.stream_next = NULL;
1357 ssl_ctx->encrypt.pending = serf_bucket_aggregate_create(allocator);
1358 ssl_ctx->encrypt.status = APR_SUCCESS;
1359 serf_databuf_init(&ssl_ctx->encrypt.databuf);
1360 ssl_ctx->encrypt.databuf.read = ssl_encrypt;
1361 ssl_ctx->encrypt.databuf.read_baton = ssl_ctx;
1363 ssl_ctx->decrypt.stream = NULL;
1364 ssl_ctx->decrypt.pending = serf_bucket_aggregate_create(allocator);
1365 ssl_ctx->decrypt.status = APR_SUCCESS;
1366 serf_databuf_init(&ssl_ctx->decrypt.databuf);
1367 ssl_ctx->decrypt.databuf.read = ssl_decrypt;
1368 ssl_ctx->decrypt.databuf.read_baton = ssl_ctx;
1373 static apr_status_t ssl_free_context(
1374 serf_ssl_context_t *ssl_ctx)
1376 /* If never had the pending buckets, don't try to free them. */
1377 if (ssl_ctx->decrypt.pending != NULL) {
1378 serf_bucket_destroy(ssl_ctx->decrypt.pending);
1380 if (ssl_ctx->encrypt.pending != NULL) {
1381 serf_bucket_destroy(ssl_ctx->encrypt.pending);
1384 /* SSL_free implicitly frees the underlying BIO. */
1385 SSL_free(ssl_ctx->ssl);
1386 SSL_CTX_free(ssl_ctx->ctx);
1388 serf_bucket_mem_free(ssl_ctx->allocator, ssl_ctx);
1393 static serf_bucket_t * serf_bucket_ssl_create(
1394 serf_ssl_context_t *ssl_ctx,
1395 serf_bucket_alloc_t *allocator,
1396 const serf_bucket_type_t *type)
1400 ctx = serf_bucket_mem_alloc(allocator, sizeof(*ctx));
1402 ctx->ssl_ctx = ssl_init_context(allocator);
1405 ctx->ssl_ctx = ssl_ctx;
1407 ctx->ssl_ctx->refcount++;
1409 return serf_bucket_create(type, allocator, ctx);
1412 apr_status_t serf_ssl_set_hostname(serf_ssl_context_t *context,
1413 const char * hostname)
1415 #ifdef SSL_set_tlsext_host_name
1416 if (SSL_set_tlsext_host_name(context->ssl, hostname) != 1) {
1423 apr_status_t serf_ssl_use_default_certificates(serf_ssl_context_t *ssl_ctx)
1425 X509_STORE *store = SSL_CTX_get_cert_store(ssl_ctx->ctx);
1427 int result = X509_STORE_set_default_paths(store);
1429 return result ? APR_SUCCESS : SERF_ERROR_SSL_CERT_FAILED;
1432 apr_status_t serf_ssl_load_cert_file(
1433 serf_ssl_certificate_t **cert,
1434 const char *file_path,
1437 FILE *fp = fopen(file_path, "r");
1440 X509 *ssl_cert = PEM_read_X509(fp, NULL, NULL, NULL);
1444 *cert = apr_palloc(pool, sizeof(serf_ssl_certificate_t));
1445 (*cert)->ssl_cert = ssl_cert;
1451 return SERF_ERROR_SSL_CERT_FAILED;
1455 apr_status_t serf_ssl_trust_cert(
1456 serf_ssl_context_t *ssl_ctx,
1457 serf_ssl_certificate_t *cert)
1459 X509_STORE *store = SSL_CTX_get_cert_store(ssl_ctx->ctx);
1461 int result = X509_STORE_add_cert(store, cert->ssl_cert);
1463 return result ? APR_SUCCESS : SERF_ERROR_SSL_CERT_FAILED;
1467 serf_bucket_t *serf_bucket_ssl_decrypt_create(
1468 serf_bucket_t *stream,
1469 serf_ssl_context_t *ssl_ctx,
1470 serf_bucket_alloc_t *allocator)
1475 bkt = serf_bucket_ssl_create(ssl_ctx, allocator,
1476 &serf_bucket_type_ssl_decrypt);
1480 ctx->databuf = &ctx->ssl_ctx->decrypt.databuf;
1481 if (ctx->ssl_ctx->decrypt.stream != NULL) {
1484 ctx->ssl_ctx->decrypt.stream = stream;
1485 ctx->our_stream = &ctx->ssl_ctx->decrypt.stream;
1491 serf_ssl_context_t *serf_bucket_ssl_decrypt_context_get(
1492 serf_bucket_t *bucket)
1494 ssl_context_t *ctx = bucket->data;
1495 return ctx->ssl_ctx;
1499 serf_bucket_t *serf_bucket_ssl_encrypt_create(
1500 serf_bucket_t *stream,
1501 serf_ssl_context_t *ssl_ctx,
1502 serf_bucket_alloc_t *allocator)
1507 bkt = serf_bucket_ssl_create(ssl_ctx, allocator,
1508 &serf_bucket_type_ssl_encrypt);
1512 ctx->databuf = &ctx->ssl_ctx->encrypt.databuf;
1513 ctx->our_stream = &ctx->ssl_ctx->encrypt.stream;
1514 if (ctx->ssl_ctx->encrypt.stream == NULL) {
1515 serf_bucket_t *tmp = serf_bucket_aggregate_create(stream->allocator);
1516 serf_bucket_aggregate_append(tmp, stream);
1517 ctx->ssl_ctx->encrypt.stream = tmp;
1520 bucket_list_t *new_list;
1522 new_list = serf_bucket_mem_alloc(ctx->ssl_ctx->allocator,
1524 new_list->bucket = stream;
1525 new_list->next = NULL;
1526 if (ctx->ssl_ctx->encrypt.stream_next == NULL) {
1527 ctx->ssl_ctx->encrypt.stream_next = new_list;
1530 bucket_list_t *scan = ctx->ssl_ctx->encrypt.stream_next;
1532 while (scan->next != NULL)
1534 scan->next = new_list;
1542 serf_ssl_context_t *serf_bucket_ssl_encrypt_context_get(
1543 serf_bucket_t *bucket)
1545 ssl_context_t *ctx = bucket->data;
1546 return ctx->ssl_ctx;
1549 /* Functions to read a serf_ssl_certificate structure. */
1551 /* Takes a counted length string and escapes any NUL bytes so that
1552 * it can be used as a C string. NUL bytes are escaped as 3 characters
1553 * "\00" (that's a literal backslash).
1554 * The returned string is allocated in POOL.
1557 pstrdup_escape_nul_bytes(const char *buf, int len, apr_pool_t *pool)
1559 int i, nul_count = 0;
1562 /* First determine if there are any nul bytes in the string. */
1563 for (i = 0; i < len; i++) {
1568 if (nul_count == 0) {
1569 /* There aren't so easy case to just copy the string */
1570 ret = apr_pstrdup(pool, buf);
1572 /* There are so we have to replace nul bytes with escape codes
1573 * Proper length is the length of the original string, plus
1574 * 2 times the number of nulls (for two digit hex code for
1575 * the value) + the trailing null. */
1577 ret = pos = apr_palloc(pool, len + 2 * nul_count + 1);
1578 for (i = 0; i < len; i++) {
1579 if (buf[i] != '\0') {
1593 /* Creates a hash_table with keys (E, CN, OU, O, L, ST and C). Any NUL bytes in
1594 these fields in the certificate will be escaped as \00. */
1596 convert_X509_NAME_to_table(X509_NAME *org, apr_pool_t *pool)
1601 apr_hash_t *tgt = apr_hash_make(pool);
1603 ret = X509_NAME_get_text_by_NID(org,
1607 apr_hash_set(tgt, "CN", APR_HASH_KEY_STRING,
1608 pstrdup_escape_nul_bytes(buf, ret, pool));
1609 ret = X509_NAME_get_text_by_NID(org,
1610 NID_pkcs9_emailAddress,
1613 apr_hash_set(tgt, "E", APR_HASH_KEY_STRING,
1614 pstrdup_escape_nul_bytes(buf, ret, pool));
1615 ret = X509_NAME_get_text_by_NID(org,
1616 NID_organizationalUnitName,
1619 apr_hash_set(tgt, "OU", APR_HASH_KEY_STRING,
1620 pstrdup_escape_nul_bytes(buf, ret, pool));
1621 ret = X509_NAME_get_text_by_NID(org,
1622 NID_organizationName,
1625 apr_hash_set(tgt, "O", APR_HASH_KEY_STRING,
1626 pstrdup_escape_nul_bytes(buf, ret, pool));
1627 ret = X509_NAME_get_text_by_NID(org,
1631 apr_hash_set(tgt, "L", APR_HASH_KEY_STRING,
1632 pstrdup_escape_nul_bytes(buf, ret, pool));
1633 ret = X509_NAME_get_text_by_NID(org,
1634 NID_stateOrProvinceName,
1637 apr_hash_set(tgt, "ST", APR_HASH_KEY_STRING,
1638 pstrdup_escape_nul_bytes(buf, ret, pool));
1639 ret = X509_NAME_get_text_by_NID(org,
1643 apr_hash_set(tgt, "C", APR_HASH_KEY_STRING,
1644 pstrdup_escape_nul_bytes(buf, ret, pool));
1650 int serf_ssl_cert_depth(const serf_ssl_certificate_t *cert)
1656 apr_hash_t *serf_ssl_cert_issuer(
1657 const serf_ssl_certificate_t *cert,
1660 X509_NAME *issuer = X509_get_issuer_name(cert->ssl_cert);
1665 return convert_X509_NAME_to_table(issuer, pool);
1669 apr_hash_t *serf_ssl_cert_subject(
1670 const serf_ssl_certificate_t *cert,
1673 X509_NAME *subject = X509_get_subject_name(cert->ssl_cert);
1678 return convert_X509_NAME_to_table(subject, pool);
1682 apr_hash_t *serf_ssl_cert_certificate(
1683 const serf_ssl_certificate_t *cert,
1686 apr_hash_t *tgt = apr_hash_make(pool);
1687 unsigned int md_size, i;
1688 unsigned char md[EVP_MAX_MD_SIZE];
1690 apr_array_header_t *san_arr;
1692 /* sha1 fingerprint */
1693 if (X509_digest(cert->ssl_cert, EVP_sha1(), md, &md_size)) {
1694 const char hex[] = "0123456789ABCDEF";
1695 char fingerprint[EVP_MAX_MD_SIZE * 3];
1697 for (i=0; i<md_size; i++) {
1698 fingerprint[3*i] = hex[(md[i] & 0xf0) >> 4];
1699 fingerprint[(3*i)+1] = hex[(md[i] & 0x0f)];
1700 fingerprint[(3*i)+2] = ':';
1703 fingerprint[(3*(md_size-1))+2] = '\0';
1705 fingerprint[0] = '\0';
1707 apr_hash_set(tgt, "sha1", APR_HASH_KEY_STRING,
1708 apr_pstrdup(pool, fingerprint));
1711 /* set expiry dates */
1712 bio = BIO_new(BIO_s_mem());
1714 ASN1_TIME *notBefore, *notAfter;
1717 memset (buf, 0, sizeof (buf));
1718 notBefore = X509_get_notBefore(cert->ssl_cert);
1719 if (ASN1_TIME_print(bio, notBefore)) {
1720 BIO_read(bio, buf, 255);
1721 apr_hash_set(tgt, "notBefore", APR_HASH_KEY_STRING,
1722 apr_pstrdup(pool, buf));
1724 memset (buf, 0, sizeof (buf));
1725 notAfter = X509_get_notAfter(cert->ssl_cert);
1726 if (ASN1_TIME_print(bio, notAfter)) {
1727 BIO_read(bio, buf, 255);
1728 apr_hash_set(tgt, "notAfter", APR_HASH_KEY_STRING,
1729 apr_pstrdup(pool, buf));
1734 /* Get subjectAltNames */
1735 if (!get_subject_alt_names(&san_arr, cert->ssl_cert, EscapeNulAndCopy, pool))
1736 apr_hash_set(tgt, "subjectAltName", APR_HASH_KEY_STRING, san_arr);
1742 const char *serf_ssl_cert_export(
1743 const serf_ssl_certificate_t *cert,
1749 unsigned char *unused;
1751 /* find the length of the DER encoding. */
1752 len = i2d_X509(cert->ssl_cert, NULL);
1757 binary_cert = apr_palloc(pool, len);
1758 unused = (unsigned char *)binary_cert;
1759 len = i2d_X509(cert->ssl_cert, &unused); /* unused is incremented */
1764 encoded_cert = apr_palloc(pool, apr_base64_encode_len(len));
1765 apr_base64_encode(encoded_cert, binary_cert, len);
1767 return encoded_cert;
1770 /* Disables compression for all SSL sessions. */
1771 static void disable_compression(serf_ssl_context_t *ssl_ctx)
1773 #ifdef SSL_OP_NO_COMPRESSION
1774 SSL_CTX_set_options(ssl_ctx->ctx, SSL_OP_NO_COMPRESSION);
1778 apr_status_t serf_ssl_use_compression(serf_ssl_context_t *ssl_ctx, int enabled)
1781 #ifdef SSL_OP_NO_COMPRESSION
1782 SSL_clear_options(ssl_ctx->ssl, SSL_OP_NO_COMPRESSION);
1786 #ifdef SSL_OP_NO_COMPRESSION
1787 SSL_set_options(ssl_ctx->ssl, SSL_OP_NO_COMPRESSION);
1792 return APR_EGENERAL;
1795 static void serf_ssl_destroy_and_data(serf_bucket_t *bucket)
1797 ssl_context_t *ctx = bucket->data;
1799 if (!--ctx->ssl_ctx->refcount) {
1800 ssl_free_context(ctx->ssl_ctx);
1803 serf_default_destroy_and_data(bucket);
1806 static void serf_ssl_decrypt_destroy_and_data(serf_bucket_t *bucket)
1808 ssl_context_t *ctx = bucket->data;
1810 serf_bucket_destroy(*ctx->our_stream);
1812 serf_ssl_destroy_and_data(bucket);
1815 static void serf_ssl_encrypt_destroy_and_data(serf_bucket_t *bucket)
1817 ssl_context_t *ctx = bucket->data;
1818 serf_ssl_context_t *ssl_ctx = ctx->ssl_ctx;
1820 if (ssl_ctx->encrypt.stream == *ctx->our_stream) {
1821 serf_bucket_destroy(*ctx->our_stream);
1822 serf_bucket_destroy(ssl_ctx->encrypt.pending);
1824 /* Reset our encrypted status and databuf. */
1825 ssl_ctx->encrypt.status = APR_SUCCESS;
1826 ssl_ctx->encrypt.databuf.status = APR_SUCCESS;
1828 /* Advance to the next stream - if we have one. */
1829 if (ssl_ctx->encrypt.stream_next == NULL) {
1830 ssl_ctx->encrypt.stream = NULL;
1831 ssl_ctx->encrypt.pending = NULL;
1836 cur = ssl_ctx->encrypt.stream_next;
1837 ssl_ctx->encrypt.stream = cur->bucket;
1838 ssl_ctx->encrypt.pending =
1839 serf_bucket_aggregate_create(cur->bucket->allocator);
1840 ssl_ctx->encrypt.stream_next = cur->next;
1841 serf_bucket_mem_free(ssl_ctx->allocator, cur);
1845 /* Ah, darn. We haven't sent this one along yet. */
1848 serf_ssl_destroy_and_data(bucket);
1851 static apr_status_t serf_ssl_read(serf_bucket_t *bucket,
1852 apr_size_t requested,
1853 const char **data, apr_size_t *len)
1855 ssl_context_t *ctx = bucket->data;
1857 return serf_databuf_read(ctx->databuf, requested, data, len);
1860 static apr_status_t serf_ssl_readline(serf_bucket_t *bucket,
1861 int acceptable, int *found,
1865 ssl_context_t *ctx = bucket->data;
1867 return serf_databuf_readline(ctx->databuf, acceptable, found, data, len);
1870 static apr_status_t serf_ssl_peek(serf_bucket_t *bucket,
1874 ssl_context_t *ctx = bucket->data;
1876 return serf_databuf_peek(ctx->databuf, data, len);
1880 const serf_bucket_type_t serf_bucket_type_ssl_encrypt = {
1884 serf_default_read_iovec,
1885 serf_default_read_for_sendfile,
1886 serf_default_read_bucket,
1888 serf_ssl_encrypt_destroy_and_data,
1891 const serf_bucket_type_t serf_bucket_type_ssl_decrypt = {
1895 serf_default_read_iovec,
1896 serf_default_read_for_sendfile,
1897 serf_default_read_bucket,
1899 serf_ssl_decrypt_destroy_and_data,