ViewVC Help

View File | Revision Log | Show Annotations | View Changeset | Root Listing

root/svn/ircd-hybrid/trunk/src/tls_openssl.c

Comparing ircd-hybrid/trunk/src/tls_openssl.c (file contents):
Revision 9130 by michael, Mon Jan 6 16:11:21 2020 UTC vs.
Revision 9131 by michael, Fri Jan 10 19:11:40 2020 UTC

#	Line 34 | Line 34
34		#include "memory.h"
35
36		#ifdef HAVE_TLS_OPENSSL
37	+	#if OPENSSL_VERSION_NUMBER < 0x1010100fL
38	+	#error "OpenSSL 1.1.1 and above is required to build this module"
39	+	#endif
40
41		static bool TLS_initialized;
42
#	Line 70 | Line 73 | tls_is_initialized(void)
73		void
74		tls_init(void)
75		{
76	<	SSL_load_error_strings();
74	<	SSLeay_add_ssl_algorithms();
75	<
76	<	if ((ConfigServerInfo.tls_ctx.server_ctx = SSL_CTX_new(SSLv23_server_method())) == NULL)
76	>	if ((ConfigServerInfo.tls_ctx.server_ctx = SSL_CTX_new(TLS_server_method())) == NULL)
77		{
78		const char *s = ERR_lib_error_string(ERR_get_error());
79
80	<	ilog(LOG_TYPE_IRCD, "ERROR: Could not initialize the TLS Server context -- %s", s);
80	>	ilog(LOG_TYPE_IRCD, "ERROR: Could not initialize the TLS server context -- %s", s);
81		exit(EXIT_FAILURE);
82		return;  /* Not reached */
83		}
84
85	<	SSL_CTX_set_options(ConfigServerInfo.tls_ctx.server_ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1|SSL_OP_NO_TICKET);
86	<	SSL_CTX_set_options(ConfigServerInfo.tls_ctx.server_ctx, SSL_OP_SINGLE_DH_USE|SSL_OP_CIPHER_SERVER_PREFERENCE);
87	<	SSL_CTX_set_verify(ConfigServerInfo.tls_ctx.server_ctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,
88	<	always_accept_verify_cb);
85	>	SSL_CTX_set_min_proto_version(ConfigServerInfo.tls_ctx.server_ctx, TLS1_2_VERSION);
86	>	SSL_CTX_set_options(ConfigServerInfo.tls_ctx.server_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE|SSL_OP_NO_TICKET);
87	>	SSL_CTX_set_verify(ConfigServerInfo.tls_ctx.server_ctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, always_accept_verify_cb);
88		SSL_CTX_set_session_cache_mode(ConfigServerInfo.tls_ctx.server_ctx, SSL_SESS_CACHE_OFF);
89		SSL_CTX_set_cipher_list(ConfigServerInfo.tls_ctx.server_ctx, "EECDH+HIGH:EDH+HIGH:HIGH:!aNULL");
90
91	<	#ifndef OPENSSL_NO_ECDH
93	<	SSL_CTX_set_options(ConfigServerInfo.tls_ctx.server_ctx, SSL_OP_SINGLE_ECDH_USE);
94	<
95	<	#if OPENSSL_VERSION_NUMBER < 0x10002000L
96	<	EC_KEY *key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
97	<
98	<	if (key)
99	<	{
100	<	SSL_CTX_set_tmp_ecdh(ConfigServerInfo.tls_ctx.server_ctx, key);
101	<	EC_KEY_free(key);
102	<	}
103	<	#elif OPENSSL_VERSION_NUMBER < 0x10100000L
104	<	SSL_CTX_set_ecdh_auto(ConfigServerInfo.tls_ctx.server_ctx, 1);
105	<	#endif
106	<	/* SSL_CTX_set_ecdh_auto() no longer exists as of 1.1.0 */
107	<	#endif
108	<
109	<	if ((ConfigServerInfo.tls_ctx.client_ctx = SSL_CTX_new(SSLv23_client_method())) == NULL)
91	>	if ((ConfigServerInfo.tls_ctx.client_ctx = SSL_CTX_new(TLS_client_method())) == NULL)
92		{
93		const char *s = ERR_lib_error_string(ERR_get_error());
94
95	<	ilog(LOG_TYPE_IRCD, "ERROR: Could not initialize the TLS Client context -- %s", s);
95	>	ilog(LOG_TYPE_IRCD, "ERROR: Could not initialize the TLS client context -- %s", s);
96		exit(EXIT_FAILURE);
97		return;  /* Not reached */
98		}
99
100	<	SSL_CTX_set_options(ConfigServerInfo.tls_ctx.client_ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1|SSL_OP_NO_TICKET);
101	<	SSL_CTX_set_options(ConfigServerInfo.tls_ctx.client_ctx, SSL_OP_SINGLE_DH_USE);
102	<	SSL_CTX_set_verify(ConfigServerInfo.tls_ctx.client_ctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,
121	<	always_accept_verify_cb);
100	>	SSL_CTX_set_min_proto_version(ConfigServerInfo.tls_ctx.client_ctx, TLS1_2_VERSION);
101	>	SSL_CTX_set_options(ConfigServerInfo.tls_ctx.client_ctx, SSL_OP_NO_TICKET);
102	>	SSL_CTX_set_verify(ConfigServerInfo.tls_ctx.client_ctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, always_accept_verify_cb);
103		SSL_CTX_set_session_cache_mode(ConfigServerInfo.tls_ctx.client_ctx, SSL_SESS_CACHE_OFF);
104		}
105
#	Line 171 | Line 152 | tls_new_cred(void)
152		ilog(LOG_TYPE_IRCD, "Ignoring serverinfo::ssl_dh_param_file -- could not open/read Diffie-Hellman parameter file");
153		}
154
174	–	#ifndef OPENSSL_NO_ECDH
155		if (ConfigServerInfo.ssl_dh_elliptic_curve)
156		{
157		int nid = 0;
#	Line 189 | Line 169 | tls_new_cred(void)
169		else
170		{
171		set_default_curve: ;
192	–	#if OPENSSL_VERSION_NUMBER < 0x10002000L
193	–	EC_KEY *key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
194	–
195	–	if (key)
196	–	{
197	–	SSL_CTX_set_tmp_ecdh(ConfigServerInfo.tls_ctx.server_ctx, key);
198	–	EC_KEY_free(key);
199	–	}
200	–	#elif OPENSSL_VERSION_NUMBER < 0x10100000L
201	–	SSL_CTX_set_ecdh_auto(ConfigServerInfo.tls_ctx.server_ctx, 1);
202	–	#endif
172		/* SSL_CTX_set_ecdh_auto() no longer exists as of 1.1.0 */
173		}
205	–	#endif
174
175		if (ConfigServerInfo.ssl_message_digest_algorithm == NULL)
176		ConfigServerInfo.message_digest_algorithm = EVP_sha256();
#	Line 244 | Line 212 | tls_get_version(void)
212		static char buf[IRCD_BUFSIZE];
213
214		snprintf(buf, sizeof(buf), "OpenSSL version: library: %s, header: %s",
215	<	SSLeay_version(SSLEAY_VERSION), OPENSSL_VERSION_TEXT);
215	>	OpenSSL_version(OPENSSL_VERSION), OPENSSL_VERSION_TEXT);
216		return buf;
217		}
218

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines (old)
>	Changed lines (new)