1 /* 2 * mod_openssl - openssl support for lighttpd 3 * 4 * Fully-rewritten from original 5 * Copyright(c) 2016 Glenn Strauss gstrauss()gluelogic.com All rights reserved 6 * License: BSD 3-clause (same as lighttpd) 7 */ 8 /* 9 * Note: If session tickets are -not- disabled with 10 * ssl.openssl.ssl-conf-cmd = ("Options" => "-SessionTicket") 11 * mod_openssl rotates server ticket encryption key (STEK) every 8 hours 12 * and keeps the prior two STEKs around, so ticket lifetime is 24 hours. 13 * This is fine for use with a single lighttpd instance, but with multiple 14 * lighttpd workers, no coordinated STEK (server ticket encryption key) 15 * rotation occurs unless ssl.stek-file is defined and maintained (preferred), 16 * or if some external job restarts lighttpd. Restarting lighttpd generates a 17 * new key that is shared by lighttpd workers for the lifetime of the new key. 18 * If the rotation period expires and lighttpd has not been restarted, and if 19 * ssl.stek-file is not in use, then lighttpd workers will generate new 20 * independent keys, making session tickets less effective for session 21 * resumption, since clients have a lower chance for future connections to 22 * reach the same lighttpd worker. However, things will still work, and a new 23 * session will be created if session resumption fails. Admins should plan to 24 * restart lighttpd at least every 8 hours if session tickets are enabled and 25 * multiple lighttpd workers are configured. Since that is likely disruptive, 26 * if multiple lighttpd workers are configured, ssl.stek-file should be 27 * defined and the file maintained externally. 28 */ 29 #include "first.h" 30 31 #include <sys/types.h> 32 #include <sys/stat.h> 33 #include <errno.h> 34 #include <fcntl.h> 35 #include <stdint.h> 36 #include <stdlib.h> 37 #include <string.h> 38 39 /*(not needed)*/ 40 /* correction; needed for: 41 * SSL_load_client_CA_file() 42 * X509_STORE_load_locations() 43 */ 44 /*#define OPENSSL_NO_STDIO*/ 45 46 #ifndef USE_OPENSSL_KERBEROS 47 #ifndef OPENSSL_NO_KRB5 48 #define OPENSSL_NO_KRB5 49 #endif 50 #endif 51 52 #ifdef BORINGSSL_API_VERSION 53 #undef OPENSSL_NO_STDIO /* for X509_STORE_load_locations() */ 54 #endif 55 56 #include <openssl/ssl.h> 57 #include <openssl/bio.h> 58 #include <openssl/bn.h> 59 #include <openssl/err.h> 60 #include <openssl/objects.h> 61 #include <openssl/pem.h> 62 #include <openssl/rand.h> 63 #include <openssl/tls1.h> 64 #ifndef OPENSSL_NO_DH 65 #include <openssl/dh.h> 66 #endif 67 #ifndef OPENSSL_NO_OCSP 68 #include <openssl/ocsp.h> 69 #endif 70 #ifdef BORINGSSL_API_VERSION 71 /* BoringSSL purports to have some OCSP support */ 72 #undef OPENSSL_NO_OCSP 73 #endif 74 75 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL 76 #ifndef OPENSSL_NO_ECDH 77 #include <openssl/ecdh.h> 78 #endif 79 #endif 80 81 #if OPENSSL_VERSION_NUMBER >= 0x30000000L 82 #include <openssl/core_names.h> 83 #include <openssl/store.h> 84 #endif 85 86 #include "base.h" 87 #include "fdevent.h" 88 #include "http_date.h" 89 #include "http_header.h" 90 #include "http_kv.h" 91 #include "log.h" 92 #include "plugin.h" 93 #include "safe_memclear.h" 94 95 typedef struct { 96 /* SNI per host: with COMP_SERVER_SOCKET, COMP_HTTP_SCHEME, COMP_HTTP_HOST */ 97 EVP_PKEY *ssl_pemfile_pkey; 98 X509 *ssl_pemfile_x509; 99 STACK_OF(X509) *ssl_pemfile_chain; 100 buffer *ssl_stapling; 101 const buffer *ssl_pemfile; 102 const buffer *ssl_privkey; 103 const buffer *ssl_stapling_file; 104 time_t ssl_stapling_loadts; 105 time_t ssl_stapling_nextts; 106 char must_staple; 107 char self_issued; 108 } plugin_cert; 109 110 typedef struct { 111 SSL_CTX *ssl_ctx; 112 } plugin_ssl_ctx; 113 114 typedef struct { 115 STACK_OF(X509_NAME) *names; 116 X509_STORE *certs; 117 } plugin_cacerts; 118 119 typedef struct { 120 SSL_CTX *ssl_ctx; /* output from network_init_ssl() */ 121 122 /*(used only during startup; not patched)*/ 123 unsigned char ssl_enabled; /* only interesting for setting up listening sockets. don't use at runtime */ 124 unsigned char ssl_honor_cipher_order; /* determine SSL cipher in server-preferred order, not client-order */ 125 unsigned char ssl_empty_fragments; /* whether to not set SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS */ 126 unsigned char ssl_use_sslv2; 127 unsigned char ssl_use_sslv3; 128 const buffer *ssl_cipher_list; 129 const buffer *ssl_dh_file; 130 const buffer *ssl_ec_curve; 131 array *ssl_conf_cmd; 132 133 /*(copied from plugin_data for socket ssl_ctx config)*/ 134 const plugin_cert *pc; 135 const plugin_cacerts *ssl_ca_file; 136 STACK_OF(X509_NAME) *ssl_ca_dn_file; 137 const buffer *ssl_ca_crl_file; 138 unsigned char ssl_verifyclient; 139 unsigned char ssl_verifyclient_enforce; 140 unsigned char ssl_verifyclient_depth; 141 unsigned char ssl_read_ahead; 142 unsigned char ssl_disable_client_renegotiation; 143 } plugin_config_socket; /*(used at startup during configuration)*/ 144 145 typedef struct { 146 /* SNI per host: w/ COMP_SERVER_SOCKET, COMP_HTTP_SCHEME, COMP_HTTP_HOST */ 147 plugin_cert *pc; 148 const plugin_cacerts *ssl_ca_file; 149 STACK_OF(X509_NAME) *ssl_ca_dn_file; 150 const buffer *ssl_ca_crl_file; 151 152 unsigned char ssl_verifyclient; 153 unsigned char ssl_verifyclient_enforce; 154 unsigned char ssl_verifyclient_depth; 155 unsigned char ssl_verifyclient_export_cert; 156 unsigned char ssl_read_ahead; 157 unsigned char ssl_log_noise; 158 unsigned char ssl_disable_client_renegotiation; 159 const buffer *ssl_verifyclient_username; 160 const buffer *ssl_acme_tls_1; 161 } plugin_config; 162 163 typedef struct { 164 PLUGIN_DATA; 165 plugin_ssl_ctx *ssl_ctxs; 166 plugin_config defaults; 167 server *srv; 168 array *cafiles; 169 const char *ssl_stek_file; 170 } plugin_data; 171 172 static int ssl_is_init; 173 /* need assigned p->id for deep access of module handler_ctx for connection 174 * i.e. handler_ctx *hctx = con->plugin_ctx[plugin_data_singleton->id]; */ 175 static plugin_data *plugin_data_singleton; 176 #define LOCAL_SEND_BUFSIZE (16 * 1024) 177 static char *local_send_buffer; 178 179 typedef struct { 180 SSL *ssl; 181 request_st *r; 182 connection *con; 183 short renegotiations; /* count of SSL_CB_HANDSHAKE_START */ 184 short close_notify; 185 unsigned short alpn; 186 plugin_config conf; 187 buffer *tmp_buf; 188 log_error_st *errh; 189 } handler_ctx; 190 191 192 static handler_ctx * 193 handler_ctx_init (void) 194 { 195 handler_ctx *hctx = calloc(1, sizeof(*hctx)); 196 force_assert(hctx); 197 return hctx; 198 } 199 200 201 static void 202 handler_ctx_free (handler_ctx *hctx) 203 { 204 if (hctx->ssl) SSL_free(hctx->ssl); 205 free(hctx); 206 } 207 208 209 #ifdef TLSEXT_TYPE_session_ticket 210 /* ssl/ssl_local.h */ 211 #define TLSEXT_KEYNAME_LENGTH 16 212 #define TLSEXT_TICK_KEY_LENGTH 32 213 214 /* openssl has a huge number of interfaces, but not the most useful; 215 * construct our own session ticket encryption key structure */ 216 typedef struct tlsext_ticket_key_st { 217 time_t active_ts; /* tickets not issued w/ key until activation timestamp */ 218 time_t expire_ts; /* key not valid after expiration timestamp */ 219 unsigned char tick_key_name[TLSEXT_KEYNAME_LENGTH]; 220 unsigned char tick_hmac_key[TLSEXT_TICK_KEY_LENGTH]; 221 unsigned char tick_aes_key[TLSEXT_TICK_KEY_LENGTH]; 222 } tlsext_ticket_key_t; 223 224 static tlsext_ticket_key_t session_ticket_keys[4]; 225 static time_t stek_rotate_ts; 226 227 228 static int 229 mod_openssl_session_ticket_key_generate (time_t active_ts, time_t expire_ts) 230 { 231 /* openssl RAND_*bytes() functions are called multiple times since the 232 * funcs might have a 32-byte limit on number of bytes returned each call 233 * 234 * (Note: session ticket encryption key generation is not expected to fail) 235 * 236 * 3 keys are stored in session_ticket_keys[] 237 * The 4th element of session_ticket_keys[] is used for STEK construction 238 */ 239 /*(RAND_priv_bytes() not in openssl 1.1.0; introduced in openssl 1.1.1)*/ 240 #if OPENSSL_VERSION_NUMBER < 0x10101000L \ 241 || defined(LIBRESSL_VERSION_NUMBER) 242 #define RAND_priv_bytes(x,sz) RAND_bytes((x),(sz)) 243 #endif 244 if (RAND_bytes(session_ticket_keys[3].tick_key_name, 245 TLSEXT_KEYNAME_LENGTH) <= 0 246 || RAND_priv_bytes(session_ticket_keys[3].tick_hmac_key, 247 TLSEXT_TICK_KEY_LENGTH) <= 0 248 || RAND_priv_bytes(session_ticket_keys[3].tick_aes_key, 249 TLSEXT_TICK_KEY_LENGTH) <= 0) 250 return 0; 251 session_ticket_keys[3].active_ts = active_ts; 252 session_ticket_keys[3].expire_ts = expire_ts; 253 return 1; 254 } 255 256 257 static void 258 mod_openssl_session_ticket_key_rotate (void) 259 { 260 /* discard oldest key (session_ticket_keys[2]) and put newest key first 261 * 3 keys are stored in session_ticket_keys[0], [1], [2] 262 * session_ticket_keys[3] is used to construct and pass new STEK */ 263 264 session_ticket_keys[2] = session_ticket_keys[1]; 265 session_ticket_keys[1] = session_ticket_keys[0]; 266 /*memmove(session_ticket_keys+1, 267 session_ticket_keys+0, sizeof(tlsext_ticket_key_t)*2);*/ 268 session_ticket_keys[0] = session_ticket_keys[3]; 269 270 OPENSSL_cleanse(session_ticket_keys+3, sizeof(tlsext_ticket_key_t)); 271 } 272 273 274 static tlsext_ticket_key_t * 275 tlsext_ticket_key_get (void) 276 { 277 const time_t cur_ts = log_epoch_secs; 278 const int e = sizeof(session_ticket_keys)/sizeof(*session_ticket_keys) - 1; 279 for (int i = 0; i < e; ++i) { 280 if (session_ticket_keys[i].active_ts > cur_ts) continue; 281 if (session_ticket_keys[i].expire_ts < cur_ts) continue; 282 return &session_ticket_keys[i]; 283 } 284 return NULL; 285 } 286 287 288 static tlsext_ticket_key_t * 289 tlsext_ticket_key_find (unsigned char key_name[16], int *refresh) 290 { 291 *refresh = 0; 292 const time_t cur_ts = log_epoch_secs; 293 const int e = sizeof(session_ticket_keys)/sizeof(*session_ticket_keys) - 1; 294 for (int i = 0; i < e; ++i) { 295 if (session_ticket_keys[i].expire_ts < cur_ts) continue; 296 if (0 == memcmp(session_ticket_keys[i].tick_key_name, key_name, 16)) 297 return &session_ticket_keys[i]; 298 if (session_ticket_keys[i].active_ts <= cur_ts) 299 *refresh = 1; /* newer active key is available */ 300 } 301 return NULL; 302 } 303 304 305 static void 306 tlsext_ticket_wipe_expired (const time_t cur_ts) 307 { 308 const int e = sizeof(session_ticket_keys)/sizeof(*session_ticket_keys) - 1; 309 for (int i = 0; i < e; ++i) { 310 if (session_ticket_keys[i].expire_ts != 0 311 && session_ticket_keys[i].expire_ts < cur_ts) 312 OPENSSL_cleanse(session_ticket_keys+i, sizeof(tlsext_ticket_key_t)); 313 } 314 } 315 316 317 #if OPENSSL_VERSION_NUMBER < 0x30000000L 318 /* based on reference implementation from openssl 1.1.1g man page 319 * man SSL_CTX_set_tlsext_ticket_key_cb 320 * but mod_openssl code uses EVP_aes_256_cbc() instead of EVP_aes_128_cbc() 321 */ 322 static int 323 ssl_tlsext_ticket_key_cb (SSL *s, unsigned char key_name[16], 324 unsigned char iv[EVP_MAX_IV_LENGTH], 325 EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc) 326 #else /* OPENSSL_VERSION_NUMBER >= 0x30000000L */ 327 /* based on reference implementation from openssl 3.0.0 man page 328 * man SSL_CTX_set_tlsext_ticket_key_cb 329 */ 330 static int 331 ssl_tlsext_ticket_key_cb(SSL *s, unsigned char key_name[16], 332 unsigned char *iv, EVP_CIPHER_CTX *ctx, 333 EVP_MAC_CTX *hctx, int enc) 334 #endif 335 { 336 UNUSED(s); 337 if (enc) { /* create new session */ 338 tlsext_ticket_key_t *k = tlsext_ticket_key_get(); 339 if (NULL == k) 340 return 0; /* current key does not exist or is not valid */ 341 memcpy(key_name, k->tick_key_name, 16); 342 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0) 343 return -1; /* insufficient random */ 344 EVP_EncryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, k->tick_aes_key, iv); 345 #if OPENSSL_VERSION_NUMBER < 0x30000000L 346 HMAC_Init_ex(hctx, k->tick_hmac_key, sizeof(k->tick_hmac_key), 347 EVP_sha256(), NULL); 348 #else 349 OSSL_PARAM params[] = { 350 OSSL_PARAM_DEFN(OSSL_MAC_PARAM_KEY, OSSL_PARAM_OCTET_STRING, 351 k->tick_hmac_key, sizeof(k->tick_hmac_key)), 352 OSSL_PARAM_DEFN(OSSL_MAC_PARAM_DIGEST, OSSL_PARAM_UTF8_STRING, 353 "sha256", sizeof("sha256")), 354 OSSL_PARAM_END 355 }; 356 EVP_MAC_CTX_set_params(hctx, params); 357 #endif 358 return 1; 359 } 360 else { /* retrieve session */ 361 int refresh; 362 tlsext_ticket_key_t *k = tlsext_ticket_key_find(key_name, &refresh); 363 if (NULL == k) 364 return 0; 365 #if OPENSSL_VERSION_NUMBER < 0x30000000L 366 HMAC_Init_ex(hctx, k->tick_hmac_key, sizeof(k->tick_hmac_key), 367 EVP_sha256(), NULL); 368 #else 369 OSSL_PARAM params[] = { 370 OSSL_PARAM_DEFN(OSSL_KDF_PARAM_KEY, OSSL_PARAM_OCTET_STRING, 371 k->tick_hmac_key, sizeof(k->tick_hmac_key)), 372 OSSL_PARAM_DEFN(OSSL_MAC_PARAM_DIGEST, OSSL_PARAM_UTF8_STRING, 373 "sha256", sizeof("sha256")), 374 OSSL_PARAM_END 375 }; 376 EVP_MAC_CTX_set_params(hctx, params); 377 #endif 378 EVP_DecryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, k->tick_aes_key, iv); 379 return refresh ? 2 : 1; 380 /* 'refresh' will trigger issuing new ticket for session 381 * even though the current ticket is still valid */ 382 } 383 } 384 385 386 static int 387 mod_openssl_session_ticket_key_file (const char *fn) 388 { 389 /* session ticket encryption key (STEK) 390 * 391 * STEK file should be stored in non-persistent storage, 392 * e.g. /dev/shm/lighttpd/stek-file (in memory) 393 * with appropriate permissions set to keep stek-file from being 394 * read by other users. Where possible, systems should also be 395 * configured without swap. 396 * 397 * admin should schedule an independent job to periodically 398 * generate new STEK up to 3 times during key lifetime 399 * (lighttpd stores up to 3 keys) 400 * 401 * format of binary file is: 402 * 4-byte - format version (always 0; for use if format changes) 403 * 4-byte - activation timestamp 404 * 4-byte - expiration timestamp 405 * 16-byte - session ticket key name 406 * 32-byte - session ticket HMAC encrpytion key 407 * 32-byte - session ticket AES encrpytion key 408 * 409 * STEK file can be created with a command such as: 410 * dd if=/dev/random bs=1 count=80 status=none | \ 411 * perl -e 'print pack("iii",0,time()+300,time()+86400),<>' \ 412 * > STEK-file.$$ && mv STEK-file.$$ STEK-file 413 * 414 * The above delays activation time by 5 mins (+300 sec) to allow file to 415 * be propagated to other machines. (admin must handle this independently) 416 * If STEK generation is performed immediately prior to starting lighttpd, 417 * admin should activate keys immediately (without +300). 418 */ 419 int buf[23]; /* 92 bytes */ 420 int rc = 0; /*(will retry on next check interval upon any error)*/ 421 if (0 != fdevent_load_file_bytes((char *)buf,(off_t)sizeof(buf),0,fn,NULL)) 422 return rc; 423 if (buf[0] == 0) { /*(format version 0)*/ 424 session_ticket_keys[3].active_ts = buf[1]; 425 session_ticket_keys[3].expire_ts = buf[2]; 426 #ifndef __COVERITY__ /* intentional; hide from Coverity Scan */ 427 /* intentionally copy 80 bytes into consecutive arrays 428 * tick_key_name[], tick_hmac_key[], tick_aes_key[] */ 429 memcpy(&session_ticket_keys[3].tick_key_name, buf+3, 80); 430 #endif 431 rc = 1; 432 } 433 434 OPENSSL_cleanse(buf, sizeof(buf)); 435 return rc; 436 } 437 438 439 static void 440 mod_openssl_session_ticket_key_check (const plugin_data *p, const time_t cur_ts) 441 { 442 int rotate = 0; 443 if (p->ssl_stek_file) { 444 struct stat st; 445 if (0 == stat(p->ssl_stek_file, &st) && st.st_mtime > stek_rotate_ts) 446 rotate = mod_openssl_session_ticket_key_file(p->ssl_stek_file); 447 tlsext_ticket_wipe_expired(cur_ts); 448 } 449 else if (cur_ts - 28800 >= stek_rotate_ts || 0 == stek_rotate_ts)/*(8 hrs)*/ 450 rotate = mod_openssl_session_ticket_key_generate(cur_ts, cur_ts+86400); 451 452 if (rotate) { 453 mod_openssl_session_ticket_key_rotate(); 454 stek_rotate_ts = cur_ts; 455 } 456 } 457 458 #endif /* TLSEXT_TYPE_session_ticket */ 459 460 461 #ifndef OPENSSL_NO_OCSP 462 #ifndef BORINGSSL_API_VERSION /* BoringSSL suggests using different API */ 463 static int 464 ssl_tlsext_status_cb(SSL *ssl, void *arg) 465 { 466 #ifdef SSL_get_tlsext_status_type 467 if (TLSEXT_STATUSTYPE_ocsp != SSL_get_tlsext_status_type(ssl)) 468 return SSL_TLSEXT_ERR_NOACK; /* ignore if not client OCSP request */ 469 #endif 470 471 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); 472 if (NULL == hctx->conf.pc) return SSL_TLSEXT_ERR_NOACK;/*should not happen*/ 473 buffer *ssl_stapling = hctx->conf.pc->ssl_stapling; 474 if (NULL == ssl_stapling) return SSL_TLSEXT_ERR_NOACK; 475 UNUSED(arg); 476 477 int len = (int)buffer_string_length(ssl_stapling); 478 479 /* OpenSSL and LibreSSL require copy (BoringSSL, too, if using compat API)*/ 480 uint8_t *ocsp_resp = OPENSSL_malloc(len); 481 if (NULL == ocsp_resp) 482 return SSL_TLSEXT_ERR_NOACK; /* ignore OCSP request if error occurs */ 483 memcpy(ocsp_resp, ssl_stapling->ptr, len); 484 485 if (!SSL_set_tlsext_status_ocsp_resp(ssl, ocsp_resp, len)) { 486 log_error(hctx->r->conf.errh, __FILE__, __LINE__, 487 "SSL: failed to set OCSP response for TLS server name %s: %s", 488 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); 489 OPENSSL_free(ocsp_resp); 490 return SSL_TLSEXT_ERR_NOACK; /* ignore OCSP request if error occurs */ 491 /*return SSL_TLSEXT_ERR_ALERT_FATAL;*/ 492 } 493 return SSL_TLSEXT_ERR_OK; 494 } 495 #endif 496 #endif 497 498 499 INIT_FUNC(mod_openssl_init) 500 { 501 plugin_data_singleton = (plugin_data *)calloc(1, sizeof(plugin_data)); 502 return plugin_data_singleton; 503 } 504 505 506 static int mod_openssl_init_once_openssl (server *srv) 507 { 508 if (ssl_is_init) return 1; 509 510 #if OPENSSL_VERSION_NUMBER >= 0x10100000L \ 511 && (!defined(LIBRESSL_VERSION_NUMBER) \ 512 || LIBRESSL_VERSION_NUMBER >= 0x2070000fL) 513 OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS 514 |OPENSSL_INIT_LOAD_CRYPTO_STRINGS,NULL); 515 OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS 516 |OPENSSL_INIT_ADD_ALL_DIGESTS 517 |OPENSSL_INIT_LOAD_CONFIG, NULL); 518 #else 519 SSL_load_error_strings(); 520 SSL_library_init(); 521 OpenSSL_add_all_algorithms(); 522 #endif 523 ssl_is_init = 1; 524 525 if (0 == RAND_status()) { 526 log_error(srv->errh, __FILE__, __LINE__, 527 "SSL: not enough entropy in the pool"); 528 return 0; 529 } 530 531 local_send_buffer = malloc(LOCAL_SEND_BUFSIZE); 532 force_assert(NULL != local_send_buffer); 533 534 return 1; 535 } 536 537 538 static void mod_openssl_free_openssl (void) 539 { 540 if (!ssl_is_init) return; 541 542 #ifdef TLSEXT_TYPE_session_ticket 543 OPENSSL_cleanse(session_ticket_keys, sizeof(session_ticket_keys)); 544 stek_rotate_ts = 0; 545 #endif 546 547 #if OPENSSL_VERSION_NUMBER >= 0x10100000L \ 548 && !defined(LIBRESSL_VERSION_NUMBER) 549 /*(OpenSSL libraries handle thread init and deinit) 550 * https://github.com/openssl/openssl/pull/1048 */ 551 #else 552 CRYPTO_cleanup_all_ex_data(); 553 ERR_free_strings(); 554 #if OPENSSL_VERSION_NUMBER >= 0x10000000L 555 ERR_remove_thread_state(NULL); 556 #else 557 ERR_remove_state(0); 558 #endif 559 EVP_cleanup(); 560 #endif 561 562 free(local_send_buffer); 563 ssl_is_init = 0; 564 } 565 566 567 static void 568 mod_openssl_free_config (server *srv, plugin_data * const p) 569 { 570 array_free(p->cafiles); 571 572 if (NULL != p->ssl_ctxs) { 573 SSL_CTX * const ssl_ctx_global_scope = p->ssl_ctxs->ssl_ctx; 574 /* free ssl_ctx from $SERVER["socket"] (if not copy of global scope) */ 575 for (uint32_t i = 1; i < srv->config_context->used; ++i) { 576 plugin_ssl_ctx * const s = p->ssl_ctxs + i; 577 if (s->ssl_ctx && s->ssl_ctx != ssl_ctx_global_scope) 578 SSL_CTX_free(s->ssl_ctx); 579 } 580 /* free ssl_ctx from global scope */ 581 if (ssl_ctx_global_scope) 582 SSL_CTX_free(ssl_ctx_global_scope); 583 free(p->ssl_ctxs); 584 } 585 586 if (NULL == p->cvlist) return; 587 /* (init i to 0 if global context; to 1 to skip empty global context) */ 588 for (int i = !p->cvlist[0].v.u2[1], used = p->nconfig; i < used; ++i) { 589 config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0]; 590 for (; -1 != cpv->k_id; ++cpv) { 591 switch (cpv->k_id) { 592 case 0: /* ssl.pemfile */ 593 if (cpv->vtype == T_CONFIG_LOCAL) { 594 plugin_cert *pc = cpv->v.v; 595 EVP_PKEY_free(pc->ssl_pemfile_pkey); 596 X509_free(pc->ssl_pemfile_x509); 597 sk_X509_pop_free(pc->ssl_pemfile_chain, X509_free); 598 buffer_free(pc->ssl_stapling); 599 free(pc); 600 } 601 break; 602 case 2: /* ssl.ca-file */ 603 if (cpv->vtype == T_CONFIG_LOCAL) { 604 plugin_cacerts *cacerts = cpv->v.v; 605 sk_X509_NAME_pop_free(cacerts->names, X509_NAME_free); 606 X509_STORE_free(cacerts->certs); 607 free(cacerts); 608 } 609 break; 610 case 3: /* ssl.ca-dn-file */ 611 if (cpv->vtype == T_CONFIG_LOCAL) 612 sk_X509_NAME_pop_free(cpv->v.v, X509_NAME_free); 613 break; 614 default: 615 break; 616 } 617 } 618 } 619 } 620 621 622 /* use memory from openssl secure heap for temporary buffers, returned storage 623 * (pemfile might contain a private key in addition to certificate chain) 624 * Interfaces similar to those constructed in include/openssl/pem.h for 625 * PEM_read_bio_X509(), except this is named PEM_read_bio_X509_secmem(). 626 * Similar for PEM_read_bio_X509_AUX_secmem(). 627 * 628 * Supporting routine PEM_ASN1_read_bio_secmem() modified from openssl 629 * crypto/pem/pem_oth.c:PEM_ASN1_read_bio(): 630 * uses PEM_bytes_read_bio_secmem() instead of PEM_bytes_read_bio() 631 * uses OPENSSL_secure_clear_free() instead of OPENSSL_free() 632 * 633 * 'man PEM_bytes_read_bio_secmem()' and see NOTES section for more info 634 * PEM_bytes_read_bio_secmem() openssl 1.1.1 or later 635 * OPENSSL_secure_clear_free() openssl 1.1.0g or later 636 * As this comment is being written, only openssl 1.1.1 is actively maintained. 637 * Earlier vers of openssl no longer receive security patches from openssl.org. 638 */ 639 static void * 640 PEM_ASN1_read_bio_secmem(d2i_of_void *d2i, const char *name, BIO *bp, void **x, 641 pem_password_cb *cb, void *u) 642 { 643 const unsigned char *p = NULL; 644 unsigned char *data = NULL; 645 long len = 0; 646 char *ret = NULL; 647 648 #if OPENSSL_VERSION_NUMBER >= 0x10101000L \ 649 && !defined(LIBRESSL_VERSION_NUMBER) 650 if (!PEM_bytes_read_bio_secmem(&data, &len, NULL, name, bp, cb, u)) 651 #else 652 if (!PEM_bytes_read_bio(&data, &len, NULL, name, bp, cb, u)) 653 #endif 654 return NULL; 655 p = data; 656 ret = d2i(x, &p, len); 657 #ifndef BORINGSSL_API_VERSION /* missing PEMerr() macro */ 658 if (ret == NULL) 659 PEMerr(PEM_F_PEM_ASN1_READ_BIO, ERR_R_ASN1_LIB); 660 #endif 661 #if OPENSSL_VERSION_NUMBER >= 0x10101000L \ 662 && !defined(LIBRESSL_VERSION_NUMBER) 663 OPENSSL_secure_clear_free(data, len); 664 #else 665 OPENSSL_cleanse(data, len); 666 OPENSSL_free(data); 667 #endif 668 return ret; 669 } 670 671 672 static X509 * 673 PEM_read_bio_X509_secmem(BIO *bp, X509 **x, pem_password_cb *cb, void *u) 674 { 675 return PEM_ASN1_read_bio_secmem((d2i_of_void *)d2i_X509, 676 PEM_STRING_X509, 677 bp, (void **)x, cb, u); 678 } 679 680 681 static X509 * 682 PEM_read_bio_X509_AUX_secmem(BIO *bp, X509 **x, pem_password_cb *cb, void *u) 683 { 684 return PEM_ASN1_read_bio_secmem((d2i_of_void *)d2i_X509_AUX, 685 PEM_STRING_X509_TRUSTED, 686 bp, (void **)x, cb, u); 687 } 688 689 690 static int 691 mod_openssl_load_X509_sk (const char *file, log_error_st *errh, STACK_OF(X509) **chain, BIO *in) 692 { 693 STACK_OF(X509) *chain_sk = NULL; 694 for (X509 *ca; (ca = PEM_read_bio_X509_secmem(in,NULL,NULL,NULL)); ) { 695 if (NULL == chain_sk) /*(allocate only if it will not be empty)*/ 696 chain_sk = sk_X509_new_null(); 697 if (!chain_sk || !sk_X509_push(chain_sk, ca)) { 698 log_error(errh, __FILE__, __LINE__, 699 "SSL: couldn't read X509 certificates from '%s'", file); 700 if (chain_sk) sk_X509_pop_free(chain_sk, X509_free); 701 X509_free(ca); 702 return 0; 703 } 704 } 705 *chain = chain_sk; 706 return 1; 707 } 708 709 710 static int 711 mod_openssl_load_X509_STORE (const char *file, log_error_st *errh, X509_STORE **chain, BIO *in) 712 { 713 X509_STORE *chain_store = NULL; 714 for (X509 *ca; (ca = PEM_read_bio_X509(in,NULL,NULL,NULL)); X509_free(ca)) { 715 if (NULL == chain_store) /*(allocate only if it will not be empty)*/ 716 chain_store = X509_STORE_new(); 717 if (!chain_store || !X509_STORE_add_cert(chain_store, ca)) { 718 log_error(errh, __FILE__, __LINE__, 719 "SSL: couldn't read X509 certificates from '%s'", file); 720 if (chain_store) X509_STORE_free(chain_store); 721 X509_free(ca); 722 return 0; 723 } 724 } 725 *chain = chain_store; 726 return 1; 727 } 728 729 730 static plugin_cacerts * 731 mod_openssl_load_cacerts (const buffer *ssl_ca_file, log_error_st *errh) 732 { 733 const char *file = ssl_ca_file->ptr; 734 BIO *in = BIO_new(BIO_s_file()); 735 if (NULL == in) { 736 log_error(errh, __FILE__, __LINE__, 737 "SSL: BIO_new(BIO_s_file()) failed"); 738 return NULL; 739 } 740 741 if (BIO_read_filename(in, file) <= 0) { 742 log_error(errh, __FILE__, __LINE__, 743 "SSL: BIO_read_filename('%s') failed", file); 744 BIO_free(in); 745 return NULL; 746 } 747 748 X509_STORE *chain_store = NULL; 749 if (!mod_openssl_load_X509_STORE(file, errh, &chain_store, in)) { 750 BIO_free(in); 751 return NULL; 752 } 753 754 BIO_free(in); 755 756 if (NULL == chain_store) { 757 log_error(errh, __FILE__, __LINE__, 758 "SSL: ssl.verifyclient.ca-file is empty %s", file); 759 return NULL; 760 } 761 762 plugin_cacerts *cacerts = malloc(sizeof(plugin_cacerts)); 763 force_assert(cacerts); 764 765 /* (would be more efficient to walk the X509_STORE and build the list, 766 * but this works for now and matches how ssl.ca-dn-file is handled) */ 767 cacerts->names = SSL_load_client_CA_file(file); 768 if (NULL == cacerts->names) { 769 X509_STORE_free(chain_store); 770 free(cacerts); 771 return NULL; 772 } 773 774 cacerts->certs = chain_store; 775 return cacerts; 776 } 777 778 779 static int 780 mod_openssl_load_cacrls (X509_STORE *store, const buffer *ssl_ca_crl_file, server *srv) 781 { 782 #if OPENSSL_VERSION_NUMBER >= 0x30000000L 783 if (1 != X509_STORE_load_file(store, ssl_ca_crl_file->ptr)) 784 #else 785 if (1 != X509_STORE_load_locations(store, ssl_ca_crl_file->ptr, NULL)) 786 #endif 787 { 788 log_error(srv->errh, __FILE__, __LINE__, 789 "SSL: %s %s", ERR_error_string(ERR_get_error(), NULL), 790 ssl_ca_crl_file->ptr); 791 return 0; 792 } 793 X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL); 794 return 1; 795 } 796 797 798 #if OPENSSL_VERSION_NUMBER < 0x10002000 \ 799 || defined(LIBRESSL_VERSION_NUMBER) 800 static int 801 mod_openssl_load_verify_locn (SSL_CTX *ssl_ctx, const buffer *b, server *srv) 802 { 803 const char *fn = b->ptr; 804 if (1 == SSL_CTX_load_verify_locations(ssl_ctx, fn, NULL)) 805 return 1; 806 807 log_error(srv->errh, __FILE__, __LINE__, 808 "SSL: %s %s", ERR_error_string(ERR_get_error(), NULL), fn); 809 return 0; 810 } 811 812 813 static int 814 mod_openssl_load_ca_files (SSL_CTX *ssl_ctx, plugin_data *p, server *srv) 815 { 816 /* load all ssl.ca-files specified in the config into each SSL_CTX */ 817 818 for (uint32_t i = 0, used = p->cafiles->used; i < used; ++i) { 819 const buffer *b = &((data_string *)p->cafiles->data[i])->value; 820 if (!mod_openssl_load_verify_locn(ssl_ctx, b, srv)) 821 return 0; 822 } 823 return 1; 824 } 825 #endif 826 827 828 FREE_FUNC(mod_openssl_free) 829 { 830 plugin_data *p = p_d; 831 if (NULL == p->srv) return; 832 mod_openssl_free_config(p->srv, p); 833 mod_openssl_free_openssl(); 834 } 835 836 837 static void 838 mod_openssl_merge_config_cpv (plugin_config * const pconf, const config_plugin_value_t * const cpv) 839 { 840 switch (cpv->k_id) { /* index into static config_plugin_keys_t cpk[] */ 841 case 0: /* ssl.pemfile */ 842 if (cpv->vtype == T_CONFIG_LOCAL) 843 pconf->pc = cpv->v.v; 844 break; 845 case 1: /* ssl.privkey */ 846 break; 847 case 2: /* ssl.ca-file */ 848 if (cpv->vtype == T_CONFIG_LOCAL) 849 pconf->ssl_ca_file = cpv->v.v; 850 break; 851 case 3: /* ssl.ca-dn-file */ 852 if (cpv->vtype == T_CONFIG_LOCAL) 853 pconf->ssl_ca_dn_file = cpv->v.v; 854 break; 855 case 4: /* ssl.ca-crl-file */ 856 pconf->ssl_ca_crl_file = cpv->v.b; 857 break; 858 case 5: /* ssl.read-ahead */ 859 pconf->ssl_read_ahead = (0 != cpv->v.u); 860 break; 861 case 6: /* ssl.disable-client-renegotiation */ 862 pconf->ssl_disable_client_renegotiation = (0 != cpv->v.u); 863 break; 864 case 7: /* ssl.verifyclient.activate */ 865 pconf->ssl_verifyclient = (0 != cpv->v.u); 866 break; 867 case 8: /* ssl.verifyclient.enforce */ 868 pconf->ssl_verifyclient_enforce = (0 != cpv->v.u); 869 break; 870 case 9: /* ssl.verifyclient.depth */ 871 pconf->ssl_verifyclient_depth = (unsigned char)cpv->v.shrt; 872 break; 873 case 10:/* ssl.verifyclient.username */ 874 pconf->ssl_verifyclient_username = cpv->v.b; 875 break; 876 case 11:/* ssl.verifyclient.exportcert */ 877 pconf->ssl_verifyclient_export_cert = (0 != cpv->v.u); 878 break; 879 case 12:/* ssl.acme-tls-1 */ 880 pconf->ssl_acme_tls_1 = cpv->v.b; 881 break; 882 case 13:/* ssl.stapling-file */ 883 break; 884 case 14:/* debug.log-ssl-noise */ 885 pconf->ssl_log_noise = (0 != cpv->v.u); 886 break; 887 #if 0 /*(cpk->k_id remapped in mod_openssl_set_defaults())*/ 888 case 15:/* ssl.verifyclient.ca-file */ 889 case 16:/* ssl.verifyclient.ca-dn-file */ 890 case 17:/* ssl.verifyclient.ca-crl-file */ 891 break; 892 #endif 893 default:/* should not happen */ 894 return; 895 } 896 } 897 898 899 static void 900 mod_openssl_merge_config(plugin_config * const pconf, const config_plugin_value_t *cpv) 901 { 902 do { 903 mod_openssl_merge_config_cpv(pconf, cpv); 904 } while ((++cpv)->k_id != -1); 905 } 906 907 908 static void 909 mod_openssl_patch_config (request_st * const r, plugin_config * const pconf) 910 { 911 plugin_data * const p = plugin_data_singleton; 912 memcpy(pconf, &p->defaults, sizeof(plugin_config)); 913 for (int i = 1, used = p->nconfig; i < used; ++i) { 914 if (config_check_cond(r, (uint32_t)p->cvlist[i].k_id)) 915 mod_openssl_merge_config(pconf, p->cvlist + p->cvlist[i].v.u2[0]); 916 } 917 } 918 919 920 static int 921 safer_X509_NAME_oneline(X509_NAME *name, char *buf, size_t sz) 922 { 923 BIO *bio = BIO_new(BIO_s_mem()); 924 if (bio) { 925 int len = X509_NAME_print_ex(bio, name, 0, XN_FLAG_ONELINE); 926 BIO_gets(bio, buf, (int)sz); /*(may be truncated if len >= sz)*/ 927 BIO_free(bio); 928 return len; /*return value has similar semantics to that of snprintf()*/ 929 } 930 else { 931 buf[0] = '\0'; 932 return -1; 933 } 934 } 935 936 937 static void 938 ssl_info_callback (const SSL *ssl, int where, int ret) 939 { 940 UNUSED(ret); 941 942 if (0 != (where & SSL_CB_HANDSHAKE_START)) { 943 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); 944 if (hctx->renegotiations >= 0) ++hctx->renegotiations; 945 } 946 #ifdef TLS1_3_VERSION 947 /* https://github.com/openssl/openssl/issues/5721 948 * "TLSv1.3 unexpected InfoCallback after handshake completed" */ 949 if (0 != (where & SSL_CB_HANDSHAKE_DONE)) { 950 /* SSL_version() is valid after initial handshake completed */ 951 if (SSL_version(ssl) >= TLS1_3_VERSION) { 952 /* https://wiki.openssl.org/index.php/TLS1.3 953 * "Renegotiation is not possible in a TLSv1.3 connection" */ 954 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); 955 hctx->renegotiations = -1; 956 } 957 } 958 #endif 959 } 960 961 /* https://wiki.openssl.org/index.php/Manual:SSL_CTX_set_verify(3)#EXAMPLES */ 962 static int 963 verify_callback(int preverify_ok, X509_STORE_CTX *ctx) 964 { 965 char buf[256]; 966 X509 *err_cert; 967 int err, depth; 968 SSL *ssl; 969 handler_ctx *hctx; 970 971 err = X509_STORE_CTX_get_error(ctx); 972 depth = X509_STORE_CTX_get_error_depth(ctx); 973 974 /* 975 * Retrieve the pointer to the SSL of the connection currently treated 976 * and the application specific data stored into the SSL object. 977 */ 978 ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); 979 hctx = (handler_ctx *) SSL_get_app_data(ssl); 980 981 /* 982 * Catch a too long certificate chain. The depth limit set using 983 * SSL_CTX_set_verify_depth() is by purpose set to "limit+1" so 984 * that whenever the "depth>verify_depth" condition is met, we 985 * have violated the limit and want to log this error condition. 986 * We must do it here, because the CHAIN_TOO_LONG error would not 987 * be found explicitly; only errors introduced by cutting off the 988 * additional certificates would be logged. 989 */ 990 if (depth > hctx->conf.ssl_verifyclient_depth) { 991 preverify_ok = 0; 992 err = X509_V_ERR_CERT_CHAIN_TOO_LONG; 993 X509_STORE_CTX_set_error(ctx, err); 994 } 995 996 if (preverify_ok && 0 == depth && NULL != hctx->conf.ssl_ca_dn_file) { 997 /* verify that client cert is issued by CA in ssl.ca-dn-file 998 * if both ssl.ca-dn-file and ssl.ca-file were configured */ 999 STACK_OF(X509_NAME) * const cert_names = hctx->conf.ssl_ca_dn_file; 1000 X509_NAME *issuer; 1001 #if OPENSSL_VERSION_NUMBER >= 0x10002000L 1002 err_cert = X509_STORE_CTX_get_current_cert(ctx); 1003 #else 1004 err_cert = ctx->current_cert; 1005 #endif 1006 if (NULL == err_cert) return !hctx->conf.ssl_verifyclient_enforce; 1007 issuer = X509_get_issuer_name(err_cert); 1008 #if 0 /*(?desirable/undesirable to have cert_names sorted?)*/ 1009 if (-1 != sk_X509_NAME_find(cert_names, issuer)) 1010 return preverify_ok; /* match */ 1011 #else 1012 for (int i = 0, len = sk_X509_NAME_num(cert_names); i < len; ++i) { 1013 if (0 == X509_NAME_cmp(sk_X509_NAME_value(cert_names, i), issuer)) 1014 return preverify_ok; /* match */ 1015 } 1016 #endif 1017 1018 preverify_ok = 0; 1019 err = X509_V_ERR_CERT_REJECTED; 1020 X509_STORE_CTX_set_error(ctx, err); 1021 } 1022 1023 if (preverify_ok) { 1024 return preverify_ok; 1025 } 1026 1027 #if OPENSSL_VERSION_NUMBER >= 0x10002000L 1028 err_cert = X509_STORE_CTX_get_current_cert(ctx); 1029 #else 1030 err_cert = ctx->current_cert; 1031 #endif 1032 if (NULL == err_cert) return !hctx->conf.ssl_verifyclient_enforce; 1033 safer_X509_NAME_oneline(X509_get_subject_name(err_cert),buf,sizeof(buf)); 1034 log_error_st *errh = hctx->r->conf.errh; 1035 log_error(errh, __FILE__, __LINE__, 1036 "SSL: verify error:num=%d:%s:depth=%d:subject=%s", 1037 err, X509_verify_cert_error_string(err), depth, buf); 1038 1039 /* 1040 * At this point, err contains the last verification error. We can use 1041 * it for something special 1042 */ 1043 if (!preverify_ok && (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY || 1044 err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)) { 1045 safer_X509_NAME_oneline(X509_get_issuer_name(err_cert),buf,sizeof(buf)); 1046 log_error(errh, __FILE__, __LINE__, "SSL: issuer=%s", buf); 1047 } 1048 1049 return !hctx->conf.ssl_verifyclient_enforce; 1050 } 1051 1052 enum { 1053 MOD_OPENSSL_ALPN_HTTP11 = 1 1054 ,MOD_OPENSSL_ALPN_HTTP10 = 2 1055 ,MOD_OPENSSL_ALPN_H2 = 3 1056 ,MOD_OPENSSL_ALPN_ACME_TLS_1 = 4 1057 }; 1058 1059 static int 1060 mod_openssl_cert_cb (SSL *ssl, void *arg) 1061 { 1062 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); 1063 plugin_cert *pc = hctx->conf.pc; 1064 UNUSED(arg); 1065 if (hctx->alpn == MOD_OPENSSL_ALPN_ACME_TLS_1) return 1; 1066 1067 if (!pc || NULL == pc->ssl_pemfile_x509 || NULL == pc->ssl_pemfile_pkey) { 1068 /* x509/pkey available <=> pemfile was set <=> pemfile got patched: 1069 * so this should never happen, unless you nest $SERVER["socket"] */ 1070 log_error(hctx->r->conf.errh, __FILE__, __LINE__, 1071 "SSL: no certificate/private key for TLS server name %s. " 1072 "$SERVER[\"socket\"] should not be nested in other conditions.", 1073 hctx->r->uri.authority.ptr); 1074 return 0; 1075 } 1076 1077 /* first set certificate! 1078 * setting private key checks whether certificate matches it */ 1079 if (1 != SSL_use_certificate(ssl, pc->ssl_pemfile_x509)) { 1080 log_error(hctx->r->conf.errh, __FILE__, __LINE__, 1081 "SSL: failed to set certificate for TLS server name %s: %s", 1082 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); 1083 return 0; 1084 } 1085 1086 #if OPENSSL_VERSION_NUMBER >= 0x10002000 \ 1087 && (!defined(LIBRESSL_VERSION_NUMBER) \ 1088 || LIBRESSL_VERSION_NUMBER >= 0x3000000fL) 1089 if (pc->ssl_pemfile_chain) 1090 SSL_set1_chain(ssl, pc->ssl_pemfile_chain); 1091 #if !defined(BORINGSSL_API_VERSION) \ 1092 && !defined(LIBRESSL_VERSION_NUMBER) 1093 /* (missing SSL_set1_chain_cert_store() and SSL_build_cert_chain()) */ 1094 else if (hctx->conf.ssl_ca_file && !pc->self_issued) { 1095 /* preserve legacy behavior whereby openssl will reuse CAs trusted for 1096 * certificate verification (set by SSL_CTX_load_verify_locations() in 1097 * SSL_CTX) in order to build certificate chain for server certificate 1098 * sent to client */ 1099 SSL_set1_chain_cert_store(ssl, hctx->conf.ssl_ca_file->certs); 1100 1101 if (1 != SSL_build_cert_chain(ssl, 1102 SSL_BUILD_CHAIN_FLAG_NO_ROOT 1103 | SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR 1104 | SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR)) { 1105 log_error(hctx->r->conf.errh, __FILE__, __LINE__, 1106 "SSL: building cert chain for TLS server name %s: %s", 1107 hctx->r->uri.authority.ptr, 1108 ERR_error_string(ERR_get_error(), NULL)); 1109 return 0; 1110 } 1111 else { /* copy chain for future reuse */ 1112 STACK_OF(X509) *chain = NULL; 1113 SSL_get0_chain_certs(ssl, &chain); 1114 pc->ssl_pemfile_chain = X509_chain_up_ref(chain); 1115 SSL_set1_chain_cert_store(ssl, NULL); 1116 } 1117 } 1118 #endif 1119 #endif 1120 1121 if (1 != SSL_use_PrivateKey(ssl, pc->ssl_pemfile_pkey)) { 1122 log_error(hctx->r->conf.errh, __FILE__, __LINE__, 1123 "SSL: failed to set private key for TLS server name %s: %s", 1124 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); 1125 return 0; 1126 } 1127 1128 #ifndef OPENSSL_NO_OCSP 1129 #ifdef BORINGSSL_API_VERSION 1130 /* BoringSSL suggests API different than SSL_CTX_set_tlsext_status_cb() */ 1131 buffer *ocsp_resp = pc->ssl_stapling; 1132 if (NULL != ocsp_resp 1133 && !SSL_set_ocsp_response(ssl, (uint8_t *)CONST_BUF_LEN(ocsp_resp))) { 1134 log_error(hctx->r->conf.errh, __FILE__, __LINE__, 1135 "SSL: failed to set OCSP response for TLS server name %s: %s", 1136 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); 1137 return 0; 1138 } 1139 #endif 1140 #endif 1141 1142 if (hctx->conf.ssl_verifyclient) { 1143 if (NULL == hctx->conf.ssl_ca_file) { 1144 log_error(hctx->r->conf.errh, __FILE__, __LINE__, 1145 "SSL: can't verify client without ssl.verifyclient.ca-file " 1146 "for TLS server name %s", hctx->r->uri.authority.ptr); 1147 return 0; 1148 } 1149 #if OPENSSL_VERSION_NUMBER >= 0x10002000 \ 1150 && !defined(LIBRESSL_VERSION_NUMBER) 1151 SSL_set1_verify_cert_store(ssl, hctx->conf.ssl_ca_file->certs); 1152 #endif 1153 /* WTH openssl? SSL_set_client_CA_list() calls set0_CA_list(), 1154 * but there is no set1_CA_list() to simply up the reference count 1155 * (without needing to duplicate the list) */ 1156 /* WolfSSL does not support setting per-session CA list; 1157 * limitation is to per-CTX CA list, and is not changed after SNI */ 1158 STACK_OF(X509_NAME) * const cert_names = hctx->conf.ssl_ca_dn_file 1159 ? hctx->conf.ssl_ca_dn_file 1160 : hctx->conf.ssl_ca_file->names; 1161 SSL_set_client_CA_list(ssl, SSL_dup_CA_list(cert_names)); 1162 int mode = SSL_VERIFY_PEER; 1163 if (hctx->conf.ssl_verifyclient_enforce) 1164 mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; 1165 SSL_set_verify(ssl, mode, verify_callback); 1166 SSL_set_verify_depth(ssl, hctx->conf.ssl_verifyclient_depth + 1); 1167 } 1168 else { 1169 SSL_set_verify(ssl, SSL_VERIFY_NONE, NULL); 1170 } 1171 1172 return 1; 1173 } 1174 1175 #ifndef OPENSSL_NO_TLSEXT 1176 static int 1177 mod_openssl_SNI (handler_ctx *hctx, const char *servername, size_t len) 1178 { 1179 request_st * const r = hctx->r; 1180 if (len >= 1024) { /*(expecting < 256; TLSEXT_MAXLEN_host_name is 255)*/ 1181 log_error(r->conf.errh, __FILE__, __LINE__, 1182 "SSL: SNI name too long %.*s", (int)len, servername); 1183 return SSL_TLSEXT_ERR_ALERT_FATAL; 1184 } 1185 1186 /* use SNI to patch mod_openssl config and then reset COMP_HTTP_HOST */ 1187 buffer_copy_string_len(&r->uri.authority, servername, len); 1188 buffer_to_lower(&r->uri.authority); 1189 #if 0 1190 /*(r->uri.authority used below for configuration before request read; 1191 * revisit for h2)*/ 1192 if (0 != http_request_host_policy(&r->uri.authority, 1193 r->conf.http_parseopts, 443)) 1194 return SSL_TLSEXT_ERR_ALERT_FATAL; 1195 #endif 1196 1197 r->conditional_is_valid |= (1 << COMP_HTTP_SCHEME) 1198 | (1 << COMP_HTTP_HOST); 1199 mod_openssl_patch_config(r, &hctx->conf); 1200 /* reset COMP_HTTP_HOST so that conditions re-run after request hdrs read */ 1201 /*(done in response.c:config_cond_cache_reset() after request hdrs read)*/ 1202 /*config_cond_cache_reset_item(r, COMP_HTTP_HOST);*/ 1203 /*buffer_clear(&r->uri.authority);*/ 1204 1205 #if OPENSSL_VERSION_NUMBER >= 0x10002000L \ 1206 && !defined(LIBRESSL_VERSION_NUMBER) 1207 return SSL_TLSEXT_ERR_OK; 1208 #else 1209 return (mod_openssl_cert_cb(hctx->ssl, NULL) == 1) 1210 ? SSL_TLSEXT_ERR_OK 1211 : SSL_TLSEXT_ERR_ALERT_FATAL; 1212 #endif 1213 } 1214 1215 #ifdef SSL_CLIENT_HELLO_SUCCESS 1216 static int 1217 mod_openssl_client_hello_cb (SSL *ssl, int *al, void *srv) 1218 { 1219 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); 1220 buffer_copy_string_len(&hctx->r->uri.scheme, CONST_STR_LEN("https")); 1221 UNUSED(srv); 1222 1223 const unsigned char *name; 1224 size_t len, slen; 1225 if (!SSL_client_hello_get0_ext(ssl, TLSEXT_TYPE_server_name, &name, &len)) { 1226 return SSL_CLIENT_HELLO_SUCCESS; /* client did not provide SNI */ 1227 } 1228 1229 /* expecting single element in the server_name extension; parse first one */ 1230 if (len > 5 1231 && (size_t)((name[0] << 8) + name[1]) == len-2 1232 && name[2] == TLSEXT_TYPE_server_name 1233 && (slen = (name[3] << 8) + name[4]) <= len-5) { /*(first)*/ 1234 int read_ahead = hctx->conf.ssl_read_ahead; 1235 int rc = mod_openssl_SNI(hctx, (const char *)name+5, slen); 1236 if (!read_ahead && hctx->conf.ssl_read_ahead) 1237 SSL_set_read_ahead(ssl, hctx->conf.ssl_read_ahead); 1238 if (rc == SSL_TLSEXT_ERR_OK) 1239 return SSL_CLIENT_HELLO_SUCCESS; 1240 } 1241 1242 *al = TLS1_AD_UNRECOGNIZED_NAME; 1243 return SSL_CLIENT_HELLO_ERROR; 1244 } 1245 #else 1246 static int 1247 network_ssl_servername_callback (SSL *ssl, int *al, void *srv) 1248 { 1249 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); 1250 buffer_copy_string_len(&hctx->r->uri.scheme, CONST_STR_LEN("https")); 1251 UNUSED(al); 1252 UNUSED(srv); 1253 1254 const char *servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name); 1255 if (NULL == servername) 1256 return SSL_TLSEXT_ERR_NOACK; /* client did not provide SNI */ 1257 size_t len = strlen(servername); 1258 int read_ahead = hctx->conf.ssl_read_ahead; 1259 int rc = mod_openssl_SNI(hctx, servername, len); 1260 if (!read_ahead && hctx->conf.ssl_read_ahead) 1261 SSL_set_read_ahead(ssl, hctx->conf.ssl_read_ahead); 1262 return rc; 1263 } 1264 #endif 1265 #endif 1266 1267 1268 static X509 * 1269 mod_openssl_load_pem_file (const char *file, log_error_st *errh, STACK_OF(X509) **chain) 1270 { 1271 *chain = NULL; 1272 1273 off_t dlen = 512*1024*1024;/*(arbitrary limit: 512 MB file; expect < 1 MB)*/ 1274 char *data = fdevent_load_file(file, &dlen, errh, malloc, free); 1275 if (NULL == data) return NULL; 1276 1277 BIO *in = BIO_new_mem_buf(data, (int)dlen); 1278 if (NULL == in) { 1279 log_error(errh, __FILE__, __LINE__, 1280 "SSL: BIO_new/BIO_read_filename('%s') failed", file); 1281 if (dlen) safe_memclear(data, dlen); 1282 free(data); 1283 return NULL; 1284 } 1285 1286 X509 *x = PEM_read_bio_X509_AUX_secmem(in, NULL, NULL, NULL); 1287 if (NULL == x) { 1288 log_error(errh, __FILE__, __LINE__, 1289 "SSL: couldn't read X509 certificate from '%s'", file); 1290 } 1291 else if (!mod_openssl_load_X509_sk(file, errh, chain, in)) { 1292 X509_free(x); 1293 x = NULL; 1294 } 1295 1296 BIO_free(in); 1297 if (dlen) safe_memclear(data, dlen); 1298 free(data); 1299 return x; 1300 } 1301 1302 1303 static EVP_PKEY * 1304 mod_openssl_evp_pkey_load_pem_file (const char *file, log_error_st *errh) 1305 { 1306 off_t dlen = 512*1024*1024;/*(arbitrary limit: 512 MB file; expect < 1 MB)*/ 1307 char *data = fdevent_load_file(file, &dlen, errh, malloc, free); 1308 if (NULL == data) return NULL; 1309 EVP_PKEY *x = NULL; 1310 BIO *in = BIO_new_mem_buf(data, (int)dlen); 1311 if (NULL != in) { 1312 x = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL); 1313 BIO_free(in); 1314 } 1315 if (dlen) safe_memclear(data, dlen); 1316 free(data); 1317 1318 if (NULL == in) 1319 log_error(errh, __FILE__, __LINE__, 1320 "SSL: BIO_new/BIO_read_filename('%s') failed", file); 1321 else if (NULL == x) 1322 log_error(errh, __FILE__, __LINE__, 1323 "SSL: couldn't read private key from '%s'", file); 1324 1325 return x; 1326 } 1327 1328 1329 #ifndef OPENSSL_NO_OCSP 1330 1331 static buffer * 1332 mod_openssl_load_stapling_file (const char *file, log_error_st *errh, buffer *b) 1333 { 1334 /* load stapling .der into buffer *b only if successful 1335 * 1336 * Note: for some TLS libs, the OCSP stapling response is not copied when 1337 * assigned to a session (and is reasonable since not changed frequently) 1338 * - BoringSSL SSL_set_ocsp_response() 1339 * - WolfSSL SSL_set_tlsext_status_ocsp_resp() (differs from OpenSSL API) 1340 * Therefore, there is a potential race condition if the OCSP response is 1341 * assigned to the session during the handshake and the Server Hello is 1342 * partially sent, AND (unlikely, if possible at all), the TLS library is 1343 * in the middle of reading this OSCP response buffer. If the OCSP response 1344 * is replaced due to an updated ssl.stapling-file (checked periodically), 1345 * AND the buffer is resized, this would be a problem. Resizing the buffer 1346 * is unlikely since updated OSCP response for same certificate are 1347 * typically the same size with the signature and dates refreshed. 1348 */ 1349 1350 /* load raw .der file */ 1351 off_t dlen = 1*1024*1024;/*(arbitrary limit: 1 MB file; expect < 1 KB)*/ 1352 char *data = fdevent_load_file(file, &dlen, errh, malloc, free); 1353 if (NULL == data) return NULL; 1354 1355 #if defined(BORINGSSL_API_VERSION) 1356 1357 if (NULL == b) 1358 b = buffer_init(); 1359 else if (b->ptr) 1360 free(b->ptr); 1361 b->ptr = data; 1362 b->used = (uint32_t)dlen; 1363 b->size = (uint32_t)dlen+1; 1364 return b; 1365 1366 #else 1367 1368 BIO *in = BIO_new_mem_buf(data, (int)dlen); 1369 if (NULL == in) { 1370 log_error(errh, __FILE__, __LINE__, 1371 "SSL: BIO_new/BIO_read_filename('%s') failed", file); 1372 free(data); 1373 return NULL; 1374 } 1375 1376 OCSP_RESPONSE *x = d2i_OCSP_RESPONSE_bio(in, NULL); 1377 BIO_free(in); 1378 free(data); 1379 if (NULL == x) { 1380 log_error(errh, __FILE__, __LINE__, 1381 "SSL: OCSP stapling file read error: %s %s", 1382 ERR_error_string(ERR_get_error(), NULL), file); 1383 return NULL; 1384 } 1385 1386 unsigned char *rspder = NULL; 1387 int rspderlen = i2d_OCSP_RESPONSE(x, &rspder); 1388 1389 if (rspderlen > 0) { 1390 if (NULL == b) b = buffer_init(); 1391 buffer_copy_string_len(b, (char *)rspder, (uint32_t)rspderlen); 1392 } 1393 1394 OPENSSL_free(rspder); 1395 OCSP_RESPONSE_free(x); 1396 return rspderlen ? b : NULL; 1397 1398 #endif 1399 } 1400 1401 1402 #if !defined(BORINGSSL_API_VERSION) 1403 static time_t 1404 mod_openssl_asn1_time_to_posix (ASN1_TIME *asn1time) 1405 { 1406 #ifdef LIBRESSL_VERSION_NUMBER 1407 /* LibreSSL was forked from OpenSSL 1.0.1; does not have ASN1_TIME_diff */ 1408 1409 /*(Note: all certificate times are expected to use UTC)*/ 1410 /*(Note: does not strictly validate string contains appropriate digits)*/ 1411 /*(Note: incorrectly assumes GMT if 'Z' or offset not provided)*/ 1412 /*(Note: incorrectly ignores if local timezone might be in DST)*/ 1413 1414 if (NULL == asn1time || NULL == asn1time->data) return (time_t)-1; 1415 const char *s = (const char *)asn1time->data; 1416 size_t len = strlen(s); 1417 struct tm x; 1418 x.tm_isdst = 0; 1419 x.tm_yday = 0; 1420 x.tm_wday = 0; 1421 switch (asn1time->type) { 1422 case V_ASN1_UTCTIME: /* 2-digit year */ 1423 if (len < 8) return (time_t)-1; 1424 len -= 8; 1425 x.tm_year = (s[0]-'0')*10 + (s[1]-'0'); 1426 x.tm_year += (x.tm_year < 50 ? 2000 : 1900); 1427 s += 2; 1428 break; 1429 case V_ASN1_GENERALIZEDTIME: /* 4-digit year */ 1430 if (len < 10) return (time_t)-1; 1431 len -= 10; 1432 x.tm_year = (s[0]-'0')*1000+(s[1]-'0')*100+(s[2]-'0')*10+(s[3]-'0'); 1433 s += 4; 1434 break; 1435 default: 1436 return (time_t)-1; 1437 } 1438 x.tm_mon = (s[0]-'0')*10 + (s[1]-'0'); 1439 x.tm_mday = (s[2]-'0')*10 + (s[3]-'0'); 1440 x.tm_hour = (s[4]-'0')*10 + (s[5]-'0'); 1441 x.tm_min = 0; 1442 x.tm_sec = 0; 1443 s += 6; 1444 if (len >= 2 && s[0] != '+' && s[0] != '-' && s[0] != 'Z') { 1445 len -= 2; 1446 x.tm_min = (s[0]-'0')*10 + (s[1]-'0'); 1447 s += 2; 1448 if (len >= 2 && s[0] != '+' && s[0] != '-' && s[0] != 'Z') { 1449 len -= 2; 1450 x.tm_sec = (s[0]-'0')*10 + (s[1]-'0'); 1451 s += 2; 1452 if (len && s[0] == '.') { 1453 /*(ignore .fff fractional seconds; 1454 * should be up to 3 digits but we ignore more)*/ 1455 do { ++s; --len; } while (*s >= '0' && *s <= '9'); 1456 } 1457 } 1458 } 1459 int offset = 0; 1460 if ((*s == '-' || *s == '+') && len != 5) { 1461 offset = ((s[1]-'0')*10 + (s[2]-'0')) * 3600 1462 + ((s[3]-'0')*10 + (s[4]-'0')) * 60; 1463 if (*s == '-') offset = -offset; 1464 } 1465 else if (s[0] != '\0' && (s[0] != 'Z' || s[1] != '\0')) 1466 return (time_t)-1; 1467 1468 if (x.tm_year == 9999 && x.tm_mon == 12 && x.tm_mday == 31 1469 && x.tm_hour == 23 && x.tm_min == 59 && x.tm_sec == 59 && s[0] == 'Z') 1470 return (time_t)-1; // 99991231235959Z RFC 5280 1471 1472 x.tm_year-= 1900; 1473 x.tm_mon -= 1; 1474 time_t t = http_date_timegm(&x); 1475 return (t != (time_t)-1) ? t + offset : t; 1476 1477 #else 1478 1479 /* Note: this does not check for integer overflow of time_t! */ 1480 int day, sec; 1481 return ASN1_TIME_diff(&day, &sec, NULL, asn1time) 1482 ? log_epoch_secs + day*86400 + sec 1483 : (time_t)-1; 1484 1485 #endif 1486 } 1487 #endif 1488 1489 1490 static time_t 1491 mod_openssl_ocsp_next_update (plugin_cert *pc) 1492 { 1493 #if defined(BORINGSSL_API_VERSION) 1494 UNUSED(pc); 1495 return (time_t)-1; /*(not implemented)*/ 1496 #else 1497 buffer *der = pc->ssl_stapling; 1498 const unsigned char *p = (unsigned char *)der->ptr; /*(p gets modified)*/ 1499 OCSP_RESPONSE *ocsp = d2i_OCSP_RESPONSE(NULL,&p,buffer_string_length(der)); 1500 if (NULL == ocsp) return (time_t)-1; 1501 OCSP_BASICRESP *bs = OCSP_response_get1_basic(ocsp); 1502 if (NULL == bs) { 1503 OCSP_RESPONSE_free(ocsp); 1504 return (time_t)-1; 1505 } 1506 1507 /* XXX: should save and evaluate cert status returned by these calls */ 1508 ASN1_TIME *nextupd = NULL; 1509 OCSP_single_get0_status(OCSP_resp_get0(bs, 0), NULL, NULL, NULL, &nextupd); 1510 time_t t = nextupd ? mod_openssl_asn1_time_to_posix(nextupd) : (time_t)-1; 1511 1512 /* Note: trust external process which creates ssl.stapling-file to verify 1513 * (as well as to validate certificate status) 1514 * future: verify OCSP response here to double-check */ 1515 1516 OCSP_BASICRESP_free(bs); 1517 OCSP_RESPONSE_free(ocsp); 1518 1519 return t; 1520 #endif 1521 } 1522 1523 1524 __attribute_cold__ 1525 static void 1526 mod_openssl_expire_stapling_file (server *srv, plugin_cert *pc) 1527 { 1528 if (NULL == pc->ssl_stapling) /*(previously discarded or never loaded)*/ 1529 return; 1530 1531 /* discard expired OCSP stapling response */ 1532 buffer_free(pc->ssl_stapling); 1533 pc->ssl_stapling = NULL; 1534 if (pc->must_staple) 1535 log_error(srv->errh, __FILE__, __LINE__, 1536 "certificate marked OCSP Must-Staple, " 1537 "but OCSP response expired from ssl.stapling-file %s", 1538 pc->ssl_stapling_file->ptr); 1539 } 1540 1541 1542 static int 1543 mod_openssl_reload_stapling_file (server *srv, plugin_cert *pc, const time_t cur_ts) 1544 { 1545 buffer *b = mod_openssl_load_stapling_file(pc->ssl_stapling_file->ptr, 1546 srv->errh, pc->ssl_stapling); 1547 if (!b) return 0; 1548 1549 pc->ssl_stapling = b; /*(unchanged unless orig was NULL)*/ 1550 pc->ssl_stapling_loadts = cur_ts; 1551 pc->ssl_stapling_nextts = mod_openssl_ocsp_next_update(pc); 1552 if (pc->ssl_stapling_nextts == (time_t)-1) { 1553 /* "Next Update" might not be provided by OCSP responder 1554 * Use 3600 sec (1 hour) in that case. */ 1555 /* retry in 1 hour if unable to determine Next Update */ 1556 pc->ssl_stapling_nextts = cur_ts + 3600; 1557 pc->ssl_stapling_loadts = 0; 1558 } 1559 else if (pc->ssl_stapling_nextts < cur_ts) { 1560 mod_openssl_expire_stapling_file(srv, pc); 1561 return 0; 1562 } 1563 1564 return 1; 1565 } 1566 1567 1568 static int 1569 mod_openssl_refresh_stapling_file (server *srv, plugin_cert *pc, const time_t cur_ts) 1570 { 1571 if (pc->ssl_stapling && pc->ssl_stapling_nextts > cur_ts + 256) 1572 return 1; /* skip check for refresh unless close to expire */ 1573 struct stat st; 1574 if (0 != stat(pc->ssl_stapling_file->ptr, &st) 1575 || st.st_mtime <= pc->ssl_stapling_loadts) { 1576 if (pc->ssl_stapling && pc->ssl_stapling_nextts < cur_ts) 1577 mod_openssl_expire_stapling_file(srv, pc); 1578 return 1; 1579 } 1580 return mod_openssl_reload_stapling_file(srv, pc, cur_ts); 1581 } 1582 1583 1584 static void 1585 mod_openssl_refresh_stapling_files (server *srv, const plugin_data *p, const time_t cur_ts) 1586 { 1587 /* future: might construct array of (plugin_cert *) at startup 1588 * to avoid the need to search for them here */ 1589 /* (init i to 0 if global context; to 1 to skip empty global context) */ 1590 if (NULL == p->cvlist) return; 1591 for (int i = !p->cvlist[0].v.u2[1], used = p->nconfig; i < used; ++i) { 1592 const config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0]; 1593 for (; cpv->k_id != -1; ++cpv) { 1594 if (cpv->k_id != 0) continue; /* k_id == 0 for ssl.pemfile */ 1595 if (cpv->vtype != T_CONFIG_LOCAL) continue; 1596 plugin_cert *pc = cpv->v.v; 1597 if (!buffer_string_is_empty(pc->ssl_stapling_file)) 1598 mod_openssl_refresh_stapling_file(srv, pc, cur_ts); 1599 } 1600 } 1601 } 1602 1603 1604 static int 1605 mod_openssl_crt_must_staple (const X509 *crt) 1606 { 1607 #if OPENSSL_VERSION_NUMBER < 0x10100000L \ 1608 || defined(BORINGSSL_API_VERSION) \ 1609 || defined(LIBRESSL_VERSION_NUMBER) 1610 /*(not currently supported in BoringSSL or LibreSSL)*/ 1611 UNUSED(crt); 1612 return 0; 1613 #else 1614 /* openssl/x509v3.h:typedef STACK_OF(ASN1_INTEGER) TLS_FEATURE; */ 1615 1616 TLS_FEATURE *tlsf = X509_get_ext_d2i(crt, NID_tlsfeature, NULL, NULL); 1617 if (NULL == tlsf) return 0; 1618 1619 int rc = 0; 1620 1621 for (int i = 0; i < sk_ASN1_INTEGER_num(tlsf); ++i) { 1622 ASN1_INTEGER *ai = sk_ASN1_INTEGER_value(tlsf, i); 1623 long tlsextid = ASN1_INTEGER_get(ai); 1624 if (tlsextid == 5) { /* 5 = OCSP Must-Staple */ 1625 rc = 1; 1626 break; 1627 } 1628 } 1629 1630 sk_ASN1_INTEGER_pop_free(tlsf, ASN1_INTEGER_free); 1631 return rc; /* 1 if OCSP Must-Staple found; 0 if not */ 1632 #endif 1633 } 1634 1635 #endif /* OPENSSL_NO_OCSP */ 1636 1637 1638 static plugin_cert * 1639 network_openssl_load_pemfile (server *srv, const buffer *pemfile, const buffer *privkey, const buffer *ssl_stapling_file) 1640 { 1641 if (!mod_openssl_init_once_openssl(srv)) return NULL; 1642 1643 STACK_OF(X509) *ssl_pemfile_chain = NULL; 1644 X509 *ssl_pemfile_x509 = 1645 mod_openssl_load_pem_file(pemfile->ptr, srv->errh, &ssl_pemfile_chain); 1646 if (NULL == ssl_pemfile_x509) 1647 return NULL; 1648 1649 EVP_PKEY *ssl_pemfile_pkey = 1650 mod_openssl_evp_pkey_load_pem_file(privkey->ptr, srv->errh); 1651 if (NULL == ssl_pemfile_pkey) { 1652 X509_free(ssl_pemfile_x509); 1653 sk_X509_pop_free(ssl_pemfile_chain, X509_free); 1654 return NULL; 1655 } 1656 1657 if (!X509_check_private_key(ssl_pemfile_x509, ssl_pemfile_pkey)) { 1658 log_error(srv->errh, __FILE__, __LINE__, "SSL:" 1659 "Private key does not match the certificate public key, " 1660 "reason: %s %s %s", ERR_error_string(ERR_get_error(), NULL), 1661 pemfile->ptr, privkey->ptr); 1662 EVP_PKEY_free(ssl_pemfile_pkey); 1663 X509_free(ssl_pemfile_x509); 1664 sk_X509_pop_free(ssl_pemfile_chain, X509_free); 1665 return NULL; 1666 } 1667 1668 plugin_cert *pc = malloc(sizeof(plugin_cert)); 1669 force_assert(pc); 1670 pc->ssl_pemfile_pkey = ssl_pemfile_pkey; 1671 pc->ssl_pemfile_x509 = ssl_pemfile_x509; 1672 pc->ssl_pemfile_chain= ssl_pemfile_chain; 1673 pc->ssl_pemfile = pemfile; 1674 pc->ssl_privkey = privkey; 1675 pc->ssl_stapling = NULL; 1676 pc->ssl_stapling_file= ssl_stapling_file; 1677 pc->ssl_stapling_loadts = 0; 1678 pc->ssl_stapling_nextts = 0; 1679 #ifndef OPENSSL_NO_OCSP 1680 pc->must_staple = mod_openssl_crt_must_staple(ssl_pemfile_x509); 1681 #else 1682 pc->must_staple = 0; 1683 #endif 1684 pc->self_issued = 1685 (0 == X509_NAME_cmp(X509_get_subject_name(ssl_pemfile_x509), 1686 X509_get_issuer_name(ssl_pemfile_x509))); 1687 1688 if (!buffer_string_is_empty(pc->ssl_stapling_file)) { 1689 #ifndef OPENSSL_NO_OCSP 1690 if (!mod_openssl_reload_stapling_file(srv, pc, log_epoch_secs)) { 1691 /* continue without OCSP response if there is an error */ 1692 } 1693 #else 1694 log_error(srv->errh, __FILE__, __LINE__, "SSL:" 1695 "OCSP stapling not supported; ignoring %s", 1696 pc->ssl_stapling_file->ptr); 1697 #endif 1698 } 1699 else if (pc->must_staple) { 1700 log_error(srv->errh, __FILE__, __LINE__, 1701 "certificate %s marked OCSP Must-Staple, " 1702 "but ssl.stapling-file not provided", pemfile->ptr); 1703 } 1704 1705 return pc; 1706 } 1707 1708 1709 #ifndef OPENSSL_NO_TLSEXT 1710 1711 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation 1712 1713 static int 1714 mod_openssl_acme_tls_1 (SSL *ssl, handler_ctx *hctx) 1715 { 1716 buffer * const b = hctx->tmp_buf; 1717 const buffer * const name = &hctx->r->uri.authority; 1718 log_error_st * const errh = hctx->r->conf.errh; 1719 X509 *ssl_pemfile_x509 = NULL; 1720 STACK_OF(X509) *ssl_pemfile_chain = NULL; 1721 EVP_PKEY *ssl_pemfile_pkey = NULL; 1722 size_t len; 1723 int rc = SSL_TLSEXT_ERR_ALERT_FATAL; 1724 1725 /* check if acme-tls/1 protocol is enabled (path to dir of cert(s) is set)*/ 1726 if (buffer_string_is_empty(hctx->conf.ssl_acme_tls_1)) 1727 return SSL_TLSEXT_ERR_NOACK; /*(reuse value here for not-configured)*/ 1728 1729 /* check if SNI set server name (required for acme-tls/1 protocol) 1730 * and perform simple path checks for no '/' 1731 * and no leading '.' (e.g. ignore "." or ".." or anything beginning '.') */ 1732 if (buffer_string_is_empty(name)) return rc; 1733 if (NULL != strchr(name->ptr, '/')) return rc; 1734 if (name->ptr[0] == '.') return rc; 1735 #if 0 1736 if (0 != http_request_host_policy(name,hctx->r->conf.http_parseopts,443)) 1737 return rc; 1738 #endif 1739 buffer_copy_path_len2(b, CONST_BUF_LEN(hctx->conf.ssl_acme_tls_1), 1740 CONST_BUF_LEN(name)); 1741 len = buffer_string_length(b); 1742 1743 do { 1744 buffer_append_string_len(b, CONST_STR_LEN(".crt.pem")); 1745 ssl_pemfile_x509 = 1746 mod_openssl_load_pem_file(b->ptr, errh, &ssl_pemfile_chain); 1747 if (NULL == ssl_pemfile_x509) { 1748 log_error(errh, __FILE__, __LINE__, 1749 "SSL: Failed to load acme-tls/1 pemfile: %s", b->ptr); 1750 break; 1751 } 1752 1753 buffer_string_set_length(b, len); /*(remove ".crt.pem")*/ 1754 buffer_append_string_len(b, CONST_STR_LEN(".key.pem")); 1755 ssl_pemfile_pkey = mod_openssl_evp_pkey_load_pem_file(b->ptr, errh); 1756 if (NULL == ssl_pemfile_pkey) { 1757 log_error(errh, __FILE__, __LINE__, 1758 "SSL: Failed to load acme-tls/1 pemfile: %s", b->ptr); 1759 break; 1760 } 1761 1762 #if 0 /* redundant with below? */ 1763 if (!X509_check_private_key(ssl_pemfile_x509, ssl_pemfile_pkey)) { 1764 log_error(errh, __FILE__, __LINE__, 1765 "SSL: Private key does not match acme-tls/1 " 1766 "certificate public key, reason: %s %s" 1767 ERR_error_string(ERR_get_error(), NULL), b->ptr); 1768 break; 1769 } 1770 #endif 1771 1772 /* first set certificate! 1773 * setting private key checks whether certificate matches it */ 1774 if (1 != SSL_use_certificate(ssl, ssl_pemfile_x509)) { 1775 log_error(errh, __FILE__, __LINE__, 1776 "SSL: failed to set acme-tls/1 certificate for TLS server " 1777 "name %s: %s", name->ptr, ERR_error_string(ERR_get_error(),NULL)); 1778 break; 1779 } 1780 1781 if (ssl_pemfile_chain) { 1782 SSL_set0_chain(ssl, ssl_pemfile_chain); 1783 ssl_pemfile_chain = NULL; 1784 } 1785 1786 if (1 != SSL_use_PrivateKey(ssl, ssl_pemfile_pkey)) { 1787 log_error(errh, __FILE__, __LINE__, 1788 "SSL: failed to set acme-tls/1 private key for TLS server " 1789 "name %s: %s", name->ptr, ERR_error_string(ERR_get_error(),NULL)); 1790 break; 1791 } 1792 1793 hctx->conf.ssl_verifyclient_enforce = 0; 1794 SSL_set_verify(ssl, SSL_VERIFY_NONE, NULL); 1795 rc = SSL_TLSEXT_ERR_OK; 1796 } while (0); 1797 1798 if (ssl_pemfile_pkey) EVP_PKEY_free(ssl_pemfile_pkey); 1799 if (ssl_pemfile_x509) X509_free(ssl_pemfile_x509); 1800 if (ssl_pemfile_chain) 1801 sk_X509_pop_free(ssl_pemfile_chain, X509_free); 1802 1803 return rc; 1804 } 1805 1806 /* https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids */ 1807 static int 1808 mod_openssl_alpn_select_cb (SSL *ssl, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg) 1809 { 1810 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); 1811 unsigned short proto; 1812 UNUSED(arg); 1813 1814 for (unsigned int i = 0, n; i < inlen; i += n) { 1815 n = in[i++]; 1816 if (i+n > inlen || 0 == n) break; 1817 switch (n) { 1818 case 2: /* "h2" */ 1819 if (in[i] == 'h' && in[i+1] == '2') { 1820 if (!hctx->r->conf.h2proto) continue; 1821 proto = MOD_OPENSSL_ALPN_H2; 1822 hctx->r->http_version = HTTP_VERSION_2; 1823 break; 1824 } 1825 continue; 1826 case 8: /* "http/1.1" "http/1.0" */ 1827 if (0 == memcmp(in+i, "http/1.", 7)) { 1828 if (in[i+7] == '1') { 1829 proto = MOD_OPENSSL_ALPN_HTTP11; 1830 break; 1831 } 1832 if (in[i+7] == '0') { 1833 proto = MOD_OPENSSL_ALPN_HTTP10; 1834 break; 1835 } 1836 } 1837 continue; 1838 case 10: /* "acme-tls/1" */ 1839 if (0 == memcmp(in+i, "acme-tls/1", 10)) { 1840 int rc = mod_openssl_acme_tls_1(ssl, hctx); 1841 if (rc == SSL_TLSEXT_ERR_OK) { 1842 proto = MOD_OPENSSL_ALPN_ACME_TLS_1; 1843 break; 1844 } 1845 /* (use SSL_TLSEXT_ERR_NOACK for not-configured) */ 1846 if (rc == SSL_TLSEXT_ERR_NOACK) continue; 1847 return rc; 1848 } 1849 continue; 1850 default: 1851 continue; 1852 } 1853 1854 hctx->alpn = proto; 1855 *out = in+i; 1856 *outlen = n; 1857 return SSL_TLSEXT_ERR_OK; 1858 } 1859 1860 #if OPENSSL_VERSION_NUMBER < 0x10100000L 1861 return SSL_TLSEXT_ERR_NOACK; 1862 #else 1863 return SSL_TLSEXT_ERR_ALERT_FATAL; 1864 #endif 1865 } 1866 1867 #endif /* TLSEXT_TYPE_application_layer_protocol_negotiation */ 1868 1869 #endif /* OPENSSL_NO_TLSEXT */ 1870 1871 1872 #if defined(BORINGSSL_API_VERSION) \ 1873 || defined(LIBRESSL_VERSION_NUMBER) 1874 static int 1875 mod_openssl_ssl_conf_cmd (server *srv, plugin_config_socket *s); 1876 #endif 1877 1878 1879 static int 1880 network_openssl_ssl_conf_cmd (server *srv, plugin_config_socket *s) 1881 { 1882 #ifdef SSL_CONF_FLAG_CMDLINE 1883 1884 int rc = 0; 1885 const data_string *ds; 1886 SSL_CONF_CTX * const cctx = SSL_CONF_CTX_new(); 1887 SSL_CONF_CTX_set_ssl_ctx(cctx, s->ssl_ctx); 1888 SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_FILE 1889 | SSL_CONF_FLAG_SERVER 1890 | SSL_CONF_FLAG_SHOW_ERRORS 1891 | SSL_CONF_FLAG_CERTIFICATE); 1892 1893 /* always disable null and export ciphers */ 1894 ds = (const data_string *) 1895 array_get_element_klen(s->ssl_conf_cmd, 1896 CONST_STR_LEN("CipherString")); 1897 if (NULL != ds) { 1898 buffer *cipher_string = 1899 array_get_buf_ptr(s->ssl_conf_cmd, CONST_STR_LEN("CipherString")); 1900 if (buffer_string_is_empty(cipher_string)) 1901 buffer_append_string_len(cipher_string, CONST_STR_LEN("HIGH")); 1902 buffer_append_string_len(cipher_string, 1903 CONST_STR_LEN(":!aNULL:!eNULL:!EXP")); 1904 } 1905 1906 for (size_t i = 0; i < s->ssl_conf_cmd->used; ++i) { 1907 ds = (data_string *)s->ssl_conf_cmd->data[i]; 1908 /* ("SecurityLevel" is lighttpd extension to SSL_CONF_cmd() syntax) 1909 * SSL_CTX_set_security_level() is specific to OpenSSL >= 1.1.0 */ 1910 if (buffer_eq_icase_slen(&ds->key, CONST_STR_LEN("SecurityLevel"))) { 1911 #if OPENSSL_VERSION_NUMBER >= 0x10100000L 1912 int level = atoi(ds->value.ptr); 1913 if (level >= 0) SSL_CTX_set_security_level(s->ssl_ctx, level); 1914 #endif 1915 continue; 1916 } 1917 ERR_clear_error(); 1918 if (SSL_CONF_cmd(cctx, ds->key.ptr, ds->value.ptr) <= 0) { 1919 log_error(srv->errh, __FILE__, __LINE__, 1920 "SSL: SSL_CONF_cmd %s %s: %s", ds->key.ptr, ds->value.ptr, 1921 ERR_error_string(ERR_get_error(), NULL)); 1922 rc = -1; 1923 break; 1924 } 1925 } 1926 1927 if (0 == rc && 1 != SSL_CONF_CTX_finish(cctx)) { 1928 log_error(srv->errh, __FILE__, __LINE__, 1929 "SSL: SSL_CONF_CTX_finish(): %s", 1930 ERR_error_string(ERR_get_error(), NULL)); 1931 rc = -1; 1932 } 1933 1934 SSL_CONF_CTX_free(cctx); 1935 return rc; 1936 1937 #elif defined(BORINGSSL_API_VERSION) \ 1938 || defined(LIBRESSL_VERSION_NUMBER) 1939 1940 return mod_openssl_ssl_conf_cmd(srv, s); 1941 1942 #else 1943 1944 UNUSED(s); 1945 log_error(srv->errh, __FILE__, __LINE__, 1946 "SSL: ssl.openssl.ssl-conf-cmd not available; ignored"); 1947 return 0; 1948 1949 #endif 1950 } 1951 1952 1953 #if OPENSSL_VERSION_NUMBER < 0x30000000L 1954 #ifndef OPENSSL_NO_DH 1955 #if OPENSSL_VERSION_NUMBER < 0x10100000L \ 1956 || (defined(LIBRESSL_VERSION_NUMBER) \ 1957 && LIBRESSL_VERSION_NUMBER < 0x2070000fL) 1958 #define DH_set0_pqg(dh, dh_p, NULL, dh_g) \ 1959 ((dh)->p = (dh_p), (dh)->g = (dh_g), (dh_p) != NULL && (dh_g) != NULL) 1960 #endif 1961 /* https://tools.ietf.org/html/rfc7919#appendix-A.1 1962 * A.1. ffdhe2048 1963 * 1964 * https://ssl-config.mozilla.org/ffdhe2048.txt 1965 * C code generated with: openssl dhparam -C -in ffdhe2048.txt 1966 */ 1967 static DH *get_dh2048(void) 1968 { 1969 static unsigned char dhp_2048[] = { 1970 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xAD, 0xF8, 1971 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, 0xAF, 0xDC, 0x56, 0x20, 1972 0x27, 0x3D, 0x3C, 0xF1, 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 1973 0x36, 0x95, 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, 1974 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, 0x7D, 0x2F, 1975 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, 0xF6, 0x81, 0xB2, 0x02, 1976 0xAE, 0xC4, 0x61, 0x7A, 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 1977 0x65, 0x61, 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, 1978 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, 0xB5, 0x57, 1979 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, 0x98, 0x4F, 0x0C, 0x70, 1980 0xE0, 0xE6, 0x8B, 0x77, 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 1981 0xE8, 0x72, 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, 1982 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, 0xBC, 0x0A, 1983 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, 0xD1, 0x08, 0xA9, 0x4B, 1984 0xB2, 0xC8, 0xE3, 0xFB, 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 1985 0xF4, 0x68, 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, 1986 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, 0x0B, 0x07, 1987 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, 0x9E, 0x02, 0xFC, 0xE1, 1988 0xCD, 0xF7, 0xE2, 0xEC, 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 1989 0x2F, 0x61, 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, 1990 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, 0xC3, 0xFE, 1991 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, 0x3B, 0xB5, 0xFC, 0xBC, 1992 0x2E, 0xC2, 0x20, 0x05, 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 1993 0x83, 0xB2, 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, 1994 0x88, 0x6B, 0x42, 0x38, 0x61, 0x28, 0x5C, 0x97, 0xFF, 0xFF, 1995 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF 1996 }; 1997 static unsigned char dhg_2048[] = { 1998 0x02 1999 }; 2000 DH *dh = DH_new(); 2001 BIGNUM *p, *g; 2002 2003 if (dh == NULL) 2004 return NULL; 2005 p = BN_bin2bn(dhp_2048, sizeof(dhp_2048), NULL); 2006 g = BN_bin2bn(dhg_2048, sizeof(dhg_2048), NULL); 2007 if (p == NULL || g == NULL || !DH_set0_pqg(dh, p, NULL, g)) { 2008 DH_free(dh); 2009 BN_free(p); 2010 BN_free(g); 2011 return NULL; 2012 } 2013 return dh; 2014 } 2015 #endif 2016 #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ 2017 2018 2019 static int 2020 mod_openssl_ssl_conf_curves(server *srv, plugin_config_socket *s, const buffer *ssl_ec_curve) 2021 { 2022 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL 2023 #ifndef OPENSSL_NO_ECDH 2024 int nid = 0; 2025 /* Support for Elliptic-Curve Diffie-Hellman key exchange */ 2026 if (!buffer_string_is_empty(ssl_ec_curve)) { 2027 /* OpenSSL only supports the "named curves" 2028 * from RFC 4492, section 5.1.1. */ 2029 nid = OBJ_sn2nid((char *) ssl_ec_curve->ptr); 2030 if (nid == 0) { 2031 log_error(srv->errh, __FILE__, __LINE__, 2032 "SSL: Unknown curve name %s", ssl_ec_curve->ptr); 2033 return 0; 2034 } 2035 } 2036 else { 2037 #if OPENSSL_VERSION_NUMBER < 0x10002000 2038 /* Default curve */ 2039 nid = OBJ_sn2nid("prime256v1"); 2040 #elif OPENSSL_VERSION_NUMBER < 0x10100000L \ 2041 || defined(LIBRESSL_VERSION_NUMBER) 2042 if (!SSL_CTX_set_ecdh_auto(s->ssl_ctx, 1)) { 2043 log_error(srv->errh, __FILE__, __LINE__, 2044 "SSL: SSL_CTX_set_ecdh_auto() failed"); 2045 } 2046 #endif 2047 } 2048 if (nid) { 2049 #if OPENSSL_VERSION_NUMBER < 0x30000000L 2050 EC_KEY *ecdh; 2051 ecdh = EC_KEY_new_by_curve_name(nid); 2052 if (ecdh == NULL) { 2053 log_error(srv->errh, __FILE__, __LINE__, 2054 "SSL: Unable to create curve %s", ssl_ec_curve->ptr); 2055 return 0; 2056 } 2057 SSL_CTX_set_tmp_ecdh(s->ssl_ctx, ecdh); 2058 EC_KEY_free(ecdh); 2059 #else 2060 /* SSL_CTX_set1_groups() available in openssl 1.1.1, but might 2061 * not be present in alt TLS libs (libressl or boringssl) */ 2062 if (1 != SSL_CTX_set1_groups(s->ssl_ctx, &nid, 1)) { 2063 log_error(srv->errh, __FILE__, __LINE__, 2064 "SSL: Unable to config curve %s", ssl_ec_curve->ptr); 2065 return 0; 2066 } 2067 #endif 2068 SSL_CTX_set_options(s->ssl_ctx, SSL_OP_SINGLE_ECDH_USE); 2069 } 2070 #endif 2071 #endif 2072 UNUSED(srv); 2073 UNUSED(s); 2074 UNUSED(ssl_ec_curve); 2075 2076 return 1; 2077 } 2078 2079 2080 static int 2081 network_init_ssl (server *srv, plugin_config_socket *s, plugin_data *p) 2082 { 2083 /* load SSL certificates */ 2084 2085 #ifndef SSL_OP_NO_COMPRESSION 2086 #define SSL_OP_NO_COMPRESSION 0 2087 #endif 2088 #ifndef SSL_MODE_RELEASE_BUFFERS /* OpenSSL >= 1.0.0 */ 2089 #define SSL_MODE_RELEASE_BUFFERS 0 2090 #endif 2091 long ssloptions = SSL_OP_ALL 2092 | SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 2093 | SSL_OP_NO_COMPRESSION; 2094 2095 #if OPENSSL_VERSION_NUMBER >= 0x10100000L 2096 s->ssl_ctx = (!s->ssl_use_sslv2 && !s->ssl_use_sslv3) 2097 ? SSL_CTX_new(TLS_server_method()) 2098 : SSL_CTX_new(SSLv23_server_method()); 2099 #else 2100 s->ssl_ctx = SSL_CTX_new(SSLv23_server_method()); 2101 #endif 2102 if (NULL == s->ssl_ctx) { 2103 log_error(srv->errh, __FILE__, __LINE__, 2104 "SSL: %s", ERR_error_string(ERR_get_error(), NULL)); 2105 return -1; 2106 } 2107 2108 #ifdef SSL_OP_NO_RENEGOTIATION /* openssl 1.1.0 */ 2109 if (s->ssl_disable_client_renegotiation) 2110 ssloptions |= SSL_OP_NO_RENEGOTIATION; 2111 #endif 2112 2113 /* completely useless identifier; 2114 * required for client cert verification to work with sessions */ 2115 if (0 == SSL_CTX_set_session_id_context( 2116 s->ssl_ctx,(const unsigned char*)CONST_STR_LEN("lighttpd"))){ 2117 log_error(srv->errh, __FILE__, __LINE__, 2118 "SSL: failed to set session context: %s", 2119 ERR_error_string(ERR_get_error(), NULL)); 2120 return -1; 2121 } 2122 2123 const int disable_sess_cache = 2124 srv->srvconf.feature_flags 2125 && !config_plugin_value_tobool( 2126 array_get_element_klen(srv->srvconf.feature_flags, 2127 CONST_STR_LEN("ssl.session-cache")), 0); 2128 if (disable_sess_cache) 2129 /* disable session cache; session tickets are preferred */ 2130 SSL_CTX_set_session_cache_mode(s->ssl_ctx, 2131 SSL_SESS_CACHE_OFF 2132 | SSL_SESS_CACHE_NO_AUTO_CLEAR 2133 | SSL_SESS_CACHE_NO_INTERNAL); 2134 2135 if (s->ssl_empty_fragments) { 2136 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS 2137 ssloptions &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; 2138 #else 2139 ssloptions &= ~0x00000800L; /* hardcode constant */ 2140 log_error(srv->errh, __FILE__, __LINE__, 2141 "WARNING: SSL: 'insert empty fragments' not supported by the " 2142 "openssl version used to compile lighttpd with"); 2143 #endif 2144 } 2145 2146 SSL_CTX_set_options(s->ssl_ctx, ssloptions); 2147 SSL_CTX_set_info_callback(s->ssl_ctx, ssl_info_callback); 2148 2149 if (!s->ssl_use_sslv2 && 0 != SSL_OP_NO_SSLv2) { 2150 /* disable SSLv2 */ 2151 if ((SSL_OP_NO_SSLv2 2152 & SSL_CTX_set_options(s->ssl_ctx, SSL_OP_NO_SSLv2)) 2153 != SSL_OP_NO_SSLv2) { 2154 log_error(srv->errh, __FILE__, __LINE__, 2155 "SSL: %s", ERR_error_string(ERR_get_error(), NULL)); 2156 return -1; 2157 } 2158 } 2159 2160 if (!s->ssl_use_sslv3 && 0 != SSL_OP_NO_SSLv3) { 2161 /* disable SSLv3 */ 2162 if ((SSL_OP_NO_SSLv3 2163 & SSL_CTX_set_options(s->ssl_ctx, SSL_OP_NO_SSLv3)) 2164 != SSL_OP_NO_SSLv3) { 2165 log_error(srv->errh, __FILE__, __LINE__, 2166 "SSL: %s", ERR_error_string(ERR_get_error(), NULL)); 2167 return -1; 2168 } 2169 } 2170 2171 if (!buffer_string_is_empty(s->ssl_cipher_list)) { 2172 /* Disable support for low encryption ciphers */ 2173 if (SSL_CTX_set_cipher_list(s->ssl_ctx,s->ssl_cipher_list->ptr)!=1){ 2174 log_error(srv->errh, __FILE__, __LINE__, 2175 "SSL: %s", ERR_error_string(ERR_get_error(), NULL)); 2176 return -1; 2177 } 2178 2179 if (s->ssl_honor_cipher_order) { 2180 SSL_CTX_set_options(s->ssl_ctx,SSL_OP_CIPHER_SERVER_PREFERENCE); 2181 } 2182 } 2183 2184 #ifdef SSL_OP_PRIORITIZE_CHACHA /*(openssl 1.1.1)*/ 2185 if (s->ssl_honor_cipher_order) 2186 SSL_CTX_set_options(s->ssl_ctx, SSL_OP_PRIORITIZE_CHACHA); 2187 #endif 2188 2189 #ifndef OPENSSL_NO_DH 2190 { 2191 #if OPENSSL_VERSION_NUMBER < 0x30000000L 2192 DH *dh; 2193 /* Support for Diffie-Hellman key exchange */ 2194 if (!buffer_string_is_empty(s->ssl_dh_file)) { 2195 /* DH parameters from file */ 2196 BIO *bio; 2197 bio = BIO_new_file((char *) s->ssl_dh_file->ptr, "r"); 2198 if (bio == NULL) { 2199 log_error(srv->errh, __FILE__, __LINE__, 2200 "SSL: Unable to open file %s", s->ssl_dh_file->ptr); 2201 return -1; 2202 } 2203 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); 2204 BIO_free(bio); 2205 if (dh == NULL) { 2206 log_error(srv->errh, __FILE__, __LINE__, 2207 "SSL: PEM_read_bio_DHparams failed %s", s->ssl_dh_file->ptr); 2208 return -1; 2209 } 2210 SSL_CTX_set_tmp_dh(s->ssl_ctx,dh); 2211 DH_free(dh); 2212 } 2213 else { 2214 dh = get_dh2048(); 2215 if (dh == NULL) { 2216 log_error(srv->errh, __FILE__, __LINE__, 2217 "SSL: get_dh2048() failed"); 2218 return -1; 2219 } 2220 SSL_CTX_set_tmp_dh(s->ssl_ctx,dh); 2221 DH_free(dh); 2222 } 2223 #else 2224 /* OSSL_STORE_open() available in openssl 1.1.1, but might 2225 * not be present in alt TLS libs (libressl or boringssl) */ 2226 EVP_PKEY *dhpkey = NULL; 2227 if (!buffer_string_is_empty(s->ssl_dh_file)) { 2228 OSSL_STORE_CTX *ctx = NULL; 2229 ctx = OSSL_STORE_open(s->ssl_dh_file->ptr, NULL, NULL, NULL, NULL); 2230 if (NULL != ctx) { 2231 if (OSSL_STORE_expect(ctx, OSSL_STORE_INFO_PARAMS)) { 2232 while (!OSSL_STORE_eof(ctx)) { 2233 OSSL_STORE_INFO *info = OSSL_STORE_load(ctx); 2234 if (info) { 2235 dhpkey = OSSL_STORE_INFO_get1_PARAMS(info); 2236 OSSL_STORE_INFO_free(info); 2237 } 2238 break; 2239 } 2240 } 2241 OSSL_STORE_close(ctx); 2242 } 2243 if (!dhpkey || !EVP_PKEY_is_a(dhpkey, "DH") 2244 || !SSL_CTX_set0_tmp_dh_pkey(s->ssl_ctx, dhpkey)) { 2245 log_error(srv->errh, __FILE__, __LINE__, 2246 "Unable to load DH params from %s", s->ssl_dh_file->ptr); 2247 EVP_PKEY_free(dhpkey); 2248 dhpkey = NULL; 2249 } /*(else dhpkey ownership transferred upon success)*/ 2250 } 2251 if (NULL == dhpkey) 2252 SSL_CTX_set_dh_auto(s->ssl_ctx, 1); 2253 #endif 2254 SSL_CTX_set_options(s->ssl_ctx,SSL_OP_SINGLE_DH_USE); 2255 } 2256 #else 2257 if (!buffer_string_is_empty(s->ssl_dh_file)) { 2258 log_error(srv->errh, __FILE__, __LINE__, 2259 "SSL: openssl compiled without DH support, " 2260 "can't load parameters from %s", s->ssl_dh_file->ptr); 2261 } 2262 #endif 2263 2264 if (!mod_openssl_ssl_conf_curves(srv, s, s->ssl_ec_curve)) 2265 return -1; 2266 2267 #ifdef TLSEXT_TYPE_session_ticket 2268 #if OPENSSL_VERSION_NUMBER < 0x30000000L 2269 SSL_CTX_set_tlsext_ticket_key_cb(s->ssl_ctx, ssl_tlsext_ticket_key_cb); 2270 #else /* OPENSSL_VERSION_NUMBER >= 0x30000000L */ 2271 SSL_CTX_set_tlsext_ticket_key_evp_cb(s->ssl_ctx, 2272 ssl_tlsext_ticket_key_cb); 2273 #endif 2274 #endif 2275 2276 #ifndef OPENSSL_NO_OCSP 2277 #ifndef BORINGSSL_API_VERSION /* BoringSSL suggests using different API */ 2278 SSL_CTX_set_tlsext_status_cb(s->ssl_ctx, ssl_tlsext_status_cb); 2279 #endif 2280 #endif 2281 2282 #if OPENSSL_VERSION_NUMBER >= 0x10002000 \ 2283 && !defined(LIBRESSL_VERSION_NUMBER) 2284 2285 SSL_CTX_set_cert_cb(s->ssl_ctx, mod_openssl_cert_cb, NULL); 2286 UNUSED(p); 2287 2288 #if defined(BORINGSSL_API_VERSION) /* BoringSSL limitation */ 2289 /* set cert store for auto-chaining 2290 * BoringSSL does not support SSL_set1_chain_cert_store() in cert_cb */ 2291 if (s->ssl_ca_file && s->ssl_ca_file->certs) { 2292 if (!X509_STORE_up_ref(s->ssl_ca_file->certs)) 2293 return -1; 2294 SSL_CTX_set_cert_store(s->ssl_ctx, s->ssl_ca_file->certs); 2295 } 2296 #endif 2297 2298 #else /* OPENSSL_VERSION_NUMBER < 0x10002000 */ 2299 2300 /* load all ssl.ca-files specified in the config into each SSL_CTX 2301 * XXX: This might be a bit excessive, but are all trusted CAs 2302 * TODO: prefer to load on-demand in mod_openssl_cert_cb() 2303 * for openssl >= 1.0.2 */ 2304 if (!mod_openssl_load_ca_files(s->ssl_ctx, p, srv)) 2305 return -1; 2306 2307 if (s->ssl_verifyclient) { 2308 if (NULL == s->ssl_ca_file) { 2309 log_error(srv->errh, __FILE__, __LINE__, 2310 "SSL: You specified ssl.verifyclient.activate " 2311 "but no ssl.verifyclient.ca-file"); 2312 return -1; 2313 } 2314 /* WTH openssl? SSL_CTX_set_client_CA_list() calls set0_CA_list(), 2315 * but there is no set1_CA_list() to simply up the reference count 2316 * (without needing to duplicate the list) */ 2317 /* WTH wolfssl? wolfSSL_dup_CA_list() is a stub which returns NULL 2318 * and so DN names in cert request are not set here. 2319 * (A patch has been submitted to WolfSSL to correct this)*/ 2320 STACK_OF(X509_NAME) * const cert_names = s->ssl_ca_dn_file 2321 ? s->ssl_ca_dn_file 2322 : s->ssl_ca_file->names; 2323 SSL_CTX_set_client_CA_list(s->ssl_ctx, SSL_dup_CA_list(cert_names)); 2324 int mode = SSL_VERIFY_PEER; 2325 if (s->ssl_verifyclient_enforce) { 2326 mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; 2327 } 2328 SSL_CTX_set_verify(s->ssl_ctx, mode, verify_callback); 2329 SSL_CTX_set_verify_depth(s->ssl_ctx, s->ssl_verifyclient_depth + 1); 2330 if (!buffer_string_is_empty(s->ssl_ca_crl_file)) { 2331 X509_STORE *store = SSL_CTX_get_cert_store(s->ssl_ctx); 2332 if (!mod_openssl_load_cacrls(store, s->ssl_ca_crl_file, srv)) 2333 return -1; 2334 } 2335 } 2336 2337 if (1 != SSL_CTX_use_certificate_chain_file(s->ssl_ctx, 2338 s->pc->ssl_pemfile->ptr)) { 2339 log_error(srv->errh, __FILE__, __LINE__, 2340 "SSL: %s %s", ERR_error_string(ERR_get_error(), NULL), 2341 s->pc->ssl_pemfile->ptr); 2342 return -1; 2343 } 2344 2345 if (1 != SSL_CTX_use_PrivateKey(s->ssl_ctx, s->pc->ssl_pemfile_pkey)) { 2346 log_error(srv->errh, __FILE__, __LINE__, 2347 "SSL: %s %s %s", ERR_error_string(ERR_get_error(), NULL), 2348 s->pc->ssl_pemfile->ptr, s->pc->ssl_privkey->ptr); 2349 return -1; 2350 } 2351 2352 if (SSL_CTX_check_private_key(s->ssl_ctx) != 1) { 2353 log_error(srv->errh, __FILE__, __LINE__, 2354 "SSL: Private key does not match the certificate public key, " 2355 "reason: %s %s %s", ERR_error_string(ERR_get_error(), NULL), 2356 s->pc->ssl_pemfile->ptr, s->pc->ssl_privkey->ptr); 2357 return -1; 2358 } 2359 2360 #endif /* OPENSSL_VERSION_NUMBER < 0x10002000 */ 2361 2362 #if defined(BORINGSSL_API_VERSION) 2363 #define SSL_CTX_set_default_read_ahead(ctx,m) \ 2364 SSL_CTX_set_read_ahead(ctx,m) 2365 #endif 2366 SSL_CTX_set_default_read_ahead(s->ssl_ctx, s->ssl_read_ahead); 2367 SSL_CTX_set_mode(s->ssl_ctx, SSL_CTX_get_mode(s->ssl_ctx) 2368 | SSL_MODE_ENABLE_PARTIAL_WRITE 2369 | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER 2370 | SSL_MODE_RELEASE_BUFFERS); 2371 2372 #ifndef OPENSSL_NO_TLSEXT 2373 #ifdef SSL_CLIENT_HELLO_SUCCESS 2374 SSL_CTX_set_client_hello_cb(s->ssl_ctx,mod_openssl_client_hello_cb,srv); 2375 #else 2376 if (!SSL_CTX_set_tlsext_servername_callback( 2377 s->ssl_ctx, network_ssl_servername_callback) || 2378 !SSL_CTX_set_tlsext_servername_arg(s->ssl_ctx, srv)) { 2379 log_error(srv->errh, __FILE__, __LINE__, 2380 "SSL: failed to initialize TLS servername callback, " 2381 "openssl library does not support TLS servername extension"); 2382 return -1; 2383 } 2384 #endif 2385 2386 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation 2387 SSL_CTX_set_alpn_select_cb(s->ssl_ctx,mod_openssl_alpn_select_cb,NULL); 2388 #endif 2389 #endif 2390 2391 #if OPENSSL_VERSION_NUMBER >= 0x10100000L \ 2392 || defined(BORINGSSL_API_VERSION) \ 2393 || defined(LIBRESSL_VERSION_NUMBER) 2394 if (!s->ssl_use_sslv3 && !s->ssl_use_sslv2 2395 && !SSL_CTX_set_min_proto_version(s->ssl_ctx, TLS1_2_VERSION)) 2396 return -1; 2397 #endif 2398 2399 if (s->ssl_conf_cmd && s->ssl_conf_cmd->used) { 2400 if (0 != network_openssl_ssl_conf_cmd(srv, s)) return -1; 2401 } 2402 2403 return 0; 2404 } 2405 2406 2407 static int 2408 mod_openssl_set_defaults_sockets(server *srv, plugin_data *p) 2409 { 2410 static const config_plugin_keys_t cpk[] = { 2411 { CONST_STR_LEN("ssl.engine"), 2412 T_CONFIG_BOOL, 2413 T_CONFIG_SCOPE_CONNECTION } 2414 ,{ CONST_STR_LEN("ssl.cipher-list"), 2415 T_CONFIG_STRING, 2416 T_CONFIG_SCOPE_CONNECTION } 2417 ,{ CONST_STR_LEN("ssl.honor-cipher-order"), 2418 T_CONFIG_BOOL, 2419 T_CONFIG_SCOPE_CONNECTION } 2420 ,{ CONST_STR_LEN("ssl.dh-file"), 2421 T_CONFIG_STRING, 2422 T_CONFIG_SCOPE_CONNECTION } 2423 ,{ CONST_STR_LEN("ssl.ec-curve"), 2424 T_CONFIG_STRING, 2425 T_CONFIG_SCOPE_CONNECTION } 2426 ,{ CONST_STR_LEN("ssl.openssl.ssl-conf-cmd"), 2427 T_CONFIG_ARRAY_KVSTRING, 2428 T_CONFIG_SCOPE_CONNECTION } 2429 ,{ CONST_STR_LEN("ssl.pemfile"), /* included to process global scope */ 2430 T_CONFIG_STRING, 2431 T_CONFIG_SCOPE_CONNECTION } 2432 ,{ CONST_STR_LEN("ssl.empty-fragments"), 2433 T_CONFIG_BOOL, 2434 T_CONFIG_SCOPE_CONNECTION } 2435 ,{ CONST_STR_LEN("ssl.use-sslv2"), 2436 T_CONFIG_BOOL, 2437 T_CONFIG_SCOPE_CONNECTION } 2438 ,{ CONST_STR_LEN("ssl.use-sslv3"), 2439 T_CONFIG_BOOL, 2440 T_CONFIG_SCOPE_CONNECTION } 2441 ,{ CONST_STR_LEN("ssl.stek-file"), 2442 T_CONFIG_STRING, 2443 T_CONFIG_SCOPE_SERVER } 2444 ,{ NULL, 0, 2445 T_CONFIG_UNSET, 2446 T_CONFIG_SCOPE_UNSET } 2447 }; 2448 static const buffer default_ssl_cipher_list = { CONST_STR_LEN("HIGH"), 0 }; 2449 2450 p->ssl_ctxs = calloc(srv->config_context->used, sizeof(plugin_ssl_ctx)); 2451 force_assert(p->ssl_ctxs); 2452 2453 int rc = HANDLER_GO_ON; 2454 plugin_data_base srvplug; 2455 memset(&srvplug, 0, sizeof(srvplug)); 2456 plugin_data_base * const ps = &srvplug; 2457 if (!config_plugin_values_init(srv, ps, cpk, "mod_openssl")) 2458 return HANDLER_ERROR; 2459 2460 plugin_config_socket defaults; 2461 memset(&defaults, 0, sizeof(defaults)); 2462 defaults.ssl_honor_cipher_order = 1; 2463 defaults.ssl_cipher_list = &default_ssl_cipher_list; 2464 2465 /* process and validate config directives for global and $SERVER["socket"] 2466 * (init i to 0 if global context; to 1 to skip empty global context) */ 2467 for (int i = !ps->cvlist[0].v.u2[1]; i < ps->nconfig; ++i) { 2468 config_cond_info cfginfo; 2469 config_get_config_cond_info(&cfginfo, (uint32_t)ps->cvlist[i].k_id); 2470 int is_socket_scope = (0 == i || cfginfo.comp == COMP_SERVER_SOCKET); 2471 int count_not_engine = 0; 2472 2473 plugin_config_socket conf; 2474 memcpy(&conf, &defaults, sizeof(conf)); 2475 2476 /*(preserve prior behavior; not inherited)*/ 2477 /*(forcing inheritance might break existing configs where SSL is enabled 2478 * by default in the global scope, but not $SERVER["socket"]=="*:80") */ 2479 conf.ssl_enabled = 0; 2480 2481 config_plugin_value_t *cpv = ps->cvlist + ps->cvlist[i].v.u2[0]; 2482 for (; -1 != cpv->k_id; ++cpv) { 2483 /* ignore ssl.pemfile (k_id=6); included to process global scope */ 2484 if (!is_socket_scope && cpv->k_id != 6) { 2485 log_error(srv->errh, __FILE__, __LINE__, 2486 "%s is valid only in global scope or " 2487 "$SERVER[\"socket\"] condition", cpk[cpv->k_id].k); 2488 continue; 2489 } 2490 ++count_not_engine; 2491 switch (cpv->k_id) { 2492 case 0: /* ssl.engine */ 2493 conf.ssl_enabled = (0 != cpv->v.u); 2494 --count_not_engine; 2495 break; 2496 case 1: /* ssl.cipher-list */ 2497 conf.ssl_cipher_list = cpv->v.b; 2498 break; 2499 case 2: /* ssl.honor-cipher-order */ 2500 conf.ssl_honor_cipher_order = (0 != cpv->v.u); 2501 break; 2502 case 3: /* ssl.dh-file */ 2503 conf.ssl_dh_file = cpv->v.b; 2504 break; 2505 case 4: /* ssl.ec-curve */ 2506 conf.ssl_ec_curve = cpv->v.b; 2507 break; 2508 case 5: /* ssl.openssl.ssl-conf-cmd */ 2509 *(const array **)&conf.ssl_conf_cmd = cpv->v.a; 2510 break; 2511 case 6: /* ssl.pemfile */ 2512 /* ignore here; included to process global scope when 2513 * ssl.pemfile is set, but ssl.engine is not "enable" */ 2514 break; 2515 case 7: /* ssl.empty-fragments */ 2516 conf.ssl_empty_fragments = (0 != cpv->v.u); 2517 log_error(srv->errh, __FILE__, __LINE__, "SSL: " 2518 "ssl.empty-fragments is deprecated and will soon be " 2519 "removed. It is disabled by default."); 2520 if (conf.ssl_empty_fragments) 2521 log_error(srv->errh, __FILE__, __LINE__, "SSL: " 2522 "If needed, use: ssl.openssl.ssl-conf-cmd = " 2523 "(\"Options\" => \"EmptyFragments\")"); 2524 log_error(srv->errh, __FILE__, __LINE__, "SSL: " 2525 "ssl.empty-fragments is a " 2526 "counter-measure against a SSL 3.0/TLS 1.0 protocol " 2527 "vulnerability affecting CBC ciphers, which cannot be handled" 2528 " by some broken (Microsoft) SSL implementations."); 2529 break; 2530 case 8: /* ssl.use-sslv2 */ 2531 conf.ssl_use_sslv2 = (0 != cpv->v.u); 2532 log_error(srv->errh, __FILE__, __LINE__, "SSL: " 2533 "ssl.use-sslv2 is deprecated and will soon be removed. " 2534 "It is disabled by default. " 2535 "Many modern TLS libraries no longer support SSLv2."); 2536 break; 2537 case 9: /* ssl.use-sslv3 */ 2538 conf.ssl_use_sslv3 = (0 != cpv->v.u); 2539 log_error(srv->errh, __FILE__, __LINE__, "SSL: " 2540 "ssl.use-sslv3 is deprecated and will soon be removed. " 2541 "It is disabled by default. " 2542 "Many modern TLS libraries no longer support SSLv3."); 2543 if (conf.ssl_use_sslv3) 2544 log_error(srv->errh, __FILE__, __LINE__, "SSL: " 2545 "If needed, use: ssl.openssl.ssl-conf-cmd = " 2546 "(\"MinProtocol\" => \"SSLv3\")"); 2547 break; 2548 case 10:/* ssl.stek-file */ 2549 if (!buffer_is_empty(cpv->v.b)) 2550 p->ssl_stek_file = cpv->v.b->ptr; 2551 break; 2552 default:/* should not happen */ 2553 break; 2554 } 2555 } 2556 if (HANDLER_GO_ON != rc) break; 2557 if (0 == i) memcpy(&defaults, &conf, sizeof(conf)); 2558 2559 if (0 != i && !conf.ssl_enabled) continue; 2560 2561 /* fill plugin_config_socket with global context then $SERVER["socket"] 2562 * only for directives directly in current $SERVER["socket"] condition*/ 2563 2564 /*conf.pc = p->defaults.pc;*/ 2565 conf.ssl_ca_file = p->defaults.ssl_ca_file; 2566 conf.ssl_ca_dn_file = p->defaults.ssl_ca_dn_file; 2567 conf.ssl_ca_crl_file = p->defaults.ssl_ca_crl_file; 2568 conf.ssl_verifyclient = p->defaults.ssl_verifyclient; 2569 conf.ssl_verifyclient_enforce = p->defaults.ssl_verifyclient_enforce; 2570 conf.ssl_verifyclient_depth = p->defaults.ssl_verifyclient_depth; 2571 conf.ssl_read_ahead = p->defaults.ssl_read_ahead; 2572 2573 int sidx = ps->cvlist[i].k_id; 2574 for (int j = !p->cvlist[0].v.u2[1]; j < p->nconfig; ++j) { 2575 if (p->cvlist[j].k_id != sidx) continue; 2576 /*if (0 == sidx) break;*//*(repeat to get ssl_pemfile,ssl_privkey)*/ 2577 cpv = p->cvlist + p->cvlist[j].v.u2[0]; 2578 for (; -1 != cpv->k_id; ++cpv) { 2579 ++count_not_engine; 2580 switch (cpv->k_id) { 2581 case 0: /* ssl.pemfile */ 2582 if (cpv->vtype == T_CONFIG_LOCAL) 2583 conf.pc = cpv->v.v; 2584 break; 2585 case 2: /* ssl.ca-file */ 2586 if (cpv->vtype == T_CONFIG_LOCAL) 2587 conf.ssl_ca_file = cpv->v.v; 2588 break; 2589 case 3: /* ssl.ca-dn-file */ 2590 if (cpv->vtype == T_CONFIG_LOCAL) 2591 conf.ssl_ca_dn_file = cpv->v.v; 2592 break; 2593 case 4: /* ssl.ca-crl-file */ 2594 conf.ssl_ca_crl_file = cpv->v.b; 2595 break; 2596 case 5: /* ssl.read-ahead */ 2597 conf.ssl_read_ahead = (0 != cpv->v.u); 2598 break; 2599 case 6: /* ssl.disable-client-renegotiation */ 2600 conf.ssl_disable_client_renegotiation = (0 != cpv->v.u); 2601 break; 2602 case 7: /* ssl.verifyclient.activate */ 2603 conf.ssl_verifyclient = (0 != cpv->v.u); 2604 break; 2605 case 8: /* ssl.verifyclient.enforce */ 2606 conf.ssl_verifyclient_enforce = (0 != cpv->v.u); 2607 break; 2608 case 9: /* ssl.verifyclient.depth */ 2609 conf.ssl_verifyclient_depth = (unsigned char)cpv->v.shrt; 2610 break; 2611 #if 0 /*(cpk->k_id remapped in mod_openssl_set_defaults())*/ 2612 case 15:/* ssl.verifyclient.ca-file */ 2613 case 16:/* ssl.verifyclient.ca-dn-file */ 2614 case 17:/* ssl.verifyclient.ca-crl-file */ 2615 #endif 2616 default: 2617 break; 2618 } 2619 } 2620 break; 2621 } 2622 2623 if (NULL == conf.pc) { 2624 if (0 == i && !conf.ssl_enabled) continue; 2625 if (0 != i) { 2626 /* inherit ssl settings from global scope 2627 * (if only ssl.engine = "enable" and no other ssl.* settings) 2628 * (This is for convenience when defining both IPv4 and IPv6 2629 * and desiring to inherit the ssl config from global context 2630 * without having to duplicate the directives)*/ 2631 if (count_not_engine 2632 || (conf.ssl_enabled && NULL == p->ssl_ctxs[0].ssl_ctx)) { 2633 log_error(srv->errh, __FILE__, __LINE__, 2634 "ssl.pemfile has to be set in same $SERVER[\"socket\"] scope " 2635 "as other ssl.* directives, unless only ssl.engine is set, " 2636 "inheriting ssl.* from global scope"); 2637 rc = HANDLER_ERROR; 2638 continue; 2639 } 2640 plugin_ssl_ctx * const s = p->ssl_ctxs + sidx; 2641 *s = *p->ssl_ctxs;/*(copy struct of ssl_ctx from global scope)*/ 2642 continue; 2643 } 2644 /* PEM file is required */ 2645 log_error(srv->errh, __FILE__, __LINE__, 2646 "ssl.pemfile has to be set when ssl.engine = \"enable\""); 2647 rc = HANDLER_ERROR; 2648 continue; 2649 } 2650 2651 /* configure ssl_ctx for socket */ 2652 2653 /*conf.ssl_ctx = NULL;*//*(filled by network_init_ssl() even on error)*/ 2654 if (0 == network_init_ssl(srv, &conf, p)) { 2655 plugin_ssl_ctx * const s = p->ssl_ctxs + sidx; 2656 s->ssl_ctx = conf.ssl_ctx; 2657 } 2658 else { 2659 SSL_CTX_free(conf.ssl_ctx); 2660 rc = HANDLER_ERROR; 2661 } 2662 } 2663 2664 #ifdef TLSEXT_TYPE_session_ticket 2665 if (rc == HANDLER_GO_ON && ssl_is_init) 2666 mod_openssl_session_ticket_key_check(p, log_epoch_secs); 2667 #endif 2668 2669 free(srvplug.cvlist); 2670 return rc; 2671 } 2672 2673 2674 SETDEFAULTS_FUNC(mod_openssl_set_defaults) 2675 { 2676 static const config_plugin_keys_t cpk[] = { 2677 { CONST_STR_LEN("ssl.pemfile"), 2678 T_CONFIG_STRING, 2679 T_CONFIG_SCOPE_CONNECTION } 2680 ,{ CONST_STR_LEN("ssl.privkey"), 2681 T_CONFIG_STRING, 2682 T_CONFIG_SCOPE_CONNECTION } 2683 ,{ CONST_STR_LEN("ssl.ca-file"), 2684 T_CONFIG_STRING, 2685 T_CONFIG_SCOPE_CONNECTION } 2686 ,{ CONST_STR_LEN("ssl.ca-dn-file"), 2687 T_CONFIG_STRING, 2688 T_CONFIG_SCOPE_CONNECTION } 2689 ,{ CONST_STR_LEN("ssl.ca-crl-file"), 2690 T_CONFIG_STRING, 2691 T_CONFIG_SCOPE_CONNECTION } 2692 ,{ CONST_STR_LEN("ssl.read-ahead"), 2693 T_CONFIG_BOOL, 2694 T_CONFIG_SCOPE_CONNECTION } 2695 ,{ CONST_STR_LEN("ssl.disable-client-renegotiation"), 2696 T_CONFIG_BOOL, 2697 T_CONFIG_SCOPE_CONNECTION } 2698 ,{ CONST_STR_LEN("ssl.verifyclient.activate"), 2699 T_CONFIG_BOOL, 2700 T_CONFIG_SCOPE_CONNECTION } 2701 ,{ CONST_STR_LEN("ssl.verifyclient.enforce"), 2702 T_CONFIG_BOOL, 2703 T_CONFIG_SCOPE_CONNECTION } 2704 ,{ CONST_STR_LEN("ssl.verifyclient.depth"), 2705 T_CONFIG_SHORT, 2706 T_CONFIG_SCOPE_CONNECTION } 2707 ,{ CONST_STR_LEN("ssl.verifyclient.username"), 2708 T_CONFIG_STRING, 2709 T_CONFIG_SCOPE_CONNECTION } 2710 ,{ CONST_STR_LEN("ssl.verifyclient.exportcert"), 2711 T_CONFIG_BOOL, 2712 T_CONFIG_SCOPE_CONNECTION } 2713 ,{ CONST_STR_LEN("ssl.acme-tls-1"), 2714 T_CONFIG_STRING, 2715 T_CONFIG_SCOPE_CONNECTION } 2716 ,{ CONST_STR_LEN("ssl.stapling-file"), 2717 T_CONFIG_STRING, 2718 T_CONFIG_SCOPE_CONNECTION } 2719 ,{ CONST_STR_LEN("debug.log-ssl-noise"), 2720 T_CONFIG_BOOL, 2721 T_CONFIG_SCOPE_CONNECTION } 2722 ,{ CONST_STR_LEN("ssl.verifyclient.ca-file"), 2723 T_CONFIG_STRING, 2724 T_CONFIG_SCOPE_CONNECTION } 2725 ,{ CONST_STR_LEN("ssl.verifyclient.ca-dn-file"), 2726 T_CONFIG_STRING, 2727 T_CONFIG_SCOPE_CONNECTION } 2728 ,{ CONST_STR_LEN("ssl.verifyclient.ca-crl-file"), 2729 T_CONFIG_STRING, 2730 T_CONFIG_SCOPE_CONNECTION } 2731 ,{ NULL, 0, 2732 T_CONFIG_UNSET, 2733 T_CONFIG_SCOPE_UNSET } 2734 }; 2735 2736 plugin_data * const p = p_d; 2737 p->srv = srv; 2738 p->cafiles = array_init(0); 2739 if (!config_plugin_values_init(srv, p, cpk, "mod_openssl")) 2740 return HANDLER_ERROR; 2741 2742 const buffer *default_ssl_ca_crl_file = NULL; 2743 2744 /* process and validate config directives 2745 * (init i to 0 if global context; to 1 to skip empty global context) */ 2746 for (int i = !p->cvlist[0].v.u2[1]; i < p->nconfig; ++i) { 2747 config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0]; 2748 config_plugin_value_t *pemfile = NULL; 2749 config_plugin_value_t *privkey = NULL; 2750 const buffer *ssl_stapling_file = NULL; 2751 const buffer *ssl_ca_file = NULL; 2752 const buffer *ssl_ca_dn_file = NULL; 2753 const buffer *ssl_ca_crl_file = NULL; 2754 X509_STORE *ca_store = NULL; 2755 for (; -1 != cpv->k_id; ++cpv) { 2756 switch (cpv->k_id) { 2757 case 0: /* ssl.pemfile */ 2758 if (!buffer_string_is_empty(cpv->v.b)) pemfile = cpv; 2759 break; 2760 case 1: /* ssl.privkey */ 2761 if (!buffer_string_is_empty(cpv->v.b)) privkey = cpv; 2762 break; 2763 case 15:/* ssl.verifyclient.ca-file */ 2764 cpv->k_id = 2; 2765 __attribute_fallthrough__ 2766 case 2: /* ssl.ca-file */ 2767 if (buffer_string_is_empty(cpv->v.b)) break; 2768 if (!mod_openssl_init_once_openssl(srv)) return HANDLER_ERROR; 2769 ssl_ca_file = cpv->v.b; 2770 cpv->v.v = mod_openssl_load_cacerts(ssl_ca_file, srv->errh); 2771 if (NULL != cpv->v.v) { 2772 cpv->vtype = T_CONFIG_LOCAL; 2773 ca_store = ((plugin_cacerts *)cpv->v.v)->certs; 2774 } 2775 else { 2776 log_error(srv->errh, __FILE__, __LINE__, "SSL: %s %s", 2777 ERR_error_string(ERR_get_error(), NULL), 2778 ssl_ca_file->ptr); 2779 return HANDLER_ERROR; 2780 } 2781 break; 2782 case 16:/* ssl.verifyclient.ca-dn-file */ 2783 cpv->k_id = 3; 2784 __attribute_fallthrough__ 2785 case 3: /* ssl.ca-dn-file */ 2786 if (buffer_string_is_empty(cpv->v.b)) break; 2787 if (!mod_openssl_init_once_openssl(srv)) return HANDLER_ERROR; 2788 ssl_ca_dn_file = cpv->v.b; 2789 cpv->v.v = SSL_load_client_CA_file(ssl_ca_dn_file->ptr); 2790 if (NULL != cpv->v.v) { 2791 cpv->vtype = T_CONFIG_LOCAL; 2792 } 2793 else { 2794 log_error(srv->errh, __FILE__, __LINE__, "SSL: %s %s", 2795 ERR_error_string(ERR_get_error(), NULL), 2796 ssl_ca_dn_file->ptr); 2797 return HANDLER_ERROR; 2798 } 2799 break; 2800 case 17:/* ssl.verifyclient.ca-crl-file */ 2801 cpv->k_id = 4; 2802 __attribute_fallthrough__ 2803 case 4: /* ssl.ca-crl-file */ 2804 if (buffer_string_is_empty(cpv->v.b)) break; 2805 ssl_ca_crl_file = cpv->v.b; 2806 if (0 == i) default_ssl_ca_crl_file = cpv->v.b; 2807 break; 2808 case 5: /* ssl.read-ahead */ 2809 case 6: /* ssl.disable-client-renegotiation */ 2810 case 7: /* ssl.verifyclient.activate */ 2811 case 8: /* ssl.verifyclient.enforce */ 2812 break; 2813 case 9: /* ssl.verifyclient.depth */ 2814 if (cpv->v.shrt > 255) { 2815 log_error(srv->errh, __FILE__, __LINE__, 2816 "%s is absurdly large (%hu); limiting to 255", 2817 cpk[cpv->k_id].k, cpv->v.shrt); 2818 cpv->v.shrt = 255; 2819 } 2820 break; 2821 case 10:/* ssl.verifyclient.username */ 2822 case 11:/* ssl.verifyclient.exportcert */ 2823 case 12:/* ssl.acme-tls-1 */ 2824 break; 2825 case 13:/* ssl.stapling-file */ 2826 ssl_stapling_file = cpv->v.b; 2827 break; 2828 case 14:/* debug.log-ssl-noise */ 2829 #if 0 /*(handled further above)*/ 2830 case 15:/* ssl.verifyclient.ca-file */ 2831 case 16:/* ssl.verifyclient.ca-dn-file */ 2832 case 17:/* ssl.verifyclient.ca-crl-file */ 2833 #endif 2834 break; 2835 default:/* should not happen */ 2836 break; 2837 } 2838 } 2839 2840 #if OPENSSL_VERSION_NUMBER < 0x10002000 /* p->cafiles for legacy only */ \ 2841 || defined(LIBRESSL_VERSION_NUMBER) 2842 /* load all ssl.ca-files into a single chain */ 2843 /*(certificate load order might matter)*/ 2844 if (ssl_ca_dn_file) 2845 array_insert_value(p->cafiles, CONST_BUF_LEN(ssl_ca_dn_file)); 2846 if (ssl_ca_file) 2847 array_insert_value(p->cafiles, CONST_BUF_LEN(ssl_ca_file)); 2848 UNUSED(ca_store); 2849 UNUSED(ssl_ca_crl_file); 2850 UNUSED(default_ssl_ca_crl_file); 2851 #else 2852 if (NULL == ca_store && ssl_ca_crl_file && i != 0) { 2853 log_error(srv->errh, __FILE__, __LINE__, 2854 "ssl.verifyclient.ca-crl-file (%s) ignored unless issued with " 2855 "ssl.verifyclient.ca-file", ssl_ca_crl_file->ptr); 2856 } 2857 else if (ca_store && (ssl_ca_crl_file || default_ssl_ca_crl_file)) { 2858 /* prior behavior in lighttpd allowed ssl.ca-crl-file only in global 2859 * scope or $SERVER["socket"], so this inheritence from global scope 2860 * is reasonable. This code does not implement inheritance of 2861 * ssl.ca-crl-file from $SERVER["socket"] into nested $HTTP["host"], 2862 * but the solution is to repeat ssl.ca-crl-file where ssl.ca-file 2863 * is issued (and to not unnecessarily repeat ssl.ca-file) 2864 * Alternative: write code to load ssl.ca-crl-file into (X509_CRL *) 2865 * using PEM_read_bio_X509_CRL() and in mod_openssl_cert_cb(), 2866 * create a new (X509_STORE *) which merges with CA (X509_STORE *) 2867 * using X509_STORE_add_cert() and X509_STORE_add_crl(), and keeps 2868 * the result in our (plugin_cert *) for reuse */ 2869 if (NULL == ssl_ca_crl_file) 2870 ssl_ca_crl_file = default_ssl_ca_crl_file; 2871 if (!mod_openssl_load_cacrls(ca_store, ssl_ca_crl_file, srv)) 2872 return HANDLER_ERROR; 2873 } 2874 #endif 2875 2876 if (pemfile) { 2877 #ifdef OPENSSL_NO_TLSEXT 2878 config_cond_info cfginfo; 2879 uint32_t j = (uint32_t)p->cvlist[i].k_id; 2880 config_get_config_cond_info(&cfginfo, j); 2881 if (j > 0 && (COMP_SERVER_SOCKET != cfginfo.comp 2882 || cfginfo.cond != CONFIG_COND_EQ)) { 2883 if (COMP_HTTP_HOST == cfginfo.comp) 2884 log_error(srv->errh, __FILE__, __LINE__, "SSL:" 2885 "can't use ssl.pemfile with $HTTP[\"host\"], " 2886 "as openssl version does not support TLS extensions"); 2887 else 2888 log_error(srv->errh, __FILE__, __LINE__, "SSL:" 2889 "ssl.pemfile only works in SSL socket binding context " 2890 "as openssl version does not support TLS extensions"); 2891 return HANDLER_ERROR; 2892 } 2893 #endif 2894 if (NULL == privkey) privkey = pemfile; 2895 pemfile->v.v = 2896 network_openssl_load_pemfile(srv, pemfile->v.b, privkey->v.b, 2897 ssl_stapling_file); 2898 if (pemfile->v.v) 2899 pemfile->vtype = T_CONFIG_LOCAL; 2900 else 2901 return HANDLER_ERROR; 2902 } 2903 } 2904 2905 p->defaults.ssl_verifyclient = 0; 2906 p->defaults.ssl_verifyclient_enforce = 1; 2907 p->defaults.ssl_verifyclient_depth = 9; 2908 p->defaults.ssl_verifyclient_export_cert = 0; 2909 p->defaults.ssl_disable_client_renegotiation = 1; 2910 p->defaults.ssl_read_ahead = 0; 2911 2912 /* initialize p->defaults from global config context */ 2913 if (p->nconfig > 0 && p->cvlist->v.u2[1]) { 2914 const config_plugin_value_t *cpv = p->cvlist + p->cvlist->v.u2[0]; 2915 if (-1 != cpv->k_id) 2916 mod_openssl_merge_config(&p->defaults, cpv); 2917 } 2918 2919 #if OPENSSL_VERSION_NUMBER < 0x10101000L \ 2920 && !defined(LIBRESSL_VERSION_NUMBER) 2921 log_error(srv->errh, __FILE__, __LINE__, "SSL:" 2922 "openssl library version is outdated and has reached end-of-life. " 2923 "As of 1 Jan 2020, only openssl 1.1.1 and later continue to receive " 2924 "security patches from openssl.org"); 2925 #endif 2926 2927 return mod_openssl_set_defaults_sockets(srv, p); 2928 } 2929 2930 2931 /* local_send_buffer is a static buffer of size (LOCAL_SEND_BUFSIZE) 2932 * 2933 * it has to stay at the same location all the time to satisfy the needs 2934 * of SSL_write to pass the SAME parameter in case of a _WANT_WRITE 2935 * 2936 * buffer is allocated once, is NOT realloced (note: not thread-safe) 2937 * 2938 * (Note: above restriction no longer true since SSL_CTX_set_mode() is 2939 * called with SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER) 2940 * */ 2941 2942 /* copy small mem chunks into single large buffer before SSL_write() 2943 * to reduce number times write() called underneath SSL_write() and 2944 * potentially reduce number of packets generated if TCP_NODELAY */ 2945 2946 2947 static int 2948 mod_openssl_close_notify(handler_ctx *hctx); 2949 2950 2951 static int 2952 connection_write_cq_ssl (connection *con, chunkqueue *cq, off_t max_bytes) 2953 { 2954 handler_ctx *hctx = con->plugin_ctx[plugin_data_singleton->id]; 2955 SSL *ssl = hctx->ssl; 2956 log_error_st * const errh = hctx->errh; 2957 2958 if (0 != hctx->close_notify) return mod_openssl_close_notify(hctx); 2959 2960 chunkqueue_remove_finished_chunks(cq); 2961 2962 while (max_bytes > 0 && !chunkqueue_is_empty(cq)) { 2963 char *data = local_send_buffer; 2964 uint32_t data_len = LOCAL_SEND_BUFSIZE < max_bytes 2965 ? LOCAL_SEND_BUFSIZE 2966 : (uint32_t)max_bytes; 2967 int wr; 2968 2969 if (0 != chunkqueue_peek_data(cq, &data, &data_len, errh)) return -1; 2970 2971 /** 2972 * SSL_write man-page 2973 * 2974 * WARNING 2975 * When an SSL_write() operation has to be repeated because of 2976 * SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE, it must be 2977 * repeated with the same arguments. 2978 */ 2979 2980 ERR_clear_error(); 2981 wr = SSL_write(ssl, data, data_len); 2982 2983 if (hctx->renegotiations > 1 2984 && hctx->conf.ssl_disable_client_renegotiation) { 2985 log_error(errh, __FILE__, __LINE__, 2986 "SSL: renegotiation initiated by client, killing connection"); 2987 return -1; 2988 } 2989 2990 if (wr <= 0) { 2991 int ssl_r; 2992 unsigned long err; 2993 2994 switch ((ssl_r = SSL_get_error(ssl, wr))) { 2995 case SSL_ERROR_WANT_READ: 2996 con->is_readable = -1; 2997 return 0; /* try again later */ 2998 case SSL_ERROR_WANT_WRITE: 2999 con->is_writable = -1; 3000 return 0; /* try again later */ 3001 case SSL_ERROR_SYSCALL: 3002 /* perhaps we have error waiting in our error-queue */ 3003 if (0 != (err = ERR_get_error())) { 3004 do { 3005 log_error(errh, __FILE__, __LINE__, 3006 "SSL: %d %d %s",ssl_r,wr,ERR_error_string(err,NULL)); 3007 } while((err = ERR_get_error())); 3008 } else if (wr == -1) { 3009 /* no, but we have errno */ 3010 switch(errno) { 3011 case EPIPE: 3012 case ECONNRESET: 3013 return -2; 3014 default: 3015 log_perror(errh, __FILE__, __LINE__, 3016 "SSL: %d %d", ssl_r, wr); 3017 break; 3018 } 3019 } else { 3020 /* neither error-queue nor errno ? */ 3021 log_perror(errh, __FILE__, __LINE__, 3022 "SSL (error): %d %d", ssl_r, wr); 3023 } 3024 break; 3025 3026 case SSL_ERROR_ZERO_RETURN: 3027 /* clean shutdown on the remote side */ 3028 3029 if (wr == 0) return -2; 3030 3031 __attribute_fallthrough__ 3032 default: 3033 while((err = ERR_get_error())) { 3034 log_error(errh, __FILE__, __LINE__, 3035 "SSL: %d %d %s", ssl_r, wr, ERR_error_string(err, NULL)); 3036 } 3037 break; 3038 } 3039 return -1; 3040 } 3041 3042 chunkqueue_mark_written(cq, wr); 3043 max_bytes -= wr; 3044 3045 if ((size_t) wr < data_len) break; /* try again later */ 3046 } 3047 3048 return 0; 3049 } 3050 3051 3052 static int 3053 connection_read_cq_ssl (connection *con, chunkqueue *cq, off_t max_bytes) 3054 { 3055 handler_ctx *hctx = con->plugin_ctx[plugin_data_singleton->id]; 3056 int len; 3057 char *mem = NULL; 3058 size_t mem_len = 0; 3059 3060 UNUSED(max_bytes); 3061 3062 if (0 != hctx->close_notify) return mod_openssl_close_notify(hctx); 3063 3064 ERR_clear_error(); 3065 do { 3066 len = SSL_pending(hctx->ssl); 3067 mem_len = len < 2048 ? 2048 : (size_t)len; 3068 chunk * const ckpt = cq->last; 3069 mem = chunkqueue_get_memory(cq, &mem_len); 3070 3071 len = SSL_read(hctx->ssl, mem, mem_len); 3072 if (len > 0) { 3073 chunkqueue_use_memory(cq, ckpt, len); 3074 con->bytes_read += len; 3075 } else { 3076 chunkqueue_use_memory(cq, ckpt, 0); 3077 } 3078 3079 if (hctx->renegotiations > 1 3080 && hctx->conf.ssl_disable_client_renegotiation) { 3081 log_error(hctx->errh, __FILE__, __LINE__, 3082 "SSL: renegotiation initiated by client, killing connection"); 3083 return -1; 3084 } 3085 3086 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation 3087 if (hctx->alpn) { 3088 if (hctx->alpn == MOD_OPENSSL_ALPN_ACME_TLS_1) { 3089 chunkqueue_reset(cq); 3090 /* initiate handshake in order to send ServerHello. 3091 * Once TLS handshake is complete, return -1 to result in 3092 * CON_STATE_ERROR so that socket connection is quickly closed*/ 3093 if (1 == SSL_do_handshake(hctx->ssl)) return -1; 3094 len = -1; 3095 break; 3096 } 3097 hctx->alpn = 0; 3098 } 3099 #endif 3100 } while (len > 0 3101 && (hctx->conf.ssl_read_ahead || SSL_pending(hctx->ssl) > 0)); 3102 3103 if (len < 0) { 3104 int oerrno = errno; 3105 int rc, ssl_err; 3106 switch ((rc = SSL_get_error(hctx->ssl, len))) { 3107 case SSL_ERROR_WANT_WRITE: 3108 con->is_writable = -1; 3109 __attribute_fallthrough__ 3110 case SSL_ERROR_WANT_READ: 3111 con->is_readable = 0; 3112 3113 /* the manual says we have to call SSL_read with the same arguments 3114 * next time. we ignore this restriction; no one has complained 3115 * about it in 1.5 yet, so it probably works anyway. 3116 */ 3117 3118 return 0; 3119 case SSL_ERROR_SYSCALL: 3120 /** 3121 * man SSL_get_error() 3122 * 3123 * SSL_ERROR_SYSCALL 3124 * Some I/O error occurred. The OpenSSL error queue may contain 3125 * more information on the error. If the error queue is empty 3126 * (i.e. ERR_get_error() returns 0), ret can be used to find out 3127 * more about the error: If ret == 0, an EOF was observed that 3128 * violates the protocol. If ret == -1, the underlying BIO 3129 * reported an I/O error (for socket I/O on Unix systems, consult 3130 * errno for details). 3131 * 3132 */ 3133 while((ssl_err = ERR_get_error())) { 3134 /* get all errors from the error-queue */ 3135 log_error(hctx->errh, __FILE__, __LINE__, 3136 "SSL: %d %s", rc, ERR_error_string(ssl_err, NULL)); 3137 } 3138 3139 switch(oerrno) { 3140 case ECONNRESET: 3141 if (!hctx->conf.ssl_log_noise) break; 3142 __attribute_fallthrough__ 3143 default: 3144 /* (oerrno should be something like ECONNABORTED not 0 3145 * if client disconnected before anything was sent 3146 * (e.g. TCP connection probe), but it does not appear 3147 * that openssl provides such notification, not even 3148 * something like SSL_R_SSL_HANDSHAKE_FAILURE) */ 3149 if (0==oerrno && 0==cq->bytes_in && !hctx->conf.ssl_log_noise) 3150 break; 3151 3152 log_error(hctx->errh, __FILE__, __LINE__, 3153 "SSL: %d %d %d %s", len, rc, oerrno, strerror(oerrno)); 3154 break; 3155 } 3156 3157 break; 3158 case SSL_ERROR_ZERO_RETURN: 3159 /* clean shutdown on the remote side */ 3160 3161 if (rc == 0) { 3162 /* FIXME: later */ 3163 } 3164 3165 __attribute_fallthrough__ 3166 default: 3167 while((ssl_err = ERR_get_error())) { 3168 switch (ERR_GET_REASON(ssl_err)) { 3169 case SSL_R_SSL_HANDSHAKE_FAILURE: 3170 #ifdef SSL_R_UNEXPECTED_EOF_WHILE_READING 3171 case SSL_R_UNEXPECTED_EOF_WHILE_READING: 3172 #endif 3173 #ifdef SSL_R_TLSV1_ALERT_UNKNOWN_CA 3174 case SSL_R_TLSV1_ALERT_UNKNOWN_CA: 3175 #endif 3176 #ifdef SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN 3177 case SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN: 3178 #endif 3179 #ifdef SSL_R_SSLV3_ALERT_BAD_CERTIFICATE 3180 case SSL_R_SSLV3_ALERT_BAD_CERTIFICATE: 3181 #endif 3182 if (!hctx->conf.ssl_log_noise) continue; 3183 break; 3184 default: 3185 break; 3186 } 3187 /* get all errors from the error-queue */ 3188 log_error(hctx->errh, __FILE__, __LINE__, 3189 "SSL: %d %s", rc, ERR_error_string(ssl_err, NULL)); 3190 } 3191 break; 3192 } 3193 return -1; 3194 } else if (len == 0) { 3195 con->is_readable = 0; 3196 /* the other end close the connection -> KEEP-ALIVE */ 3197 3198 return -2; 3199 } else { 3200 return 0; 3201 } 3202 } 3203 3204 3205 CONNECTION_FUNC(mod_openssl_handle_con_accept) 3206 { 3207 server_socket *srv_sock = con->srv_socket; 3208 if (!srv_sock->is_ssl) return HANDLER_GO_ON; 3209 3210 plugin_data *p = p_d; 3211 handler_ctx * const hctx = handler_ctx_init(); 3212 request_st * const r = &con->request; 3213 hctx->r = r; 3214 hctx->con = con; 3215 hctx->tmp_buf = con->srv->tmp_buf; 3216 hctx->errh = r->conf.errh; 3217 con->plugin_ctx[p->id] = hctx; 3218 buffer_string_set_length(&r->uri.authority, 0); 3219 3220 plugin_ssl_ctx * const s = p->ssl_ctxs + srv_sock->sidx; 3221 hctx->ssl = SSL_new(s->ssl_ctx); 3222 if (NULL != hctx->ssl 3223 && SSL_set_app_data(hctx->ssl, hctx) 3224 && SSL_set_fd(hctx->ssl, con->fd)) { 3225 SSL_set_accept_state(hctx->ssl); 3226 con->network_read = connection_read_cq_ssl; 3227 con->network_write = connection_write_cq_ssl; 3228 con->proto_default_port = 443; /* "https" */ 3229 mod_openssl_patch_config(r, &hctx->conf); 3230 return HANDLER_GO_ON; 3231 } 3232 else { 3233 log_error(r->conf.errh, __FILE__, __LINE__, 3234 "SSL: %s", ERR_error_string(ERR_get_error(), NULL)); 3235 return HANDLER_ERROR; 3236 } 3237 } 3238 3239 3240 static void 3241 mod_openssl_detach(handler_ctx *hctx) 3242 { 3243 /* step aside from further SSL processing 3244 * (used after handle_connection_shut_wr hook) */ 3245 /* future: might restore prior network_read and network_write fn ptrs */ 3246 hctx->con->is_ssl_sock = 0; 3247 /* if called after handle_connection_shut_wr hook, shutdown SHUT_WR */ 3248 if (-1 == hctx->close_notify) shutdown(hctx->con->fd, SHUT_WR); 3249 hctx->close_notify = 1; 3250 } 3251 3252 3253 CONNECTION_FUNC(mod_openssl_handle_con_shut_wr) 3254 { 3255 plugin_data *p = p_d; 3256 handler_ctx *hctx = con->plugin_ctx[p->id]; 3257 if (NULL == hctx) return HANDLER_GO_ON; 3258 3259 hctx->close_notify = -2; 3260 if (SSL_is_init_finished(hctx->ssl)) { 3261 mod_openssl_close_notify(hctx); 3262 } 3263 else { 3264 mod_openssl_detach(hctx); 3265 } 3266 3267 return HANDLER_GO_ON; 3268 } 3269 3270 3271 static int 3272 mod_openssl_close_notify(handler_ctx *hctx) 3273 { 3274 int ret, ssl_r; 3275 unsigned long err; 3276 log_error_st *errh; 3277 3278 if (1 == hctx->close_notify) return -2; 3279 3280 ERR_clear_error(); 3281 switch ((ret = SSL_shutdown(hctx->ssl))) { 3282 case 1: 3283 mod_openssl_detach(hctx); 3284 return -2; 3285 case 0: 3286 /* Drain SSL read buffers in case pending records need processing. 3287 * Limit to reading next record to avoid denial of service when CPU 3288 * processing TLS is slower than arrival speed of TLS data packets. 3289 * (unless hctx->conf.ssl_read_ahead is set) 3290 * 3291 * references: 3292 * 3293 * "New session ticket breaks bidirectional shutdown of TLS 1.3 connection" 3294 * https://github.com/openssl/openssl/issues/6262 3295 * 3296 * The peer is still allowed to send data after receiving the 3297 * "close notify" event. If the peer did send data it need to be 3298 * processed by calling SSL_read() before calling SSL_shutdown() a 3299 * second time. SSL_read() will indicate the end of the peer data by 3300 * returning <= 0 and SSL_get_error() returning 3301 * SSL_ERROR_ZERO_RETURN. It is recommended to call SSL_read() 3302 * between SSL_shutdown() calls. 3303 * 3304 * Additional discussion in "Auto retry in shutdown" 3305 * https://github.com/openssl/openssl/pull/6340 3306 */ 3307 ssl_r = SSL_pending(hctx->ssl); 3308 if (ssl_r) { 3309 do { 3310 char buf[4096]; 3311 ret = SSL_read(hctx->ssl, buf, (int)sizeof(buf)); 3312 } while (ret > 0 && (hctx->conf.ssl_read_ahead||(ssl_r-=ret))); 3313 } 3314 3315 ERR_clear_error(); 3316 switch ((ret = SSL_shutdown(hctx->ssl))) { 3317 case 1: 3318 mod_openssl_detach(hctx); 3319 return -2; 3320 case 0: 3321 hctx->close_notify = -1; 3322 return 0; 3323 default: 3324 break; 3325 } 3326 3327 __attribute_fallthrough__ 3328 default: 3329 3330 if (!SSL_is_init_finished(hctx->ssl)) { 3331 mod_openssl_detach(hctx); 3332 return -2; 3333 } 3334 3335 switch ((ssl_r = SSL_get_error(hctx->ssl, ret))) { 3336 case SSL_ERROR_ZERO_RETURN: 3337 case SSL_ERROR_WANT_WRITE: 3338 case SSL_ERROR_WANT_READ: 3339 hctx->close_notify = -1; 3340 return 0; /* try again later */ 3341 case SSL_ERROR_SYSCALL: 3342 /* perhaps we have error waiting in our error-queue */ 3343 errh = hctx->r->conf.errh; 3344 if (0 != (err = ERR_get_error())) { 3345 do { 3346 log_error(errh, __FILE__, __LINE__, 3347 "SSL: %d %d %s",ssl_r,ret,ERR_error_string(err,NULL)); 3348 } while((err = ERR_get_error())); 3349 } else if (errno != 0) { 3350 /*ssl bug (see lighttpd ticket #2213): sometimes errno==0*/ 3351 switch(errno) { 3352 case EPIPE: 3353 case ECONNRESET: 3354 break; 3355 default: 3356 log_perror(errh, __FILE__, __LINE__, 3357 "SSL (error): %d %d", ssl_r, ret); 3358 break; 3359 } 3360 } 3361 3362 break; 3363 default: 3364 errh = hctx->r->conf.errh; 3365 while((err = ERR_get_error())) { 3366 log_error(errh, __FILE__, __LINE__, 3367 "SSL: %d %d %s", ssl_r, ret, ERR_error_string(err, NULL)); 3368 } 3369 3370 break; 3371 } 3372 } 3373 ERR_clear_error(); 3374 hctx->close_notify = -1; 3375 return ret; 3376 } 3377 3378 3379 CONNECTION_FUNC(mod_openssl_handle_con_close) 3380 { 3381 plugin_data *p = p_d; 3382 handler_ctx *hctx = con->plugin_ctx[p->id]; 3383 if (NULL != hctx) { 3384 con->plugin_ctx[p->id] = NULL; 3385 handler_ctx_free(hctx); 3386 } 3387 3388 return HANDLER_GO_ON; 3389 } 3390 3391 3392 static void 3393 https_add_ssl_client_subject (request_st * const r, X509_NAME *xn) 3394 { 3395 const size_t prelen = sizeof("SSL_CLIENT_S_DN_")-1; 3396 char key[64] = "SSL_CLIENT_S_DN_"; 3397 for (int i = 0, nentries = X509_NAME_entry_count(xn); i < nentries; ++i) { 3398 int xobjnid; 3399 const char * xobjsn; 3400 X509_NAME_ENTRY *xe; 3401 3402 if (!(xe = X509_NAME_get_entry(xn, i))) { 3403 continue; 3404 } 3405 xobjnid = OBJ_obj2nid((ASN1_OBJECT*)X509_NAME_ENTRY_get_object(xe)); 3406 xobjsn = OBJ_nid2sn(xobjnid); 3407 if (xobjsn) { 3408 const size_t len = strlen(xobjsn); 3409 if (prelen+len >= sizeof(key)) continue; 3410 memcpy(key+prelen, xobjsn, len); /*(not '\0'-terminated)*/ 3411 http_header_env_set(r, key, prelen+len, 3412 (const char*)X509_NAME_ENTRY_get_data(xe)->data, 3413 X509_NAME_ENTRY_get_data(xe)->length); 3414 } 3415 } 3416 } 3417 3418 3419 __attribute_cold__ 3420 static void 3421 https_add_ssl_client_verify_err (buffer * const b, long status) 3422 { 3423 char errstr[256]; 3424 ERR_error_string_n(status, errstr, sizeof(errstr)); 3425 buffer_append_string(b, errstr); 3426 } 3427 3428 3429 __attribute_noinline__ 3430 static void 3431 https_add_ssl_client_entries (request_st * const r, handler_ctx * const hctx) 3432 { 3433 X509 *xs; 3434 X509_NAME *xn; 3435 buffer *vb = http_header_env_set_ptr(r, CONST_STR_LEN("SSL_CLIENT_VERIFY")); 3436 3437 long vr = SSL_get_verify_result(hctx->ssl); 3438 if (vr != X509_V_OK) { 3439 buffer_copy_string_len(vb, CONST_STR_LEN("FAILED:")); 3440 https_add_ssl_client_verify_err(vb, vr); 3441 return; 3442 } else if (!(xs = SSL_get_peer_certificate(hctx->ssl))) { 3443 buffer_copy_string_len(vb, CONST_STR_LEN("NONE")); 3444 return; 3445 } else { 3446 buffer_copy_string_len(vb, CONST_STR_LEN("SUCCESS")); 3447 } 3448 3449 xn = X509_get_subject_name(xs); 3450 { 3451 char buf[256]; 3452 int len = safer_X509_NAME_oneline(xn, buf, sizeof(buf)); 3453 if (len > 0) { 3454 if (len >= (int)sizeof(buf)) len = (int)sizeof(buf)-1; 3455 http_header_env_set(r, 3456 CONST_STR_LEN("SSL_CLIENT_S_DN"), 3457 buf, (size_t)len); 3458 } 3459 } 3460 3461 https_add_ssl_client_subject(r, xn); 3462 3463 { 3464 ASN1_INTEGER *xsn = X509_get_serialNumber(xs); 3465 BIGNUM *serialBN = ASN1_INTEGER_to_BN(xsn, NULL); 3466 char *serialHex = BN_bn2hex(serialBN); 3467 http_header_env_set(r, 3468 CONST_STR_LEN("SSL_CLIENT_M_SERIAL"), 3469 serialHex, strlen(serialHex)); 3470 OPENSSL_free(serialHex); 3471 BN_free(serialBN); 3472 } 3473 3474 if (!buffer_string_is_empty(hctx->conf.ssl_verifyclient_username)) { 3475 /* pick one of the exported values as "REMOTE_USER", for example 3476 * ssl.verifyclient.username = "SSL_CLIENT_S_DN_UID" 3477 * or 3478 * ssl.verifyclient.username = "SSL_CLIENT_S_DN_emailAddress" 3479 */ 3480 const buffer *varname = hctx->conf.ssl_verifyclient_username; 3481 vb = http_header_env_get(r, CONST_BUF_LEN(varname)); 3482 if (vb) { /* same as http_auth.c:http_auth_setenv() */ 3483 http_header_env_set(r, 3484 CONST_STR_LEN("REMOTE_USER"), 3485 CONST_BUF_LEN(vb)); 3486 http_header_env_set(r, 3487 CONST_STR_LEN("AUTH_TYPE"), 3488 CONST_STR_LEN("SSL_CLIENT_VERIFY")); 3489 } 3490 } 3491 3492 if (hctx->conf.ssl_verifyclient_export_cert) { 3493 BIO *bio; 3494 if (NULL != (bio = BIO_new(BIO_s_mem()))) { 3495 PEM_write_bio_X509(bio, xs); 3496 const int n = BIO_pending(bio); 3497 3498 vb = http_header_env_set_ptr(r, CONST_STR_LEN("SSL_CLIENT_CERT")); 3499 buffer_extend(vb, (uint32_t)n); 3500 BIO_read(bio, vb->ptr, n); 3501 BIO_free(bio); 3502 } 3503 } 3504 X509_free(xs); 3505 } 3506 3507 3508 static void 3509 http_cgi_ssl_env (request_st * const r, handler_ctx * const hctx) 3510 { 3511 const char *s; 3512 const SSL_CIPHER *cipher; 3513 3514 s = SSL_get_version(hctx->ssl); 3515 http_header_env_set(r, CONST_STR_LEN("SSL_PROTOCOL"), s, strlen(s)); 3516 3517 if ((cipher = SSL_get_current_cipher(hctx->ssl))) { 3518 int usekeysize, algkeysize = 0; 3519 char buf[LI_ITOSTRING_LENGTH]; 3520 s = SSL_CIPHER_get_name(cipher); 3521 http_header_env_set(r, CONST_STR_LEN("SSL_CIPHER"), s, strlen(s)); 3522 usekeysize = SSL_CIPHER_get_bits(cipher, &algkeysize); 3523 if (0 == algkeysize) algkeysize = usekeysize; 3524 http_header_env_set(r, CONST_STR_LEN("SSL_CIPHER_USEKEYSIZE"), 3525 buf, li_itostrn(buf, sizeof(buf), usekeysize)); 3526 http_header_env_set(r, CONST_STR_LEN("SSL_CIPHER_ALGKEYSIZE"), 3527 buf, li_itostrn(buf, sizeof(buf), algkeysize)); 3528 } 3529 } 3530 3531 3532 REQUEST_FUNC(mod_openssl_handle_request_env) 3533 { 3534 plugin_data *p = p_d; 3535 /* simple flag for request_env_patched */ 3536 if (r->plugin_ctx[p->id]) return HANDLER_GO_ON; 3537 handler_ctx *hctx = r->con->plugin_ctx[p->id]; 3538 if (NULL == hctx) return HANDLER_GO_ON; 3539 r->plugin_ctx[p->id] = (void *)(uintptr_t)1u; 3540 3541 http_cgi_ssl_env(r, hctx); 3542 if (hctx->conf.ssl_verifyclient) { 3543 https_add_ssl_client_entries(r, hctx); 3544 } 3545 3546 return HANDLER_GO_ON; 3547 } 3548 3549 3550 REQUEST_FUNC(mod_openssl_handle_uri_raw) 3551 { 3552 /* mod_openssl must be loaded prior to mod_auth 3553 * if mod_openssl is configured to set REMOTE_USER based on client cert */ 3554 /* mod_openssl must be loaded after mod_extforward 3555 * if mod_openssl config is based on lighttpd.conf remote IP conditional 3556 * using remote IP address set by mod_extforward, *unless* PROXY protocol 3557 * is enabled with extforward.hap-PROXY = "enable", in which case the 3558 * reverse is true: mod_extforward must be loaded after mod_openssl */ 3559 plugin_data *p = p_d; 3560 handler_ctx *hctx = r->con->plugin_ctx[p->id]; 3561 if (NULL == hctx) return HANDLER_GO_ON; 3562 3563 mod_openssl_patch_config(r, &hctx->conf); 3564 if (hctx->conf.ssl_verifyclient) { 3565 mod_openssl_handle_request_env(r, p); 3566 } 3567 3568 return HANDLER_GO_ON; 3569 } 3570 3571 3572 REQUEST_FUNC(mod_openssl_handle_request_reset) 3573 { 3574 plugin_data *p = p_d; 3575 r->plugin_ctx[p->id] = NULL; /* simple flag for request_env_patched */ 3576 return HANDLER_GO_ON; 3577 } 3578 3579 3580 TRIGGER_FUNC(mod_openssl_handle_trigger) { 3581 const plugin_data * const p = p_d; 3582 const time_t cur_ts = log_epoch_secs; 3583 if (cur_ts & 0x3f) return HANDLER_GO_ON; /*(continue once each 64 sec)*/ 3584 UNUSED(srv); 3585 UNUSED(p); 3586 3587 #ifdef TLSEXT_TYPE_session_ticket 3588 mod_openssl_session_ticket_key_check(p, cur_ts); 3589 #endif 3590 3591 #ifndef OPENSSL_NO_OCSP 3592 mod_openssl_refresh_stapling_files(srv, p, cur_ts); 3593 #endif 3594 3595 return HANDLER_GO_ON; 3596 } 3597 3598 3599 int mod_openssl_plugin_init (plugin *p); 3600 int mod_openssl_plugin_init (plugin *p) 3601 { 3602 p->version = LIGHTTPD_VERSION_ID; 3603 p->name = "openssl"; 3604 p->init = mod_openssl_init; 3605 p->cleanup = mod_openssl_free; 3606 p->priv_defaults= mod_openssl_set_defaults; 3607 3608 p->handle_connection_accept = mod_openssl_handle_con_accept; 3609 p->handle_connection_shut_wr = mod_openssl_handle_con_shut_wr; 3610 p->handle_connection_close = mod_openssl_handle_con_close; 3611 p->handle_uri_raw = mod_openssl_handle_uri_raw; 3612 p->handle_request_env = mod_openssl_handle_request_env; 3613 p->handle_request_reset = mod_openssl_handle_request_reset; 3614 p->handle_trigger = mod_openssl_handle_trigger; 3615 3616 return 0; 3617 } 3618 3619 3620 #if defined(BORINGSSL_API_VERSION) \ 3621 || defined(LIBRESSL_VERSION_NUMBER) 3622 3623 static int 3624 mod_openssl_ssl_conf_proto_val (server *srv, plugin_config_socket *s, const buffer *b, int max) 3625 { 3626 if (NULL == b) /* default: min TLSv1.2, max TLSv1.3 */ 3627 #ifdef TLS1_3_VERSION 3628 return max ? TLS1_3_VERSION : TLS1_2_VERSION; 3629 #else 3630 return TLS1_2_VERSION; 3631 #endif 3632 else if (buffer_eq_icase_slen(b, CONST_STR_LEN("None"))) /*"disable" limit*/ 3633 return max 3634 ? 3635 #ifdef TLS1_3_VERSION 3636 TLS1_3_VERSION 3637 #else 3638 TLS1_2_VERSION 3639 #endif 3640 : (s->ssl_use_sslv3 ? SSL3_VERSION : TLS1_VERSION); 3641 else if (buffer_eq_icase_slen(b, CONST_STR_LEN("SSLv3"))) 3642 return SSL3_VERSION; 3643 else if (buffer_eq_icase_slen(b, CONST_STR_LEN("TLSv1.0"))) 3644 return TLS1_VERSION; 3645 else if (buffer_eq_icase_slen(b, CONST_STR_LEN("TLSv1.1"))) 3646 return TLS1_1_VERSION; 3647 else if (buffer_eq_icase_slen(b, CONST_STR_LEN("TLSv1.2"))) 3648 return TLS1_2_VERSION; 3649 #ifdef TLS1_3_VERSION 3650 else if (buffer_eq_icase_slen(b, CONST_STR_LEN("TLSv1.3"))) 3651 return TLS1_3_VERSION; 3652 #endif 3653 else { 3654 if (buffer_eq_icase_slen(b, CONST_STR_LEN("DTLSv1")) 3655 || buffer_eq_icase_slen(b, CONST_STR_LEN("DTLSv1.2"))) 3656 log_error(srv->errh, __FILE__, __LINE__, 3657 "SSL: ssl.openssl.ssl-conf-cmd %s %s ignored", 3658 max ? "MaxProtocol" : "MinProtocol", b->ptr); 3659 else 3660 log_error(srv->errh, __FILE__, __LINE__, 3661 "SSL: ssl.openssl.ssl-conf-cmd %s %s invalid; ignored", 3662 max ? "MaxProtocol" : "MinProtocol", b->ptr); 3663 } 3664 #ifdef TLS1_3_VERSION 3665 return max ? TLS1_3_VERSION : TLS1_2_VERSION; 3666 #else 3667 return TLS1_2_VERSION; 3668 #endif 3669 } 3670 3671 3672 static int 3673 mod_openssl_ssl_conf_cmd (server *srv, plugin_config_socket *s) 3674 { 3675 /* reference: 3676 * https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html */ 3677 int rc = 0; 3678 buffer *cipherstring = NULL; 3679 buffer *ciphersuites = NULL; 3680 buffer *minb = NULL; 3681 buffer *maxb = NULL; 3682 buffer *curves = NULL; 3683 3684 for (size_t i = 0; i < s->ssl_conf_cmd->used; ++i) { 3685 data_string *ds = (data_string *)s->ssl_conf_cmd->data[i]; 3686 if (buffer_eq_icase_slen(&ds->key, CONST_STR_LEN("CipherString"))) 3687 cipherstring = &ds->value; 3688 else if (buffer_eq_icase_slen(&ds->key, CONST_STR_LEN("Ciphersuites"))) 3689 ciphersuites = &ds->value; 3690 else if (buffer_eq_icase_slen(&ds->key, CONST_STR_LEN("Curves")) 3691 || buffer_eq_icase_slen(&ds->key, CONST_STR_LEN("Groups"))) 3692 curves = &ds->value; 3693 else if (buffer_eq_icase_slen(&ds->key, CONST_STR_LEN("MaxProtocol"))) 3694 maxb = &ds->value; 3695 else if (buffer_eq_icase_slen(&ds->key, CONST_STR_LEN("MinProtocol"))) 3696 minb = &ds->value; 3697 else if (buffer_eq_icase_slen(&ds->key, CONST_STR_LEN("Protocol"))) { 3698 /* openssl config for Protocol=... is complex and deprecated */ 3699 log_error(srv->errh, __FILE__, __LINE__, 3700 "SSL: ssl.openssl.ssl-conf-cmd %s ignored; " 3701 "use MinProtocol=... and MaxProtocol=... instead", 3702 ds->key.ptr); 3703 } 3704 else if (buffer_eq_icase_slen(&ds->key, CONST_STR_LEN("Options"))) { 3705 for (char *v = ds->value.ptr, *e; *v; v = e) { 3706 while (*v == ' ' || *v == '\t' || *v == ',') ++v; 3707 int flag = 1; 3708 if (*v == '-') { 3709 flag = 0; 3710 ++v; 3711 } 3712 for (e = v; light_isalpha(*e); ++e) ; 3713 switch ((int)(e-v)) { 3714 case 11: 3715 if (buffer_eq_icase_ssn(v, "Compression", 11)) { 3716 if (flag) 3717 SSL_CTX_clear_options(s->ssl_ctx, 3718 SSL_OP_NO_COMPRESSION); 3719 else 3720 SSL_CTX_set_options(s->ssl_ctx, 3721 SSL_OP_NO_COMPRESSION); 3722 continue; 3723 } 3724 break; 3725 case 13: 3726 if (buffer_eq_icase_ssn(v, "SessionTicket", 13)) { 3727 if (flag) 3728 SSL_CTX_clear_options(s->ssl_ctx, 3729 SSL_OP_NO_TICKET); 3730 else 3731 SSL_CTX_set_options(s->ssl_ctx, 3732 SSL_OP_NO_TICKET); 3733 continue; 3734 } 3735 break; 3736 case 16: 3737 if (buffer_eq_icase_ssn(v, "ServerPreference", 16)) { 3738 if (flag) 3739 SSL_CTX_set_options(s->ssl_ctx, 3740 SSL_OP_CIPHER_SERVER_PREFERENCE); 3741 else 3742 SSL_CTX_clear_options(s->ssl_ctx, 3743 SSL_OP_CIPHER_SERVER_PREFERENCE); 3744 s->ssl_honor_cipher_order = flag; 3745 continue; 3746 } 3747 break; 3748 default: 3749 break; 3750 } 3751 /* warn if not explicitly handled or ignored above */ 3752 if (!flag) --v; 3753 log_error(srv->errh, __FILE__, __LINE__, 3754 "SSL: ssl.openssl.ssl-conf-cmd Options %.*s " 3755 "ignored", (int)(e-v), v); 3756 } 3757 } 3758 #if 0 3759 else if (buffer_eq_icase_slen(&ds->key, CONST_STR_LEN("..."))) { 3760 } 3761 #endif 3762 else { 3763 /* warn if not explicitly handled or ignored above */ 3764 log_error(srv->errh, __FILE__, __LINE__, 3765 "SSL: ssl.openssl.ssl-conf-cmd %s ignored", 3766 ds->key.ptr); 3767 } 3768 3769 } 3770 3771 if (minb) { 3772 int n = mod_openssl_ssl_conf_proto_val(srv, s, minb, 0); 3773 if (!SSL_CTX_set_min_proto_version(s->ssl_ctx, n)) 3774 rc = -1; 3775 } 3776 3777 if (maxb) { 3778 int x = mod_openssl_ssl_conf_proto_val(srv, s, maxb, 1); 3779 if (!SSL_CTX_set_max_proto_version(s->ssl_ctx, x)) 3780 rc = -1; 3781 } 3782 3783 if (!buffer_string_is_empty(ciphersuites)) { 3784 #if defined(LIBRESSL_VERSION_NUMBER) && defined(LIBRESSL_HAS_TLS1_3) 3785 if (SSL_CTX_set_ciphersuites(s->ssl_ctx, ciphersuites->ptr) != 1) { 3786 log_error(srv->errh, __FILE__, __LINE__, 3787 "SSL: %s", ERR_error_string(ERR_get_error(), NULL)); 3788 rc = -1; 3789 } 3790 #endif 3791 } 3792 3793 if (!buffer_string_is_empty(cipherstring)) { 3794 /* Disable support for low encryption ciphers */ 3795 buffer_append_string_len(cipherstring, 3796 CONST_STR_LEN(":!aNULL:!eNULL:!EXP")); 3797 if (SSL_CTX_set_cipher_list(s->ssl_ctx, cipherstring->ptr) != 1) { 3798 log_error(srv->errh, __FILE__, __LINE__, 3799 "SSL: %s", ERR_error_string(ERR_get_error(), NULL)); 3800 rc = -1; 3801 } 3802 3803 if (s->ssl_honor_cipher_order) 3804 SSL_CTX_set_options(s->ssl_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE); 3805 } 3806 3807 if (curves) { 3808 if (!mod_openssl_ssl_conf_curves(srv, s, curves)) 3809 rc = -1; 3810 } 3811 3812 return rc; 3813 } 3814 3815 #endif /* BORINGSSL_API_VERSION || LIBRESSL_VERSION_NUMBER */ 3816