X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/755762fd4c420cabbcba4a9c79947e926fa82219..cd2e3fd052d5c6beceb412f6741b78622c759014:/src/src/tlscert-openssl.c diff --git a/src/src/tlscert-openssl.c b/src/src/tlscert-openssl.c index 19db0408f..2e6ee8b3c 100644 --- a/src/src/tlscert-openssl.c +++ b/src/src/tlscert-openssl.c @@ -2,7 +2,7 @@ * Exim - an Internet mail transport agent * *************************************************/ -/* Copyright (c) Jeremy Harris 2014 - 2015 */ +/* Copyright (c) Jeremy Harris 2014 - 2016 */ /* This module provides TLS (aka SSL) support for Exim using the OpenSSL library. It is #included into the tls.c file when that library is used. @@ -17,6 +17,10 @@ library. It is #included into the tls.c file when that library is used. #include #include +#if OPENSSL_VERSION_NUMBER >= 0x10100000L +# define EXIM_HAVE_ASN1_MACROS +#endif + /***************************************************** * Export/import a certificate, binary/printable @@ -119,7 +123,7 @@ int len; if (!bp) return badalloc(); len = ASN1_TIME_print(bp, asntime); -len = len > 0 ? (int) BIO_get_mem_data(bp, &s) : 0; +len = len > 0 ? (int) BIO_get_mem_data(bp, CSS &s) : 0; if (mod && Ustrcmp(mod, "raw") == 0) /* native ASN */ s = string_copyn(s, len); @@ -137,7 +141,7 @@ else /*XXX %Z might be glibc-specific? Solaris has it, at least*/ /*XXX should we switch to POSIX locale for this? */ tm.tm_isdst = 0; - if (!strptime(CCS s, "%b %e %T %Y %Z", &tm)) + if (!len || !strptime(CCS s, "%b %e %T %Y %Z", &tm)) expand_string_message = US"failed time conversion"; else @@ -241,9 +245,9 @@ BIO * bp = BIO_new(BIO_s_mem()); if (!bp) return badalloc(); if (X509_print_ex(bp, (X509 *)cert, 0, - X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION | X509_FLAG_NO_SERIAL | - X509_FLAG_NO_SIGNAME | X509_FLAG_NO_ISSUER | X509_FLAG_NO_VALIDITY | - X509_FLAG_NO_SUBJECT | X509_FLAG_NO_PUBKEY | X509_FLAG_NO_EXTENSIONS | + X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION | X509_FLAG_NO_SERIAL | + X509_FLAG_NO_SIGNAME | X509_FLAG_NO_ISSUER | X509_FLAG_NO_VALIDITY | + X509_FLAG_NO_SUBJECT | X509_FLAG_NO_PUBKEY | X509_FLAG_NO_EXTENSIONS | /* X509_FLAG_NO_SIGDUMP is the missing one */ X509_FLAG_NO_AUX) == 1) { @@ -267,10 +271,10 @@ BIO * bp = BIO_new(BIO_s_mem()); if (!bp) return badalloc(); if (X509_print_ex(bp, (X509 *)cert, 0, - X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION | X509_FLAG_NO_SERIAL | + X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION | X509_FLAG_NO_SERIAL | /* X509_FLAG_NO_SIGNAME is the missing one */ - X509_FLAG_NO_ISSUER | X509_FLAG_NO_VALIDITY | - X509_FLAG_NO_SUBJECT | X509_FLAG_NO_PUBKEY | X509_FLAG_NO_EXTENSIONS | + X509_FLAG_NO_ISSUER | X509_FLAG_NO_VALIDITY | + X509_FLAG_NO_SUBJECT | X509_FLAG_NO_PUBKEY | X509_FLAG_NO_EXTENSIONS | X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_AUX) == 1) { long len = BIO_get_mem_data(bp, &cp); @@ -314,9 +318,13 @@ uschar * cp3; if (!bp) return badalloc(); +#ifdef EXIM_HAVE_ASN1_MACROS +ASN1_STRING_print(bp, adata); +#else M_ASN1_OCTET_STRING_print(bp, adata); -/* binary data, DER encoded */ +#endif +/* binary data, DER encoded */ /* just dump for now */ len = BIO_get_mem_data(bp, &cp1); cp3 = cp2 = store_get(len*3+1); @@ -336,6 +344,7 @@ uschar * tls_cert_subject_altname(void * cert, uschar * mod) { uschar * list = NULL; +int lsize = 0, llen = 0; STACK_OF(GENERAL_NAME) * san = (STACK_OF(GENERAL_NAME) *) X509_get_ext_d2i((X509 *)cert, NID_subject_alt_name, NULL, NULL); uschar osep = '\n'; @@ -386,7 +395,7 @@ while (sk_GENERAL_NAME_num(san) > 0) ele = string_copyn(ele, len); if (Ustrlen(ele) == len) /* ignore any with embedded nul */ - list = string_append_listele(list, osep, + list = string_append_listele(list, &lsize, &llen, osep, match == -1 ? string_sprintf("%s=%s", tag, ele) : ele); } @@ -403,6 +412,7 @@ int adsnum = sk_ACCESS_DESCRIPTION_num(ads); int i; uschar sep = '\n'; uschar * list = NULL; +int size = 0, len = 0; if (mod) if (*mod == '>' && *++mod) sep = *mod++; @@ -412,11 +422,9 @@ for (i = 0; i < adsnum; i++) ACCESS_DESCRIPTION * ad = sk_ACCESS_DESCRIPTION_value(ads, i); if (ad && OBJ_obj2nid(ad->method) == NID_ad_OCSP) - { - uschar * ele = ASN1_STRING_data(ad->location->d.ia5); - int len = ASN1_STRING_length(ad->location->d.ia5); - list = string_append_listele_n(list, sep, ele, len); - } + list = string_append_listele_n(list, &size, &len, sep, + ASN1_STRING_data(ad->location->d.ia5), + ASN1_STRING_length(ad->location->d.ia5)); } sk_ACCESS_DESCRIPTION_free(ads); return list; @@ -433,6 +441,7 @@ int dpsnum = sk_DIST_POINT_num(dps); int i; uschar sep = '\n'; uschar * list = NULL; +int size = 0, len = 0; if (mod) if (*mod == '>' && *++mod) sep = *mod++; @@ -449,11 +458,9 @@ if (dps) for (i = 0; i < dpsnum; i++) if ( (np = sk_GENERAL_NAME_value(names, j)) && np->type == GEN_URI ) - { - uschar * ele = ASN1_STRING_data(np->d.uniformResourceIdentifier); - int len = ASN1_STRING_length(np->d.uniformResourceIdentifier); - list = string_append_listele_n(list, sep, ele, len); - } + list = string_append_listele_n(list, &size, &len, sep, + ASN1_STRING_data(np->d.uniformResourceIdentifier), + ASN1_STRING_length(np->d.uniformResourceIdentifier)); } sk_DIST_POINT_free(dps); return list; @@ -464,6 +471,26 @@ return list; /***************************************************** * Certificate operator routines *****************************************************/ +uschar * +tls_cert_der_b64(void * cert) +{ +BIO * bp = BIO_new(BIO_s_mem()); +uschar * cp = NULL; + +if (!i2d_X509_bio(bp, (X509 *)cert)) + log_write(0, LOG_MAIN, "TLS error in certificate export: %s", + ERR_error_string(ERR_get_error(), NULL)); +else + { + long len = BIO_get_mem_data(bp, &cp); + cp = b64encode(cp, (int)len); + } + +BIO_free(bp); +return cp; +} + + static uschar * fingerprint(X509 * cert, const EVP_MD * fdig) { @@ -482,19 +509,19 @@ for (j = 0; j < (int)n; j++) sprintf(CS cp+2*j, "%02X", md[j]); return(cp); } -uschar * +uschar * tls_cert_fprt_md5(void * cert) { return fingerprint((X509 *)cert, EVP_md5()); } -uschar * +uschar * tls_cert_fprt_sha1(void * cert) { return fingerprint((X509 *)cert, EVP_sha1()); } -uschar * +uschar * tls_cert_fprt_sha256(void * cert) { return fingerprint((X509 *)cert, EVP_sha256());