2 * Copyright (C) 1996-2017 The Squid Software Foundation and contributors
4 * Squid software is distributed under GPLv2+ license and includes
5 * contributions from numerous individuals and organizations.
6 * Please see the COPYING and CONTRIBUTORS files for details.
9 /* DEBUG: section 83 SSL accelerator support */
13 /* MS Visual Studio Projects are monolithic, so we need the following
14 * #if to exclude the SSL code from compile process when not needed.
18 #include "acl/FilledChecklist.h"
19 #include "anyp/PortCfg.h"
24 #include "ipc/MemMap.h"
25 #include "security/CertError.h"
26 #include "security/Session.h"
27 #include "SquidConfig.h"
28 #include "SquidTime.h"
30 #include "ssl/Config.h"
31 #include "ssl/ErrorDetail.h"
32 #include "ssl/gadgets.h"
33 #include "ssl/support.h"
38 // TODO: Move ssl_ex_index_* global variables from global.cc here.
39 int ssl_ex_index_ssl_untrusted_chain
= -1;
41 static Ssl::CertsIndexedList SquidUntrustedCerts
;
43 const EVP_MD
*Ssl::DefaultSignHash
= NULL
;
45 std::vector
<const char *> Ssl::BumpModeStr
= {
58 \defgroup ServerProtocolSSLInternal Server-Side SSL Internals
59 \ingroup ServerProtocolSSLAPI
62 /// \ingroup ServerProtocolSSLInternal
64 ssl_ask_password_cb(char *buf
, int size
, int rwflag
, void *userdata
)
70 snprintf(cmdline
, sizeof(cmdline
), "\"%s\" \"%s\"", Config
.Program
.ssl_password
, (const char *)userdata
);
71 in
= popen(cmdline
, "r");
73 if (fgets(buf
, size
, in
))
77 while (len
> 0 && (buf
[len
- 1] == '\n' || buf
[len
- 1] == '\r'))
87 /// \ingroup ServerProtocolSSLInternal
89 ssl_ask_password(SSL_CTX
* context
, const char * prompt
)
91 if (Config
.Program
.ssl_password
) {
92 SSL_CTX_set_default_passwd_cb(context
, ssl_ask_password_cb
);
93 SSL_CTX_set_default_passwd_cb_userdata(context
, (void *)prompt
);
97 #if HAVE_LIBSSL_SSL_CTX_SET_TMP_RSA_CALLBACK
99 ssl_temp_rsa_cb(SSL
* ssl
, int anInt
, int keylen
)
101 static RSA
*rsa_512
= NULL
;
102 static RSA
*rsa_1024
= NULL
;
111 rsa_512
= RSA_generate_key(512, RSA_F4
, NULL
, NULL
);
121 rsa_1024
= RSA_generate_key(1024, RSA_F4
, NULL
, NULL
);
129 debugs(83, DBG_IMPORTANT
, "ssl_temp_rsa_cb: Unexpected key length " << keylen
);
134 debugs(83, DBG_IMPORTANT
, "ssl_temp_rsa_cb: Failed to generate key " << keylen
);
139 if (Debug::Enabled(83, 5))
140 PEM_write_RSAPrivateKey(debug_log
, rsa
, NULL
, NULL
, 0, NULL
, NULL
);
142 debugs(83, DBG_IMPORTANT
, "Generated ephemeral RSA key of length " << keylen
);
150 Ssl::MaybeSetupRsaCallback(Security::ContextPointer
&ctx
)
152 #if HAVE_LIBSSL_SSL_CTX_SET_TMP_RSA_CALLBACK
153 debugs(83, 9, "Setting RSA key generation callback.");
154 SSL_CTX_set_tmp_rsa_callback(ctx
.get(), ssl_temp_rsa_cb
);
158 int Ssl::asn1timeToString(ASN1_TIME
*tm
, char *buf
, int len
)
162 bio
= BIO_new(BIO_s_mem());
164 if (ASN1_TIME_print(bio
, tm
))
165 write
= BIO_read(bio
, buf
, len
-1);
172 int Ssl::matchX509CommonNames(X509
*peer_cert
, void *check_data
, int (*check_func
)(void *check_data
, ASN1_STRING
*cn_data
))
176 X509_NAME
*name
= X509_get_subject_name(peer_cert
);
178 for (int i
= X509_NAME_get_index_by_NID(name
, NID_commonName
, -1); i
>= 0; i
= X509_NAME_get_index_by_NID(name
, NID_commonName
, i
)) {
180 ASN1_STRING
*cn_data
= X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name
, i
));
182 if ( (*check_func
)(check_data
, cn_data
) == 0)
186 STACK_OF(GENERAL_NAME
) * altnames
;
187 altnames
= (STACK_OF(GENERAL_NAME
)*)X509_get_ext_d2i(peer_cert
, NID_subject_alt_name
, NULL
, NULL
);
190 int numalts
= sk_GENERAL_NAME_num(altnames
);
191 for (int i
= 0; i
< numalts
; ++i
) {
192 const GENERAL_NAME
*check
= sk_GENERAL_NAME_value(altnames
, i
);
193 if (check
->type
!= GEN_DNS
) {
196 ASN1_STRING
*cn_data
= check
->d
.dNSName
;
198 if ( (*check_func
)(check_data
, cn_data
) == 0) {
199 sk_GENERAL_NAME_pop_free(altnames
, GENERAL_NAME_free
);
203 sk_GENERAL_NAME_pop_free(altnames
, GENERAL_NAME_free
);
208 static int check_domain( void *check_data
, ASN1_STRING
*cn_data
)
211 const char *server
= (const char *)check_data
;
213 if (cn_data
->length
== 0)
214 return 1; // zero length cn, ignore
216 if (cn_data
->length
> (int)sizeof(cn
) - 1)
217 return 1; //if does not fit our buffer just ignore
219 char *s
= reinterpret_cast<char*>(cn_data
->data
);
221 for (int i
= 0; i
< cn_data
->length
; ++i
, ++d
, ++s
) {
223 return 1; // always a domain mismatch. contains 0x00
226 cn
[cn_data
->length
] = '\0';
227 debugs(83, 4, "Verifying server domain " << server
<< " to certificate name/subjectAltName " << cn
);
228 return matchDomainName(server
, (cn
[0] == '*' ? cn
+ 1 : cn
), mdnRejectSubsubDomains
);
231 bool Ssl::checkX509ServerValidity(X509
*cert
, const char *server
)
233 return matchX509CommonNames(cert
, (void *)server
, check_domain
);
236 #if !HAVE_LIBCRYPTO_X509_STORE_CTX_GET0_CERT
237 static inline X509
*X509_STORE_CTX_get0_cert(X509_STORE_CTX
*ctx
)
243 /// \ingroup ServerProtocolSSLInternal
245 ssl_verify_cb(int ok
, X509_STORE_CTX
* ctx
)
247 // preserve original ctx->error before SSL_ calls can overwrite it
248 Security::ErrorCode error_no
= ok
? SSL_ERROR_NONE
: X509_STORE_CTX_get_error(ctx
);
250 char buffer
[256] = "";
251 SSL
*ssl
= (SSL
*)X509_STORE_CTX_get_ex_data(ctx
, SSL_get_ex_data_X509_STORE_CTX_idx());
252 SSL_CTX
*sslctx
= SSL_get_SSL_CTX(ssl
);
253 SBuf
*server
= (SBuf
*)SSL_get_ex_data(ssl
, ssl_ex_index_server
);
254 void *dont_verify_domain
= SSL_CTX_get_ex_data(sslctx
, ssl_ctx_ex_index_dont_verify_domain
);
255 ACLChecklist
*check
= (ACLChecklist
*)SSL_get_ex_data(ssl
, ssl_ex_index_cert_error_check
);
256 X509
*peeked_cert
= (X509
*)SSL_get_ex_data(ssl
, ssl_ex_index_ssl_peeked_cert
);
257 Security::CertPointer peer_cert
;
258 peer_cert
.resetAndLock(X509_STORE_CTX_get0_cert(ctx
));
260 X509_NAME_oneline(X509_get_subject_name(peer_cert
.get()), buffer
, sizeof(buffer
));
262 // detect infinite loops
263 uint32_t *validationCounter
= static_cast<uint32_t *>(SSL_get_ex_data(ssl
, ssl_ex_index_ssl_validation_counter
));
264 if (!validationCounter
) {
265 validationCounter
= new uint32_t(1);
266 SSL_set_ex_data(ssl
, ssl_ex_index_ssl_validation_counter
, validationCounter
);
268 // overflows allowed if SQUID_CERT_VALIDATION_ITERATION_MAX >= UINT32_MAX
269 (*validationCounter
)++;
272 if ((*validationCounter
) >= SQUID_CERT_VALIDATION_ITERATION_MAX
) {
273 ok
= 0; // or the validation loop will never stop
274 error_no
= SQUID_X509_V_ERR_INFINITE_VALIDATION
;
275 debugs(83, 2, "SQUID_X509_V_ERR_INFINITE_VALIDATION: " <<
276 *validationCounter
<< " iterations while checking " << buffer
);
280 debugs(83, 5, "SSL Certificate signature OK: " << buffer
);
282 // Check for domain mismatch only if the current certificate is the peer certificate.
283 if (!dont_verify_domain
&& server
&& peer_cert
.get() == X509_STORE_CTX_get_current_cert(ctx
)) {
284 if (!Ssl::checkX509ServerValidity(peer_cert
.get(), server
->c_str())) {
285 debugs(83, 2, "SQUID_X509_V_ERR_DOMAIN_MISMATCH: Certificate " << buffer
<< " does not match domainname " << server
);
287 error_no
= SQUID_X509_V_ERR_DOMAIN_MISMATCH
;
292 if (ok
&& peeked_cert
) {
293 // Check whether the already peeked certificate matches the new one.
294 if (X509_cmp(peer_cert
.get(), peeked_cert
) != 0) {
295 debugs(83, 2, "SQUID_X509_V_ERR_CERT_CHANGE: Certificate " << buffer
<< " does not match peeked certificate");
297 error_no
= SQUID_X509_V_ERR_CERT_CHANGE
;
302 Security::CertPointer broken_cert
;
303 broken_cert
.resetAndLock(X509_STORE_CTX_get_current_cert(ctx
));
305 broken_cert
= peer_cert
;
307 Security::CertErrors
*errs
= static_cast<Security::CertErrors
*>(SSL_get_ex_data(ssl
, ssl_ex_index_ssl_errors
));
308 const int depth
= X509_STORE_CTX_get_error_depth(ctx
);
310 errs
= new Security::CertErrors(Security::CertError(error_no
, broken_cert
, depth
));
311 if (!SSL_set_ex_data(ssl
, ssl_ex_index_ssl_errors
, (void *)errs
)) {
312 debugs(83, 2, "Failed to set ssl error_no in ssl_verify_cb: Certificate " << buffer
);
316 } else // remember another error number
317 errs
->push_back_unique(Security::CertError(error_no
, broken_cert
, depth
));
319 if (const char *err_descr
= Ssl::GetErrorDescr(error_no
))
320 debugs(83, 5, err_descr
<< ": " << buffer
);
322 debugs(83, DBG_IMPORTANT
, "SSL unknown certificate error " << error_no
<< " in " << buffer
);
324 // Check if the certificate error can be bypassed.
325 // Infinity validation loop errors can not bypassed.
326 if (error_no
!= SQUID_X509_V_ERR_INFINITE_VALIDATION
) {
328 ACLFilledChecklist
*filledCheck
= Filled(check
);
329 assert(!filledCheck
->sslErrors
);
330 filledCheck
->sslErrors
= new Security::CertErrors(Security::CertError(error_no
, broken_cert
));
331 filledCheck
->serverCert
= peer_cert
;
332 if (check
->fastCheck().allowed()) {
333 debugs(83, 3, "bypassing SSL error " << error_no
<< " in " << buffer
);
336 debugs(83, 5, "confirming SSL error " << error_no
);
338 delete filledCheck
->sslErrors
;
339 filledCheck
->sslErrors
= NULL
;
340 filledCheck
->serverCert
.reset();
342 // If the certificate validator is used then we need to allow all errors and
343 // pass them to certficate validator for more processing
344 else if (Ssl::TheConfig
.ssl_crt_validator
) {
350 if (Ssl::TheConfig
.ssl_crt_validator
) {
351 // Check if we have stored certificates chain. Store if not.
352 if (!SSL_get_ex_data(ssl
, ssl_ex_index_ssl_cert_chain
)) {
353 STACK_OF(X509
) *certStack
= X509_STORE_CTX_get1_chain(ctx
);
354 if (certStack
&& !SSL_set_ex_data(ssl
, ssl_ex_index_ssl_cert_chain
, certStack
))
355 sk_X509_pop_free(certStack
, X509_free
);
359 if (!ok
&& !SSL_get_ex_data(ssl
, ssl_ex_index_ssl_error_detail
) ) {
361 // Find the broken certificate. It may be intermediate.
362 Security::CertPointer
broken_cert(peer_cert
); // reasonable default if search fails
363 // Our SQUID_X509_V_ERR_DOMAIN_MISMATCH implies peer_cert is at fault.
364 if (error_no
!= SQUID_X509_V_ERR_DOMAIN_MISMATCH
) {
365 if (auto *last_used_cert
= X509_STORE_CTX_get_current_cert(ctx
))
366 broken_cert
.resetAndLock(last_used_cert
);
369 auto *errDetail
= new Ssl::ErrorDetail(error_no
, peer_cert
.get(), broken_cert
.get());
370 if (!SSL_set_ex_data(ssl
, ssl_ex_index_ssl_error_detail
, errDetail
)) {
371 debugs(83, 2, "Failed to set Ssl::ErrorDetail in ssl_verify_cb: Certificate " << buffer
);
380 Ssl::SetupVerifyCallback(Security::ContextPointer
&ctx
)
382 SSL_CTX_set_verify(ctx
.get(), SSL_VERIFY_PEER
| SSL_VERIFY_FAIL_IF_NO_PEER_CERT
, ssl_verify_cb
);
385 // "dup" function for SSL_get_ex_new_index("cert_err_check")
386 #if SQUID_USE_CONST_CRYPTO_EX_DATA_DUP
388 ssl_dupAclChecklist(CRYPTO_EX_DATA
*, const CRYPTO_EX_DATA
*, void *,
392 ssl_dupAclChecklist(CRYPTO_EX_DATA
*, CRYPTO_EX_DATA
*, void *,
396 // We do not support duplication of ACLCheckLists.
397 // If duplication is needed, we can count copies with cbdata.
402 // "free" function for SSL_get_ex_new_index("cert_err_check")
404 ssl_freeAclChecklist(void *, void *ptr
, CRYPTO_EX_DATA
*,
407 delete static_cast<ACLChecklist
*>(ptr
); // may be NULL
410 // "free" function for SSL_get_ex_new_index("ssl_error_detail")
412 ssl_free_ErrorDetail(void *, void *ptr
, CRYPTO_EX_DATA
*,
415 Ssl::ErrorDetail
*errDetail
= static_cast <Ssl::ErrorDetail
*>(ptr
);
420 ssl_free_SslErrors(void *, void *ptr
, CRYPTO_EX_DATA
*,
423 Security::CertErrors
*errs
= static_cast <Security::CertErrors
*>(ptr
);
427 // "free" function for SSL_get_ex_new_index("ssl_ex_index_ssl_validation_counter")
429 ssl_free_int(void *, void *ptr
, CRYPTO_EX_DATA
*,
432 uint32_t *counter
= static_cast <uint32_t *>(ptr
);
436 /// \ingroup ServerProtocolSSLInternal
437 /// Callback handler function to release STACK_OF(X509) "ex" data stored
438 /// in an SSL object.
440 ssl_free_CertChain(void *, void *ptr
, CRYPTO_EX_DATA
*,
443 STACK_OF(X509
) *certsChain
= static_cast <STACK_OF(X509
) *>(ptr
);
444 sk_X509_pop_free(certsChain
,X509_free
);
447 // "free" function for X509 certificates
449 ssl_free_X509(void *, void *ptr
, CRYPTO_EX_DATA
*,
452 X509
*cert
= static_cast <X509
*>(ptr
);
456 // "free" function for SBuf
458 ssl_free_SBuf(void *, void *ptr
, CRYPTO_EX_DATA
*,
461 SBuf
*buf
= static_cast <SBuf
*>(ptr
);
466 Ssl::Initialize(void)
468 static bool initialized
= false;
473 SSL_load_error_strings();
474 SSLeay_add_ssl_algorithms();
476 #if HAVE_OPENSSL_ENGINE_H
477 if (::Config
.SSL
.ssl_engine
) {
478 ENGINE_load_builtin_engines();
480 if (!(e
= ENGINE_by_id(::Config
.SSL
.ssl_engine
)))
481 fatalf("Unable to find SSL engine '%s'\n", ::Config
.SSL
.ssl_engine
);
483 if (!ENGINE_set_default(e
, ENGINE_METHOD_ALL
)) {
484 const int ssl_error
= ERR_get_error();
485 fatalf("Failed to initialise SSL engine: %s\n", Security::ErrorString(ssl_error
));
489 if (::Config
.SSL
.ssl_engine
)
490 fatalf("Your OpenSSL has no SSL engine support\n");
493 const char *defName
= ::Config
.SSL
.certSignHash
? ::Config
.SSL
.certSignHash
: SQUID_SSL_SIGN_HASH_IF_NONE
;
494 Ssl::DefaultSignHash
= EVP_get_digestbyname(defName
);
495 if (!Ssl::DefaultSignHash
)
496 fatalf("Sign hash '%s' is not supported\n", defName
);
498 ssl_ex_index_server
= SSL_get_ex_new_index(0, (void *) "server", NULL
, NULL
, ssl_free_SBuf
);
499 ssl_ctx_ex_index_dont_verify_domain
= SSL_CTX_get_ex_new_index(0, (void *) "dont_verify_domain", NULL
, NULL
, NULL
);
500 ssl_ex_index_cert_error_check
= SSL_get_ex_new_index(0, (void *) "cert_error_check", NULL
, &ssl_dupAclChecklist
, &ssl_freeAclChecklist
);
501 ssl_ex_index_ssl_error_detail
= SSL_get_ex_new_index(0, (void *) "ssl_error_detail", NULL
, NULL
, &ssl_free_ErrorDetail
);
502 ssl_ex_index_ssl_peeked_cert
= SSL_get_ex_new_index(0, (void *) "ssl_peeked_cert", NULL
, NULL
, &ssl_free_X509
);
503 ssl_ex_index_ssl_errors
= SSL_get_ex_new_index(0, (void *) "ssl_errors", NULL
, NULL
, &ssl_free_SslErrors
);
504 ssl_ex_index_ssl_cert_chain
= SSL_get_ex_new_index(0, (void *) "ssl_cert_chain", NULL
, NULL
, &ssl_free_CertChain
);
505 ssl_ex_index_ssl_validation_counter
= SSL_get_ex_new_index(0, (void *) "ssl_validation_counter", NULL
, NULL
, &ssl_free_int
);
506 ssl_ex_index_ssl_untrusted_chain
= SSL_get_ex_new_index(0, (void *) "ssl_untrusted_chain", NULL
, NULL
, &ssl_free_CertChain
);
510 Ssl::InitServerContext(Security::ContextPointer
&ctx
, AnyP::PortCfg
&port
)
515 if (!SSL_CTX_use_certificate(ctx
.get(), port
.secure
.signingCert
.get())) {
516 const int ssl_error
= ERR_get_error();
517 const auto &keys
= port
.secure
.certs
.front();
518 debugs(83, DBG_CRITICAL
, "ERROR: Failed to acquire TLS certificate '" << keys
.certFile
<< "': " << Security::ErrorString(ssl_error
));
522 if (!SSL_CTX_use_PrivateKey(ctx
.get(), port
.secure
.signPkey
.get())) {
523 const int ssl_error
= ERR_get_error();
524 const auto &keys
= port
.secure
.certs
.front();
525 debugs(83, DBG_CRITICAL
, "ERROR: Failed to acquire TLS private key '" << keys
.privateKeyFile
<< "': " << Security::ErrorString(ssl_error
));
529 Ssl::addChainToSslContext(ctx
, port
.secure
.certsToChain
);
531 if (!port
.secure
.updateContextConfig(ctx
)) {
532 debugs(83, DBG_CRITICAL
, "ERROR: Configuring static SSL context");
540 Ssl::InitClientContext(Security::ContextPointer
&ctx
, Security::PeerOptions
&peer
, long fl
)
545 if (!peer
.sslCipher
.isEmpty()) {
546 debugs(83, 5, "Using chiper suite " << peer
.sslCipher
<< ".");
548 const char *cipher
= peer
.sslCipher
.c_str();
549 if (!SSL_CTX_set_cipher_list(ctx
.get(), cipher
)) {
550 const int ssl_error
= ERR_get_error();
551 fatalf("Failed to set SSL cipher suite '%s': %s\n",
552 cipher
, Security::ErrorString(ssl_error
));
556 if (!peer
.certs
.empty()) {
557 // TODO: support loading multiple cert/key pairs
558 auto &keys
= peer
.certs
.front();
559 if (!keys
.certFile
.isEmpty()) {
560 debugs(83, DBG_IMPORTANT
, "Using certificate in " << keys
.certFile
);
562 const char *certfile
= keys
.certFile
.c_str();
563 if (!SSL_CTX_use_certificate_chain_file(ctx
.get(), certfile
)) {
564 const int ssl_error
= ERR_get_error();
565 fatalf("Failed to acquire SSL certificate '%s': %s\n",
566 certfile
, Security::ErrorString(ssl_error
));
569 debugs(83, DBG_IMPORTANT
, "Using private key in " << keys
.privateKeyFile
);
570 const char *keyfile
= keys
.privateKeyFile
.c_str();
571 ssl_ask_password(ctx
.get(), keyfile
);
573 if (!SSL_CTX_use_PrivateKey_file(ctx
.get(), keyfile
, SSL_FILETYPE_PEM
)) {
574 const int ssl_error
= ERR_get_error();
575 fatalf("Failed to acquire SSL private key '%s': %s\n",
576 keyfile
, Security::ErrorString(ssl_error
));
579 debugs(83, 5, "Comparing private and public SSL keys.");
581 if (!SSL_CTX_check_private_key(ctx
.get())) {
582 const int ssl_error
= ERR_get_error();
583 fatalf("SSL private key '%s' does not match public key '%s': %s\n",
584 certfile
, keyfile
, Security::ErrorString(ssl_error
));
589 MaybeSetupRsaCallback(ctx
);
591 if (fl
& SSL_FLAG_DONT_VERIFY_PEER
) {
592 debugs(83, 2, "SECURITY WARNING: Peer certificates are not verified for validity!");
593 SSL_CTX_set_verify(ctx
.get(), SSL_VERIFY_NONE
, NULL
);
595 debugs(83, 9, "Setting certificate verification callback.");
596 Ssl::SetupVerifyCallback(ctx
);
602 /// \ingroup ServerProtocolSSLInternal
604 ssl_get_attribute(X509_NAME
* name
, const char *attribute_name
)
606 static char buffer
[1024];
609 if (strcmp(attribute_name
, "DN") == 0) {
610 X509_NAME_oneline(name
, buffer
, sizeof(buffer
));
612 int nid
= OBJ_txt2nid(const_cast<char *>(attribute_name
));
614 debugs(83, DBG_IMPORTANT
, "WARNING: Unknown SSL attribute name '" << attribute_name
<< "'");
617 X509_NAME_get_text_by_NID(name
, nid
, buffer
, sizeof(buffer
));
620 return *buffer
? buffer
: nullptr;
623 /// \ingroup ServerProtocolSSLInternal
625 Ssl::GetX509UserAttribute(X509
* cert
, const char *attribute_name
)
633 name
= X509_get_subject_name(cert
);
635 ret
= ssl_get_attribute(name
, attribute_name
);
641 Ssl::GetX509Fingerprint(X509
* cert
, const char *)
643 static char buf
[1024];
648 unsigned char md
[EVP_MAX_MD_SIZE
];
649 if (!X509_digest(cert
, EVP_sha1(), md
, &n
))
652 assert(3 * n
+ 1 < sizeof(buf
));
655 for (unsigned int i
=0; i
< n
; ++i
, s
+= 3) {
656 const char term
= (i
+ 1 < n
) ? ':' : '\0';
657 snprintf(s
, 4, "%02X%c", md
[i
], term
);
663 /// \ingroup ServerProtocolSSLInternal
665 Ssl::GetX509CAAttribute(X509
* cert
, const char *attribute_name
)
674 name
= X509_get_issuer_name(cert
);
676 ret
= ssl_get_attribute(name
, attribute_name
);
681 const char *sslGetUserAttribute(SSL
*ssl
, const char *attribute_name
)
686 X509
*cert
= SSL_get_peer_certificate(ssl
);
688 const char *attr
= Ssl::GetX509UserAttribute(cert
, attribute_name
);
694 const char *sslGetCAAttribute(SSL
*ssl
, const char *attribute_name
)
699 X509
*cert
= SSL_get_peer_certificate(ssl
);
701 const char *attr
= Ssl::GetX509CAAttribute(cert
, attribute_name
);
708 sslGetUserEmail(SSL
* ssl
)
710 return sslGetUserAttribute(ssl
, "emailAddress");
714 sslGetUserCertificatePEM(SSL
*ssl
)
718 static char *str
= NULL
;
727 cert
= SSL_get_peer_certificate(ssl
);
732 mem
= BIO_new(BIO_s_mem());
734 PEM_write_bio_X509(mem
, cert
);
736 len
= BIO_get_mem_data(mem
, &ptr
);
738 str
= (char *)xmalloc(len
+ 1);
740 memcpy(str
, ptr
, len
);
752 sslGetUserCertificateChainPEM(SSL
*ssl
)
754 STACK_OF(X509
) *chain
;
756 static char *str
= NULL
;
766 chain
= SSL_get_peer_cert_chain(ssl
);
769 return sslGetUserCertificatePEM(ssl
);
771 mem
= BIO_new(BIO_s_mem());
773 for (i
= 0; i
< sk_X509_num(chain
); ++i
) {
774 X509
*cert
= sk_X509_value(chain
, i
);
775 PEM_write_bio_X509(mem
, cert
);
778 len
= BIO_get_mem_data(mem
, &ptr
);
780 str
= (char *)xmalloc(len
+ 1);
781 memcpy(str
, ptr
, len
);
789 /// Create SSL context and apply ssl certificate and private key to it.
790 Security::ContextPointer
791 Ssl::createSSLContext(Security::CertPointer
& x509
, Security::PrivateKeyPointer
& pkey
, Security::ServerOptions
&options
)
793 Security::ContextPointer
ctx(options
.createBlankContext());
795 if (!SSL_CTX_use_certificate(ctx
.get(), x509
.get()))
796 return Security::ContextPointer();
798 if (!SSL_CTX_use_PrivateKey(ctx
.get(), pkey
.get()))
799 return Security::ContextPointer();
801 if (!options
.updateContextConfig(ctx
))
802 return Security::ContextPointer();
807 Security::ContextPointer
808 Ssl::GenerateSslContextUsingPkeyAndCertFromMemory(const char * data
, Security::ServerOptions
&options
, bool trusted
)
810 Security::CertPointer cert
;
811 Security::PrivateKeyPointer pkey
;
812 if (!readCertAndPrivateKeyFromMemory(cert
, pkey
, data
) || !cert
|| !pkey
)
813 return Security::ContextPointer();
815 Security::ContextPointer
ctx(createSSLContext(cert
, pkey
, options
));
817 Ssl::chainCertificatesToSSLContext(ctx
, options
);
821 Security::ContextPointer
822 Ssl::GenerateSslContext(CertificateProperties
const &properties
, Security::ServerOptions
&options
, bool trusted
)
824 Security::CertPointer cert
;
825 Security::PrivateKeyPointer pkey
;
826 if (!generateSslCertificate(cert
, pkey
, properties
) || !cert
|| !pkey
)
827 return Security::ContextPointer();
829 Security::ContextPointer
ctx(createSSLContext(cert
, pkey
, options
));
831 Ssl::chainCertificatesToSSLContext(ctx
, options
);
836 Ssl::chainCertificatesToSSLContext(Security::ContextPointer
&ctx
, Security::ServerOptions
&options
)
839 // Add signing certificate to the certificates chain
840 X509
*signingCert
= options
.signingCert
.get();
841 if (SSL_CTX_add_extra_chain_cert(ctx
.get(), signingCert
)) {
842 // increase the certificate lock
843 X509_up_ref(signingCert
);
845 const int ssl_error
= ERR_get_error();
846 debugs(33, DBG_IMPORTANT
, "WARNING: can not add signing certificate to SSL context chain: " << Security::ErrorString(ssl_error
));
848 Ssl::addChainToSslContext(ctx
, options
.certsToChain
);
852 Ssl::configureUnconfiguredSslContext(Security::ContextPointer
&ctx
, Ssl::CertSignAlgorithm signAlgorithm
,AnyP::PortCfg
&port
)
854 if (ctx
&& signAlgorithm
== Ssl::algSignTrusted
)
855 Ssl::chainCertificatesToSSLContext(ctx
, port
.secure
);
859 Ssl::configureSSL(SSL
*ssl
, CertificateProperties
const &properties
, AnyP::PortCfg
&port
)
861 Security::CertPointer cert
;
862 Security::PrivateKeyPointer pkey
;
863 if (!generateSslCertificate(cert
, pkey
, properties
))
872 if (!SSL_use_certificate(ssl
, cert
.get()))
875 if (!SSL_use_PrivateKey(ssl
, pkey
.get()))
882 Ssl::configureSSLUsingPkeyAndCertFromMemory(SSL
*ssl
, const char *data
, AnyP::PortCfg
&port
)
884 Security::CertPointer cert
;
885 Security::PrivateKeyPointer pkey
;
886 if (!readCertAndPrivateKeyFromMemory(cert
, pkey
, data
))
892 if (!SSL_use_certificate(ssl
, cert
.get()))
895 if (!SSL_use_PrivateKey(ssl
, pkey
.get()))
902 Ssl::verifySslCertificate(Security::ContextPointer
&ctx
, CertificateProperties
const &properties
)
904 #if HAVE_SSL_CTX_GET0_CERTIFICATE
905 X509
* cert
= SSL_CTX_get0_certificate(ctx
.get());
906 #elif SQUID_USE_SSLGETCERTIFICATE_HACK
907 // SSL_get_certificate is buggy in openssl versions 1.0.1d and 1.0.1e
908 // Try to retrieve certificate directly from Security::ContextPointer object
909 X509
***pCert
= (X509
***)ctx
->cert
;
910 X509
* cert
= pCert
&& *pCert
? **pCert
: NULL
;
911 #elif SQUID_SSLGETCERTIFICATE_BUGGY
915 // Temporary ssl for getting X509 certificate from SSL_CTX.
916 Security::SessionPointer
ssl(Security::NewSessionObject(ctx
));
917 X509
* cert
= SSL_get_certificate(ssl
.get());
921 ASN1_TIME
* time_notBefore
= X509_get_notBefore(cert
);
922 ASN1_TIME
* time_notAfter
= X509_get_notAfter(cert
);
923 return (X509_cmp_current_time(time_notBefore
) < 0 && X509_cmp_current_time(time_notAfter
) > 0);
927 Ssl::setClientSNI(SSL
*ssl
, const char *fqdn
)
929 //The SSL_CTRL_SET_TLSEXT_HOSTNAME is a openssl macro which indicates
930 // if the TLS servername extension (SNI) is enabled in openssl library.
931 #if defined(SSL_CTRL_SET_TLSEXT_HOSTNAME)
932 if (!SSL_set_tlsext_host_name(ssl
, fqdn
)) {
933 const int ssl_error
= ERR_get_error();
934 debugs(83, 3, "WARNING: unable to set TLS servername extension (SNI): " <<
935 Security::ErrorString(ssl_error
) << "\n");
940 debugs(83, 7, "no support for TLS servername extension (SNI)");
946 Ssl::addChainToSslContext(Security::ContextPointer
&ctx
, Security::CertList
&chain
)
951 for (auto cert
: chain
) {
952 if (SSL_CTX_add_extra_chain_cert(ctx
.get(), cert
.get())) {
953 // increase the certificate lock
954 X509_up_ref(cert
.get());
956 const int ssl_error
= ERR_get_error();
957 debugs(83, DBG_IMPORTANT
, "WARNING: can not add certificate to SSL context chain: " << Security::ErrorString(ssl_error
));
963 hasAuthorityInfoAccessCaIssuers(X509
*cert
)
965 AUTHORITY_INFO_ACCESS
*info
;
968 info
= static_cast<AUTHORITY_INFO_ACCESS
*>(X509_get_ext_d2i(cert
, NID_info_access
, NULL
, NULL
));
972 static char uri
[MAX_URL
];
975 for (int i
= 0; i
< sk_ACCESS_DESCRIPTION_num(info
); i
++) {
976 ACCESS_DESCRIPTION
*ad
= sk_ACCESS_DESCRIPTION_value(info
, i
);
977 if (OBJ_obj2nid(ad
->method
) == NID_ad_ca_issuers
) {
978 if (ad
->location
->type
== GEN_URI
) {
980 reinterpret_cast<const char *>(
981 #if HAVE_LIBCRYPTO_ASN1_STRING_GET0_DATA
982 ASN1_STRING_get0_data(ad
->location
->d
.uniformResourceIdentifier
)
984 ASN1_STRING_data(ad
->location
->d
.uniformResourceIdentifier
)
992 AUTHORITY_INFO_ACCESS_free(info
);
993 return uri
[0] != '\0' ? uri
: nullptr;
997 Ssl::loadCerts(const char *certsFile
, Ssl::CertsIndexedList
&list
)
999 BIO
*in
= BIO_new_file(certsFile
, "r");
1001 debugs(83, DBG_IMPORTANT
, "Failed to open '" << certsFile
<< "' to load certificates");
1006 while((aCert
= PEM_read_bio_X509(in
, NULL
, NULL
, NULL
))) {
1007 static char buffer
[2048];
1008 X509_NAME_oneline(X509_get_subject_name(aCert
), buffer
, sizeof(buffer
));
1009 list
.insert(std::pair
<SBuf
, X509
*>(SBuf(buffer
), aCert
));
1011 debugs(83, 4, "Loaded " << list
.size() << " certificates from file: '" << certsFile
<< "'");
1016 /// quickly find the issuer certificate of a certificate cert in the
1017 /// Ssl::CertsIndexedList list
1019 findCertIssuerFast(Ssl::CertsIndexedList
&list
, X509
*cert
)
1021 static char buffer
[2048];
1023 if (X509_NAME
*issuerName
= X509_get_issuer_name(cert
))
1024 X509_NAME_oneline(issuerName
, buffer
, sizeof(buffer
));
1028 const auto ret
= list
.equal_range(SBuf(buffer
));
1029 for (Ssl::CertsIndexedList::iterator it
= ret
.first
; it
!= ret
.second
; ++it
) {
1030 X509
*issuer
= it
->second
;
1031 if (X509_check_issued(issuer
, cert
) == X509_V_OK
) {
1038 /// slowly find the issuer certificate of a given cert using linear search
1040 findCertIssuer(Security::CertList
const &list
, X509
*cert
)
1042 for (Security::CertList::const_iterator it
= list
.begin(); it
!= list
.end(); ++it
) {
1043 if (X509_check_issued(it
->get(), cert
) == X509_V_OK
)
1049 /// \return true if the cert issuer exist in the certificates stored in connContext
1051 issuerExistInCaDb(X509
*cert
, const Security::ContextPointer
&connContext
)
1056 X509_STORE_CTX
*storeCtx
= X509_STORE_CTX_new();
1058 debugs(83, DBG_IMPORTANT
, "Failed to allocate STORE_CTX object");
1062 bool gotIssuer
= false;
1063 X509_STORE
*store
= SSL_CTX_get_cert_store(connContext
.get());
1064 if (X509_STORE_CTX_init(storeCtx
, store
, nullptr, nullptr)) {
1065 X509
*issuer
= nullptr;
1066 gotIssuer
= (X509_STORE_CTX_get1_issuer(&issuer
, storeCtx
, cert
) > 0);
1070 const int ssl_error
= ERR_get_error();
1071 debugs(83, DBG_IMPORTANT
, "Failed to initialize STORE_CTX object: " << Security::ErrorString(ssl_error
));
1073 X509_STORE_CTX_free(storeCtx
);
1079 Ssl::uriOfIssuerIfMissing(X509
*cert
, Security::CertList
const &serverCertificates
, const Security::ContextPointer
&context
)
1081 if (!cert
|| !serverCertificates
.size())
1084 if (!findCertIssuer(serverCertificates
, cert
)) {
1085 //if issuer is missing
1086 if (const char *issuerUri
= hasAuthorityInfoAccessCaIssuers(cert
)) {
1087 // There is a URI where we can download a certificate.
1088 if (!findCertIssuerFast(SquidUntrustedCerts
, cert
) &&
1089 !issuerExistInCaDb(cert
, context
)) {
1090 // and issuer not found in local databases containing
1091 // untrusted certificates and trusted CA certificates
1100 Ssl::missingChainCertificatesUrls(std::queue
<SBuf
> &URIs
, Security::CertList
const &serverCertificates
, const Security::ContextPointer
&context
)
1102 if (!serverCertificates
.size())
1105 for (const auto &i
: serverCertificates
) {
1106 if (const char *issuerUri
= uriOfIssuerIfMissing(i
.get(), serverCertificates
, context
))
1107 URIs
.push(SBuf(issuerUri
));
1112 Ssl::SSL_add_untrusted_cert(SSL
*ssl
, X509
*cert
)
1114 STACK_OF(X509
) *untrustedStack
= static_cast <STACK_OF(X509
) *>(SSL_get_ex_data(ssl
, ssl_ex_index_ssl_untrusted_chain
));
1115 if (!untrustedStack
) {
1116 untrustedStack
= sk_X509_new_null();
1117 if (!SSL_set_ex_data(ssl
, ssl_ex_index_ssl_untrusted_chain
, untrustedStack
)) {
1118 sk_X509_pop_free(untrustedStack
, X509_free
);
1119 throw TextException("Failed to attach untrusted certificates chain");
1122 sk_X509_push(untrustedStack
, cert
);
1125 /// Search for the issuer certificate of cert in sk list.
1127 sk_x509_findIssuer(STACK_OF(X509
) *sk
, X509
*cert
)
1132 const int skItemsNum
= sk_X509_num(sk
);
1133 for (int i
= 0; i
< skItemsNum
; ++i
) {
1134 X509
*issuer
= sk_X509_value(sk
, i
);
1135 if (X509_check_issued(issuer
, cert
) == X509_V_OK
)
1141 /// add missing issuer certificates to untrustedCerts
1143 completeIssuers(X509_STORE_CTX
*ctx
, STACK_OF(X509
) *untrustedCerts
)
1145 debugs(83, 2, "completing " << sk_X509_num(untrustedCerts
) << " OpenSSL untrusted certs using " << SquidUntrustedCerts
.size() << " configured untrusted certificates");
1147 #if HAVE_LIBCRYPTO_X509_VERIFY_PARAM_GET_DEPTH
1148 const X509_VERIFY_PARAM
*param
= X509_STORE_CTX_get0_param(ctx
);
1149 int depth
= X509_VERIFY_PARAM_get_depth(param
);
1151 int depth
= ctx
->param
->depth
;
1153 X509
*current
= X509_STORE_CTX_get0_cert(ctx
);
1155 for (i
= 0; current
&& (i
< depth
); ++i
) {
1156 if (X509_check_issued(current
, current
) == X509_V_OK
) {
1157 // either ctx->cert is itself self-signed or untrustedCerts
1158 // aready contain the self-signed current certificate
1162 // untrustedCerts is short, not worth indexing
1163 X509
*issuer
= sk_x509_findIssuer(untrustedCerts
, current
);
1165 if ((issuer
= findCertIssuerFast(SquidUntrustedCerts
, current
)))
1166 sk_X509_push(untrustedCerts
, issuer
);
1172 debugs(83, 2, "exceeded the maximum certificate chain length: " << depth
);
1175 /// OpenSSL certificate validation callback.
1177 untrustedToStoreCtx_cb(X509_STORE_CTX
*ctx
,void *data
)
1179 debugs(83, 4, "Try to use pre-downloaded intermediate certificates");
1181 SSL
*ssl
= static_cast<SSL
*>(X509_STORE_CTX_get_ex_data(ctx
, SSL_get_ex_data_X509_STORE_CTX_idx()));
1182 STACK_OF(X509
) *sslUntrustedStack
= static_cast <STACK_OF(X509
) *>(SSL_get_ex_data(ssl
, ssl_ex_index_ssl_untrusted_chain
));
1184 // OpenSSL already maintains ctx->untrusted but we cannot modify
1185 // internal OpenSSL list directly. We have to give OpenSSL our own
1186 // list, but it must include certificates on the OpenSSL ctx->untrusted
1187 #if HAVE_LIBCRYPTO_X509_STORE_CTX_GET0_UNTRUSTED
1188 STACK_OF(X509
) *oldUntrusted
= X509_STORE_CTX_get0_untrusted(ctx
);
1190 STACK_OF(X509
) *oldUntrusted
= ctx
->untrusted
;
1192 STACK_OF(X509
) *sk
= sk_X509_dup(oldUntrusted
); // oldUntrusted is always not NULL
1194 for (int i
= 0; i
< sk_X509_num(sslUntrustedStack
); ++i
) {
1195 X509
*cert
= sk_X509_value(sslUntrustedStack
, i
);
1196 sk_X509_push(sk
, cert
);
1199 // If the local untrusted certificates internal database is used
1200 // run completeIssuers to add missing certificates if possible.
1201 if (SquidUntrustedCerts
.size() > 0)
1202 completeIssuers(ctx
, sk
);
1204 X509_STORE_CTX_set_chain(ctx
, sk
); // No locking/unlocking, just sets ctx->untrusted
1205 int ret
= X509_verify_cert(ctx
);
1206 #if HAVE_LIBCRYPTO_X509_STORE_CTX_SET0_UNTRUSTED
1207 X509_STORE_CTX_set0_untrusted(ctx
, oldUntrusted
);
1209 X509_STORE_CTX_set_chain(ctx
, oldUntrusted
); // Set back the old untrusted list
1211 sk_X509_free(sk
); // Release sk list
1216 Ssl::useSquidUntrusted(SSL_CTX
*sslContext
)
1218 SSL_CTX_set_cert_verify_callback(sslContext
, untrustedToStoreCtx_cb
, NULL
);
1222 Ssl::loadSquidUntrusted(const char *path
)
1224 return Ssl::loadCerts(path
, SquidUntrustedCerts
);
1228 Ssl::unloadSquidUntrusted()
1230 if (SquidUntrustedCerts
.size()) {
1231 for (Ssl::CertsIndexedList::iterator it
= SquidUntrustedCerts
.begin(); it
!= SquidUntrustedCerts
.end(); ++it
) {
1232 X509_free(it
->second
);
1234 SquidUntrustedCerts
.clear();
1239 \ingroup ServerProtocolSSLInternal
1240 * Read certificate from file.
1241 * See also: static readSslX509Certificate function, gadgets.cc file
1243 static X509
* readSslX509CertificatesChain(char const * certFilename
, Security::CertList
&chain
)
1247 Ssl::BIO_Pointer
bio(BIO_new(BIO_s_file()));
1250 if (!BIO_read_filename(bio
.get(), certFilename
))
1252 X509
*certificate
= PEM_read_bio_X509(bio
.get(), NULL
, NULL
, NULL
);
1256 if (X509_check_issued(certificate
, certificate
) == X509_V_OK
)
1257 debugs(83, 5, "Certificate is self-signed, will not be chained");
1259 // and add to the chain any other certificate exist in the file
1260 while (X509
*ca
= PEM_read_bio_X509(bio
.get(), nullptr, nullptr, nullptr))
1261 chain
.emplace_front(Security::CertPointer(ca
));
1269 Ssl::readCertChainAndPrivateKeyFromFiles(Security::CertPointer
& cert
, Security::PrivateKeyPointer
& pkey
, Security::CertList
&chain
, char const * certFilename
, char const * keyFilename
)
1271 if (keyFilename
== NULL
)
1272 keyFilename
= certFilename
;
1274 if (certFilename
== NULL
)
1275 certFilename
= keyFilename
;
1277 debugs(83, DBG_IMPORTANT
, "Using certificate in " << certFilename
);
1279 // XXX: ssl_ask_password_cb needs SSL_CTX_set_default_passwd_cb_userdata()
1280 // so this may not fully work iff Config.Program.ssl_password is set.
1281 pem_password_cb
*cb
= ::Config
.Program
.ssl_password
? &ssl_ask_password_cb
: NULL
;
1282 Ssl::ReadPrivateKeyFromFile(keyFilename
, pkey
, cb
);
1283 cert
.resetWithoutLocking(readSslX509CertificatesChain(certFilename
, chain
));
1285 debugs(83, DBG_IMPORTANT
, "WARNING: missing cert in '" << certFilename
<< "'");
1287 debugs(83, DBG_IMPORTANT
, "WARNING: missing private key in '" << keyFilename
<< "'");
1288 } else if (!X509_check_private_key(cert
.get(), pkey
.get())) {
1289 debugs(83, DBG_IMPORTANT
, "WARNING: X509_check_private_key() failed to verify signing cert");
1291 return; // everything is okay
1297 bool Ssl::generateUntrustedCert(Security::CertPointer
&untrustedCert
, Security::PrivateKeyPointer
&untrustedPkey
, Security::CertPointer
const &cert
, Security::PrivateKeyPointer
const & pkey
)
1299 // Generate the self-signed certificate, using a hard-coded subject prefix
1300 Ssl::CertificateProperties certProperties
;
1301 if (const char *cn
= CommonHostName(cert
.get())) {
1302 certProperties
.commonName
= "Not trusted by \"";
1303 certProperties
.commonName
+= cn
;
1304 certProperties
.commonName
+= "\"";
1305 } else if (const char *org
= getOrganization(cert
.get())) {
1306 certProperties
.commonName
= "Not trusted by \"";
1307 certProperties
.commonName
+= org
;
1308 certProperties
.commonName
+= "\"";
1310 certProperties
.commonName
= "Not trusted";
1311 certProperties
.setCommonName
= true;
1312 // O, OU, and other CA subject fields will be mimicked
1313 // Expiration date and other common properties will be mimicked
1314 certProperties
.signAlgorithm
= Ssl::algSignSelf
;
1315 certProperties
.signWithPkey
.resetAndLock(pkey
.get());
1316 certProperties
.mimicCert
.resetAndLock(cert
.get());
1317 return Ssl::generateSslCertificate(untrustedCert
, untrustedPkey
, certProperties
);
1320 void Ssl::InRamCertificateDbKey(const Ssl::CertificateProperties
&certProperties
, SBuf
&key
)
1322 bool origSignatureAsKey
= false;
1323 if (certProperties
.mimicCert
) {
1324 if (auto *sig
= Ssl::X509_get_signature(certProperties
.mimicCert
)) {
1325 origSignatureAsKey
= true;
1326 key
.append((const char *)sig
->data
, sig
->length
);
1330 if (!origSignatureAsKey
|| certProperties
.setCommonName
) {
1331 // Use common name instead
1332 key
.append(certProperties
.commonName
.c_str());
1334 key
.append(certProperties
.setCommonName
? '1' : '0');
1335 key
.append(certProperties
.setValidAfter
? '1' : '0');
1336 key
.append(certProperties
.setValidBefore
? '1' : '0');
1337 key
.append(certProperties
.signAlgorithm
!= Ssl:: algSignEnd
? certSignAlgorithm(certProperties
.signAlgorithm
) : "-");
1338 key
.append(certProperties
.signHash
? EVP_MD_name(certProperties
.signHash
) : "-");
1340 if (certProperties
.mimicCert
) {
1341 Ssl::BIO_Pointer
bio(BIO_new_SBuf(&key
));
1342 ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509
), bio
.get(), (ASN1_VALUE
*)certProperties
.mimicCert
.get());
1347 bio_sbuf_create(BIO
* bio
)
1349 BIO_set_init(bio
, 0);
1350 BIO_set_data(bio
, NULL
);
1355 bio_sbuf_destroy(BIO
* bio
)
1363 bio_sbuf_write(BIO
* bio
, const char* data
, int len
)
1365 SBuf
*buf
= static_cast<SBuf
*>(BIO_get_data(bio
));
1366 // TODO: Convert exceptions into BIO errors
1367 buf
->append(data
, len
);
1372 bio_sbuf_puts(BIO
* bio
, const char* data
)
1374 // TODO: use bio_sbuf_write() instead
1375 SBuf
*buf
= static_cast<SBuf
*>(BIO_get_data(bio
));
1376 size_t oldLen
= buf
->length();
1378 return buf
->length() - oldLen
;
1382 bio_sbuf_ctrl(BIO
* bio
, int cmd
, long num
, void* ptr
) {
1383 SBuf
*buf
= static_cast<SBuf
*>(BIO_get_data(bio
));
1385 case BIO_CTRL_RESET
:
1386 // TODO: Convert exceptions into BIO errors
1389 case BIO_CTRL_FLUSH
:
1396 BIO
*Ssl::BIO_new_SBuf(SBuf
*buf
)
1398 #if HAVE_LIBCRYPTO_BIO_METH_NEW
1399 static BIO_METHOD
*BioSBufMethods
= nullptr;
1400 if (!BioSBufMethods
) {
1401 BioSBufMethods
= BIO_meth_new(BIO_TYPE_MEM
, "Squid-SBuf");
1402 BIO_meth_set_write(BioSBufMethods
, bio_sbuf_write
);
1403 BIO_meth_set_read(BioSBufMethods
, nullptr);
1404 BIO_meth_set_puts(BioSBufMethods
, bio_sbuf_puts
);
1405 BIO_meth_set_gets(BioSBufMethods
, nullptr);
1406 BIO_meth_set_ctrl(BioSBufMethods
, bio_sbuf_ctrl
);
1407 BIO_meth_set_create(BioSBufMethods
, bio_sbuf_create
);
1408 BIO_meth_set_destroy(BioSBufMethods
, bio_sbuf_destroy
);
1411 static BIO_METHOD
*BioSBufMethods
= new BIO_METHOD({
1424 BIO
*bio
= BIO_new(BioSBufMethods
);
1426 BIO_set_data(bio
, buf
);
1427 BIO_set_init(bio
, 1);
1431 #endif /* USE_OPENSSL */