dhparams=/path/to/file.pem https_port option to specify DH parameters

for forward-secrecy in encryption (practically denies decryption even
if the private key is known from what I understand).

diff --git a/src/cache_cf.cc b/src/cache_cf.cc
index 8aff02feabd46af9726f05c8214a46727be54e5a..7c3039e9c7731c18448ce193bbb3f66dd39d01eb 100644 (file)
--- a/src/cache_cf.cc
+++ b/src/cache_cf.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: cache_cf.cc,v 1.438 2003/03/10 04:56:36 robertc Exp $
+ * $Id: cache_cf.cc,v 1.439 2003/04/17 15:25:43 hno Exp $
  *
  * DEBUG: section 3     Configuration File Parsing
  * AUTHOR: Harvest Derived
@@ -2907,6 +2907,9 @@ parse_https_port_list(https_port_list ** head)
         } else if (strncmp(token, "capath=", 7) == 0) {
             safe_free(s->capath);
             s->capath = xstrdup(token + 7);
+        } else if (strncmp(token, "dhparams=", 9) == 0) {
+            safe_free(s->dhfile);
+            s->dhfile = xstrdup(token + 9);
         } else if (strncmp(token, "sslflags=", 9) == 0) {
             safe_free(s->sslflags);
             s->sslflags = xstrdup(token + 9);
@@ -2915,7 +2918,7 @@ parse_https_port_list(https_port_list ** head)
         }
     }
 
-    s->sslContext = sslCreateServerContext(s->cert, s->key, s->version, s->cipher, s->options, s->sslflags, s->clientca, s->cafile, s->capath);
+    s->sslContext = sslCreateServerContext(s->cert, s->key, s->version, s->cipher, s->options, s->sslflags, s->clientca, s->cafile, s->capath, s->dhfile);
 
     if (!s->sslContext)
         self_destruct();
@@ -2953,6 +2956,9 @@ dump_https_port_list(StoreEntry * e, const char *n, const https_port_list * s)
         if (s->capath)
             storeAppendPrintf(e, " capath=%s", s->capath);
 
+        if (s->dhfile)
+            storeAppendPrintf(e, " dhparams=%s", s->dhfile);
+
         if (s->sslflags)
             storeAppendPrintf(e, " sslflags=%s", s->sslflags);
 

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 5da6b6d14c876387fc8e8575c3ed1bdac9235944..c04cda18cdcfbeb10814f8081e88e61a3b3f1388 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -1,6 +1,6 @@
 
 #
-# $Id: cf.data.pre,v 1.310 2003/04/14 19:57:10 hno Exp $
+# $Id: cf.data.pre,v 1.311 2003/04/17 15:25:44 hno Exp $
 #
 #
 # SQUID Web Proxy Cache          http://www.squid-cache.org/
@@ -148,8 +148,10 @@ DOC_START
                            NO_SSLv2  Disallow the use of SSLv2
                            NO_SSLv3  Disallow the use of SSLv3
                            NO_TLSv1  Disallow the use of TLSv1
-                       See src/ssl_support.c or OpenSSL documentation
-                       for a more complete list.
+                           SINGLE_DH_USE Always create a new key when using
+                                     temporary/ephemeral DH key exchanges
+                       See src/ssl_support.c or OpenSSL SSL_CTX_set_options
+                       documentation for a complete list of options.
 
           clientca=    File containing the list of CAs to use when
                        requesting a client certificate
@@ -161,6 +163,9 @@ DOC_START
           capath=      Directory containing additional CA certificates
                        to use when verifying client certificates
 
+          dhparams=    File containing DH parameters for temporary/ephemeral
+                       DH key exchanges
+
           sslflags=    Various flags modifying the use of SSL:
                            DELAYED_AUTH
                                Don't request client certificates

diff --git a/src/ssl_support.cc b/src/ssl_support.cc
index 66751787c0fa500cb42f8f991b277249f812ab1a..a9ce482404e2294f44ddd55bf6bcfc5ce1a12a96 100644 (file)
--- a/src/ssl_support.cc
+++ b/src/ssl_support.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: ssl_support.cc,v 1.12 2003/02/21 22:50:11 robertc Exp $
+ * $Id: ssl_support.cc,v 1.13 2003/04/17 15:25:44 hno Exp $
  *
  * AUTHOR: Benno Rice
  * DEBUG: section 83    SSL accelerator support
@@ -419,7 +419,7 @@ ssl_initialize(void)
 }
 
 SSL_CTX *
-sslCreateServerContext(const char *certfile, const char *keyfile, int version, const char *cipher, const char *options, const char *flags, const char *clientCA, const char *CAfile, const char *CApath)
+sslCreateServerContext(const char *certfile, const char *keyfile, int version, const char *cipher, const char *options, const char *flags, const char *clientCA, const char *CAfile, const char *CApath, const char *dhfile)
 {
     int ssl_error;
     SSL_METHOD *method;
@@ -547,6 +547,30 @@ sslCreateServerContext(const char *certfile, const char *keyfile, int version, c
         SSL_CTX_set_verify(sslContext, SSL_VERIFY_NONE, NULL);
     }
 
+    if (dhfile) {
+        FILE *in = fopen(dhfile, "r");
+        DH *dh = NULL;
+        int codes;
+
+        if (in) {
+            dh = PEM_read_DHparams(in, NULL, NULL, NULL);
+            fclose(in);
+        }
+
+        if (!dh)
+            debug(83, 1) ("WARNING: Failed to read DH parameters '%s'\n", dhfile);
+        else if (dh && DH_check(dh, &codes) == 0) {
+            if (codes) {
+                debug(83, 1) ("WARNING: Failed to verify DH parameters '%s' (%x)\n", dhfile, codes);
+                DH_free(dh);
+                dh = NULL;
+            }
+        }
+
+        if (dh)
+            SSL_CTX_set_tmp_dh(sslContext, dh);
+    }
+
     if (fl & SSL_FLAG_DONT_VERIFY_DOMAIN)
         SSL_CTX_set_ex_data(sslContext, ssl_ctx_ex_index_dont_verify_domain, (void *) -1);
 

diff --git a/src/ssl_support.h b/src/ssl_support.h
index 17296e0962cb5145255605b78bb486bd1e0ea5ee..fcc4443b817f50e6736d7921173bedbf2be56c3c 100644 (file)
--- a/src/ssl_support.h
+++ b/src/ssl_support.h
@@ -1,6 +1,6 @@
 
 /*
- * $Id: ssl_support.h,v 1.7 2003/02/17 07:01:37 robertc Exp $
+ * $Id: ssl_support.h,v 1.8 2003/04/17 15:25:44 hno Exp $
  *
  * AUTHOR: Benno Rice
  *
@@ -46,7 +46,7 @@
 #include <openssl/engine.h>
 #endif
 
-SSL_CTX *sslCreateServerContext(const char *certfile, const char *keyfile, int version, const char *cipher, const char *options, const char *flags, const char *clientCA, const char *CAfile, const char *CApath);
+SSL_CTX *sslCreateServerContext(const char *certfile, const char *keyfile, int version, const char *cipher, const char *options, const char *flags, const char *clientCA, const char *CAfile, const char *CApath, const char *dhpath);
 SSL_CTX *sslCreateClientContext(const char *certfile, const char *keyfile, int version, const char *cipher, const char *options, const char *flags, const char *CAfile, const char *CApath);
 int ssl_read_method(int, char *, int);
 int ssl_write_method(int, const char *, int);

diff --git a/src/structs.h b/src/structs.h
index 53f05af048d4083673e75d31df1a9d495e9f1bac..23d7b6b5167e152fc07130977cac3b7163f23cd6 100644 (file)
--- a/src/structs.h
+++ b/src/structs.h
@@ -1,6 +1,6 @@
 
 /*
- * $Id: structs.h,v 1.460 2003/03/15 04:17:41 robertc Exp $
+ * $Id: structs.h,v 1.461 2003/04/17 15:25:44 hno Exp $
  *
  *
  * SQUID Web Proxy Cache          http://www.squid-cache.org/
@@ -195,6 +195,7 @@ struct _https_port_list
     char *clientca;
     char *cafile;
     char *capath;
+    char *dhfile;
     char *sslflags;
     SSL_CTX *sslContext;
 };