done
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL version >= 0.9.7" >&5
-$as_echo_n "checking for OpenSSL version >= 0.9.7... " >&6; }
+ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL version >= 1.0.2" >&5
+$as_echo_n "checking for OpenSSL version >= 1.0.2... " >&6; }
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
#include <openssl/crypto.h>
- #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+ #if (OPENSSL_VERSION_NUMBER >= 0x10002000L)
yes
#endif
]
)
- AC_MSG_CHECKING([for OpenSSL version >= 0.9.7])
+ AC_MSG_CHECKING([for OpenSSL version >= 1.0.2])
AC_EGREP_CPP(yes,
[#include <openssl/crypto.h>
- #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+ #if (OPENSSL_VERSION_NUMBER >= 0x10002000L)
yes
#endif
],
#
# Parameters for the OAEP RSA padding scheme.
#
- # NOTE: Only available when using OpenSSL >= 1.0.2
- #
oaep {
# oaep_digest = "sha256"
# mgf1_digest = "sha256"
# The key type does not need to be explicitly specified as
# it is determined from the certificate provided.
#
- # Note: OpenSSL >= 1.0.2 is required for crypto agility to
- # function correctly.
- #
chain {
#
# The format of the certificate(s) and private key file.
#
certificate_file = ${certdir}/rsa/server.pem
- #
- # Only available with OpenSSL >= 1.0.2
#
# Load an additional intermediary CA or Root CA for consideration in
# chain compilation. Multiple "ca_file" config items may be used
private_key_file = ${certdir}/rsa/server.key
#
- # With OpenSSL >= 1.0.2 we attempt to precompile the certificate chain
+ # During startup we attempt to precompile the certificate chain
# from server certificate to Root CA. This configuration item specifies
# what happens if compilation fails.
#
#
# verify_mode = "hard"
- #
- # Only available with OpenSSL >= 1.0.2
#
# Omit the Root CA from the compiled certificate chain.
# The Root CA should already be known/trusted by the client so it is
# https://mitls.org/pages/attacks/3SHAKE
#
# Note: This attack is undetectable by the client.
- # Note: Only supported with OpenSSL >= 1.1.0
#
# require_extended_master_secret = yes
# Only allow session resumption if a cipher which would
# allow perfect forward secrecy has been selected.
#
- # Note: Only enforced with OpenSSL >= 1.1.0
- #
# require_perfect_forward_secrecy = no
# As of 4.0 OpenSSL's internal cache has been disabled due to
uint8_t scratch[sizeof(out)];
uint8_t master_key[SSL_MAX_MASTER_KEY_LENGTH];
-#if OPENSSL_VERSION_NUMBER >= 0x10001000L
- if (SSL_export_keying_material(ssl, out, sizeof(out), prf_label, prf_label_len, NULL, 0, 0) != 1) /* Fallback */
-#endif
-
- {
+ if (SSL_export_keying_material(ssl, out, sizeof(out), prf_label, prf_label_len, NULL, 0, 0) != 1) {
p = seed;
memcpy(p, prf_label, seed_len);
p += seed_len;
uint8_t master_key[SSL_MAX_MASTER_KEY_LENGTH];
uint8_t seed[128 + (2 * SSL3_RANDOM_SIZE)];
-#if OPENSSL_VERSION_NUMBER >= 0x10001000L
if (SSL_export_keying_material(s, buffer, size, prf_label,
strlen(prf_label), NULL, 0, 0) == 1) return;
-#endif
-
len = strlen(prf_label);
if (len > 128) len = 128;
#endif
);
-#ifdef WITH_TLS
+
dependency_feature_add(cs, "tls-key-agility",
-# if OPENSSL_VERSION_NUMBER >= 0x10002000L
+#ifdef WITH_TLS
true
-# else
+#else
false
-# endif
- );
#endif
+ );
dependency_feature_add(cs, "unlang",
#ifdef WITH_UNLANG
*/
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
# define FR_TLS_REMOVE_THREAD_STATE()
-#elif OPENSSL_VERSION_NUMBER >= 0x10000000L
-# define FR_TLS_REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
#else
-# define FR_TLS_REMOVE_THREAD_STATE() ERR_remove_state(0);
+# define FR_TLS_REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
#endif
/*
typedef struct {
SSL_CTX *ctx; //!< TLS configuration context.
SSL *ssl; //!< This SSL session.
-#if OPENSSL_VERSION_NUMBER >= 0x10001000L
SSL_SESSION *session; //!< Session resumption data.
-#endif
tls_info_t info; //!< Information about the state of the TLS session.
BIO *into_ssl; //!< Basic I/O input to OpenSSL.
} fr_tls_ocsp_conf_t;
#endif
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
/** Different chain building modes
*
*/
///< the leaf cert back to a root.
FR_TLS_CHAIN_VERIFY_NONE //!< Don't verify/build the chain.
} fr_tls_chain_verify_mode_t;
-#endif
/** Structure representing a certificate chain configuration
*
char const *password; //!< Password to decrypt the certificate(s).
char const *private_key_file; //!< Path to certificate.
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
char const **ca_files; //!< Extra certificates to load.
fr_tls_chain_verify_mode_t verify_mode; //!< How hard we try to build up a complete certificate
///< chain.
-#endif
bool include_root_ca; //!< Include the root ca in the chain we built.
} fr_tls_chain_conf_t;
//!< with ocsp.
#endif
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
-# ifndef OPENSSL_NO_ECDH
+#ifndef OPENSSL_NO_ECDH
char const *ecdh_curve;
-# endif
#endif
#ifdef PSK_MAX_IDENTITY_LEN
.name = "OCSP status request extension",
.comment = "For more information see https://www.openssl.org/news/secadv/20160922.txt"
},
- {
- .low = VM(1,0,1), /* 1.0.1 */
- .high = Vm(1,0,1,'t'), /* 1.0.1t */
- .id = "CVE-2016-6304",
- .name = "OCSP status request extension",
- .comment = "For more information see https://www.openssl.org/news/secadv/20160922.txt"
- },
- {
- .low = VM(1,0,1), /* 1.0.1 */
- .high = Vm(1,0,1,'f'), /* 1.0.1f */
- .id = "CVE-2014-0160",
- .name = "Heartbleed",
- .comment = "For more information see http://heartbleed.com"
- },
};
#endif /* ENABLE_OPENSSL_VERSION_CHECK */
* Use preprocessor magic to get the right function and argument
* to use. This avoids ifdef's through the rest of the code.
*/
-#if OPENSSL_VERSION_NUMBER < 0x10000000L
-#define ssl_id_function _thread_id
-#define set_id_callback CRYPTO_set_id_callback
-
-#else
static void ssl_id_function(CRYPTO_THREADID *id)
{
CRYPTO_THREADID_set_numeric(id, _thread_id());
}
#define set_id_callback CRYPTO_THREADID_set_callback
-#endif
static void _global_mutex(int mode, int n, UNUSED char const *file, UNUSED int line)
*/
inline static ssize_t tls_cache_id(uint8_t const **out, SSL_SESSION *sess)
{
-#if OPENSSL_VERSION_NUMBER < 0x10001000L
- *out = sess->session_id;
- return sess->session_id_length;
-#else
unsigned int len;
*out = SSL_SESSION_get_id(sess, &len);
return len;
-#endif
}
/** Write a newly created session data to the tls_session structure
* will be called, so better to remove the session
* directly.
*/
- SSL_CTX_remove_session(session->ctx, session->ssl_session);
+ SSL_CTX_remove_session(session->ctx, session->session);
}
/** Prevent a TLS session from being resumed in future
if (vp && (vp->vp_uint32 == 0)) {
RDEBUG2("&control:Allow-Session-Resumption == no, disabling session resumption");
disable:
- SSL_CTX_remove_session(session->ctx, session->ssl_session);
+ SSL_CTX_remove_session(session->ctx, session->session);
session->allow_session_resumption = false;
return 1;
}
{ NULL, 0 },
};
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
static const FR_NAME_NUMBER chain_verify_mode_table[] = {
{ "hard", FR_TLS_CHAIN_VERIFY_HARD },
{ "soft", FR_TLS_CHAIN_VERIFY_SOFT },
{ "none", FR_TLS_CHAIN_VERIFY_NONE },
{ NULL, 0 },
};
-#endif
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
static int chain_verify_mode_parse(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent,
CONF_ITEM *ci, UNUSED CONF_PARSER const *rule);
-#endif
static int certificate_format_type_parse(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent,
CONF_ITEM *ci, UNUSED CONF_PARSER const *rule);
{ FR_CONF_OFFSET("private_key_password", FR_TYPE_STRING | FR_TYPE_SECRET, fr_tls_chain_conf_t, password) },
{ FR_CONF_OFFSET("private_key_file", FR_TYPE_FILE_INPUT | FR_TYPE_REQUIRED, fr_tls_chain_conf_t, private_key_file) },
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
{ FR_CONF_OFFSET("ca_file", FR_TYPE_FILE_INPUT | FR_TYPE_MULTI, fr_tls_chain_conf_t, ca_files) },
{ FR_CONF_OFFSET("verify_mode", FR_TYPE_VOID, fr_tls_chain_conf_t, verify_mode), .dflt = "hard", .func = chain_verify_mode_parse },
{ FR_CONF_OFFSET("include_root_ca", FR_TYPE_BOOL, fr_tls_chain_conf_t, include_root_ca), .dflt = "no" },
-#endif
CONF_PARSER_TERMINATOR
};
{ FR_CONF_OFFSET("check_cert_issuer", FR_TYPE_STRING, fr_tls_conf_t, check_cert_issuer) },
{ FR_CONF_OFFSET("require_client_cert", FR_TYPE_BOOL, fr_tls_conf_t, require_client_cert) },
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
#ifndef OPENSSL_NO_ECDH
{ FR_CONF_OFFSET("ecdh_curve", FR_TYPE_STRING, fr_tls_conf_t, ecdh_curve), .dflt = "prime256v1" },
-#endif
#endif
{ FR_CONF_OFFSET("tls_max_version", FR_TYPE_FLOAT32, fr_tls_conf_t, tls_max_version) },
{ FR_CONF_OFFSET("cipher_list", FR_TYPE_STRING, fr_tls_conf_t, cipher_list) },
{ FR_CONF_OFFSET("check_cert_issuer", FR_TYPE_STRING, fr_tls_conf_t, check_cert_issuer) },
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
#ifndef OPENSSL_NO_ECDH
{ FR_CONF_OFFSET("ecdh_curve", FR_TYPE_STRING, fr_tls_conf_t, ecdh_curve), .dflt = "prime256v1" },
-#endif
#endif
{ FR_CONF_OFFSET("tls_max_version", FR_TYPE_FLOAT32, fr_tls_conf_t, tls_max_version) },
CONF_PARSER_TERMINATOR
};
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
/** Calls to convert verify_mode strings into macros
*
* @param[in] ctx to allocate data in.
return 0;
}
-#endif
/** Calls to convert format strings to OpenSSL macros
*
if (tls_ocsp_staple_cache_compile(&conf->staple.cache, server_cs) < 0) goto error;
}
-#ifdef SSL_OP_NO_TLSv1_2
- /*
- * OpenSSL 1.0.1f and 1.0.1g get the MS-MPPE keys wrong.
- */
-#if (OPENSSL_VERSION_NUMBER >= 0x10010060L) && (OPENSSL_VERSION_NUMBER < 0x10010060L)
- conf->max_tls_version = 1.1;
- WARN("OpenSSL version in range 1.0.1f-1.0.1g. "
- "TLSv1.2 disabled to workaround broken keying material export");
-#endif
-#endif
-
/*
* Cache conf in cs in case we're asked to parse this again.
*/
#include "base.h"
#include "missing.h"
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
-# ifndef OPENSSL_NO_ECDH
+#ifndef OPENSSL_NO_ECDH
static int ctx_ecdh_curve_set(SSL_CTX *ctx, char const *ecdh_curve, bool disable_single_dh_use)
{
int nid;
return 0;
}
-# endif
#endif
/*
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
{
size_t extra_cnt, i;
/*
SSL_CTX_add0_chain_cert(ctx, cert);
}
}
-#endif
/*
* Check if the last loaded private key matches the last
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
{
int mode = SSL_BUILD_CHAIN_FLAG_CHECK;
break;
}
}
-#endif
return 0;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
static void _tls_ctx_print_cert_line(int index, X509 *cert)
{
char subject[1024];
DEBUG3("[%i] %s %s", index, tls_utils_x509_pkey_type(cert), subject);
}
-#endif
/** Create SSL context
*
{
SSL_CTX *ctx;
X509_STORE *cert_vpstore;
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
X509_STORE *chain_store;
X509_STORE *verify_store;
-#endif
int verify_mode = SSL_VERIFY_NONE;
int ctx_options = 0;
void *app_data_index;
if (mode) SSL_CTX_set_mode(ctx, mode);
}
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
/*
* If we're using a sufficiently new version of
* OpenSSL, initialise different stores for creating
MEM(verify_store = X509_STORE_new());
SSL_CTX_set0_verify_cert_store(ctx, verify_store);
}
-#endif
+
/*
* Load the CAs we trust
*/
}
}
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
/*
* Print out our certificate chains.
*
}
(void)SSL_CTX_set_current_cert(ctx, SSL_CERT_SET_FIRST); /* Reset */
}
-#endif
}
/*
/*
* Set eliptical curve crypto configuration.
*/
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
#ifndef OPENSSL_NO_ECDH
if (ctx_ecdh_curve_set(ctx, conf->ecdh_curve, conf->disable_single_dh_use) < 0) {
goto error;
}
-#endif
#endif
/* Set Info callback */
return outlen;
}
#endif
-
-#if OPENSSL_VERSION_NUMBER < 0x10001000L
-# define ssl_session ssl->session
-#else
-# define ssl_session session
-#endif
ocsp_status_t status;
ASN1_GENERALIZEDTIME *rev, *this_update, *next_update;
int reason;
-#if OPENSSL_VERSION_NUMBER >= 0x1000003f
OCSP_REQ_CTX *ctx;
int rc;
struct timeval when;
-#endif
struct timeval now = { 0, 0 };
time_t next;
VALUE_PAIR *vp;
conn = BIO_new_connect(host);
BIO_set_conn_port(conn, port);
-#if OPENSSL_VERSION_NUMBER < 0x1000003f
- BIO_do_connect(conn);
-
- /* Send OCSP request and wait for response */
- resp = OCSP_sendreq_bio(conn, path, req);
- if (!resp) {
- REDEBUG("Couldn't get OCSP response");
- ocsp_status = OCSP_STATUS_SKIPPED;
- goto finish;
- }
-#else
if (conf->timeout) BIO_set_nbio(conn, 1);
rc = BIO_do_connect(conn);
ocsp_status = OCSP_STATUS_SKIPPED;
goto finish;
}
-#endif /* OPENSSL_VERSION_NUMBER < 0x1000003f */
/* Verify OCSP response status */
status = OCSP_response_status(resp);
#endif
/*
- * OpenSSL 1.0.2 calls this function with 'pseudo'
+ * OpenSSL >= 1.0.2 calls this function with 'pseudo'
* content types. Which breaks our tracking of
* the SSL Session state.
*/
REXDENT();
}
-#if OPENSSL_VERSION_NUMBER >= 0x10001000L
/*
* Cache the SSL_SESSION pointer.
*
* Which contains all the data we need for session resumption.
*/
- if (!session->ssl_session) {
- session->ssl_session = SSL_get_session(session->ssl);
- if (!session->ssl_session) {
+ if (!session->session) {
+ session->session = SSL_get_session(session->ssl);
+ if (!session->session) {
REDEBUG("Failed getting TLS session");
return 0;
}
MEM(ssl_log = BIO_new(BIO_s_mem()));
- if (SSL_SESSION_print(ssl_log, session->ssl_session) == 1) {
+ if (SSL_SESSION_print(ssl_log, session->session) == 1) {
SSL_DRAIN_ERROR_QUEUE(RDEBUG3, "", ssl_log);
} else {
RDEBUG3("Failed retrieving session data");
}
BIO_free(ssl_log);
}
-#endif
/*
* Session was resumed, add attribute to mark it as such.
uint8_t *digest_buff; //!< Pre-allocated digest buffer.
} rlm_cipher_rsa_thread_inst_t;
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
/** Configuration for the OAEP padding method
*
*/
char const *label; //!< Additional input to the hashing function.
} cipher_rsa_oaep_t;
-#endif
/** Configuration for RSA encryption/decryption/signing
*
EVP_MD *sig_digest; //!< Signature digest type.
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
cipher_rsa_oaep_t *oaep; //!< OAEP can use a configurable message digest type
-#endif ///< and additional keying labeleter.
} cipher_rsa_t;
/** Instance configuration
};
} rlm_cipher_t;
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
/** Configuration for the RSA-PCKS1-OAEP padding scheme
*
*/
CONF_PARSER_TERMINATOR
};
-#endif
/** Configuration for the RSA cipher type
*
{ FR_CONF_OFFSET("padding_type", FR_TYPE_VOID | FR_TYPE_NOT_EMPTY, cipher_rsa_t, padding), .func = cipher_rsa_padding_type_parse, .dflt = "pkcs" },
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
{ FR_CONF_OFFSET("oaep", FR_TYPE_SUBSECTION, cipher_rsa_t, oaep),
.subcs_size = sizeof(cipher_rsa_oaep_t), .subcs_type = "cipher_rsa_oaep_t", .subcs = (void const *) rsa_oaep_config },
-#endif
+
CONF_PARSER_TERMINATOR
};
* Configure OAEP advanced padding options
*/
case RSA_PKCS1_OAEP_PADDING:
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
if (unlikely(EVP_PKEY_CTX_set_rsa_oaep_md(evp_pkey_ctx, rsa_inst->oaep->oaep_digest) <= 0)) {
tls_strerror_printf(NULL);
PERROR("%s: Failed setting OAEP digest", __FUNCTION__);
return -1;
}
}
-#endif
return 0;
default:
projects / thirdparty / freeradius-server.git / commitdiff
