mirror of
https://git.hush.is/hush/hush3.git
synced 2025-09-24 00:04:19 -04:00
OpenSSL replaced by WolfSSL
This commit is contained in:
miodragpop
parent
6aac6ed3d7
commit
9ff7565901
10
configure.ac
10
configure.ac
@ -664,8 +664,8 @@ if test x$use_pkgconfig = xyes; then
|
||||
m4_ifdef(
|
||||
[PKG_CHECK_MODULES],
|
||||
[
|
||||
PKG_CHECK_MODULES([SSL], [libssl],, [AC_MSG_ERROR(openssl not found.)])
|
||||
PKG_CHECK_MODULES([CRYPTO], [libcrypto],,[AC_MSG_ERROR(libcrypto not found.)])
|
||||
PKG_CHECK_MODULES([SSL], [wolfssl],, [AC_MSG_ERROR(WolfSSL not found.)])
|
||||
#PKG_CHECK_MODULES([CRYPTO], [libcrypto],,[AC_MSG_ERROR(libcrypto not found.)])
|
||||
if test x$build_bitcoin_utils$build_bitcoind$bitcoin_enable_qt$use_tests != xnononono; then
|
||||
PKG_CHECK_MODULES([EVENT], [libevent],, [AC_MSG_ERROR(libevent not found.)])
|
||||
if test x$TARGET_OS != xwindows; then
|
||||
@ -688,11 +688,11 @@ else
|
||||
# BUG: Fix this:
|
||||
echo 'BUG: configure does not yet check for the following dependencies if pkg-config is not on the system: libcrypto++, gmp'
|
||||
|
||||
AC_CHECK_HEADER([openssl/crypto.h],,AC_MSG_ERROR(libcrypto headers missing))
|
||||
AC_CHECK_HEADER([wolfssl/openssl/crypto.h],,AC_MSG_ERROR(libcrypto headers missing))
|
||||
AC_CHECK_LIB([crypto], [main],CRYPTO_LIBS=-lcrypto, AC_MSG_ERROR(libcrypto missing))
|
||||
|
||||
AC_CHECK_HEADER([openssl/ssl.h],, AC_MSG_ERROR(libssl headers missing),)
|
||||
AC_CHECK_LIB([ssl], [main],SSL_LIBS=-lssl, AC_MSG_ERROR(libssl missing))
|
||||
AC_CHECK_HEADER([wolfssl/ssl.h],, AC_MSG_ERROR(libssl headers missing),)
|
||||
AC_CHECK_LIB([wolfssl], [main],SSL_LIBS=-lwolfssl, AC_MSG_ERROR(libwolfssl missing))
|
||||
|
||||
if test x$build_bitcoin_utils$build_bitcoind$bitcoin_enable_qt$use_tests != xnononono; then
|
||||
AC_CHECK_HEADER([event2/event.h],, AC_MSG_ERROR(libevent headers missing),)
|
||||
|
||||
@ -1,12 +1,12 @@
|
||||
package=libcurl
|
||||
$(package)_version=7.67.0
|
||||
$(package)_dependencies=openssl
|
||||
$(package)_dependencies=wolfssl
|
||||
$(package)_download_path=https://curl.haxx.se/download
|
||||
$(package)_file_name=curl-$($(package)_version).tar.gz
|
||||
$(package)_sha256_hash=52af3361cf806330b88b4fe6f483b6844209d47ae196ac46da4de59bb361ab02
|
||||
$(package)_config_opts_linux=--disable-shared --enable-static --prefix=$(host_prefix) --host=$(host)
|
||||
$(package)_config_opts_mingw32=--enable-mingw --disable-shared --enable-static --prefix=$(host_prefix) --host=x86_64-w64-mingw32
|
||||
$(package)_config_opts_darwin=--disable-shared --enable-static --prefix=$(host_prefix)
|
||||
$(package)_config_opts_linux=--disable-shared --enable-static --with-wolfssl --without-ssl --prefix=$(host_prefix) --host=$(host)
|
||||
$(package)_config_opts_mingw32=--enable-mingw --disable-shared --enable-static --with-wolfssl --without-ssl --prefix=$(host_prefix) --host=x86_64-w64-mingw32
|
||||
$(package)_config_opts_darwin=--disable-shared --enable-static --with-wolfssl --without-ssl --prefix=$(host_prefix)
|
||||
$(package)_cflags_darwin=-mmacosx-version-min=10.9
|
||||
$(package)_conf_tool=./configure
|
||||
|
||||
|
||||
@ -1,113 +0,0 @@
|
||||
package=openssl
|
||||
$(package)_version=1.1.1h
|
||||
$(package)_download_path=https://www.openssl.org/source
|
||||
$(package)_file_name=$(package)-$($(package)_version).tar.gz
|
||||
$(package)_sha256_hash=5c9ca8774bd7b03e5784f26ae9e9e6d749c9da2438545077e6b3d755a06595d9
|
||||
|
||||
define $(package)_set_vars
|
||||
$(package)_config_env=AR="$($(package)_ar)" RANLIB="$($(package)_ranlib)" CC="$($(package)_cc)"
|
||||
$(package)_config_opts=--prefix=$(host_prefix) --openssldir=$(host_prefix)/etc/openssl
|
||||
$(package)_config_opts+=no-afalgeng
|
||||
$(package)_config_opts+=no-asm
|
||||
$(package)_config_opts+=no-async
|
||||
$(package)_config_opts+=no-bf
|
||||
$(package)_config_opts+=no-blake2
|
||||
$(package)_config_opts+=no-camellia
|
||||
#$(package)_config_opts+=no-capieng
|
||||
$(package)_config_opts+=no-cast
|
||||
#$(package)_config_opts+=no-chacha
|
||||
$(package)_config_opts+=no-cmac
|
||||
$(package)_config_opts+=no-cms
|
||||
#$(package)_config_opts+=no-comp
|
||||
$(package)_config_opts+=no-crypto-mdebug
|
||||
$(package)_config_opts+=no-crypto-mdebug-backtrace
|
||||
#$(package)_config_opts+=no-ct
|
||||
#$(package)_config_opts+=no-des
|
||||
$(package)_config_opts+=no-dgram
|
||||
#$(package)_config_opts+=no-dsa
|
||||
$(package)_config_opts+=no-dso
|
||||
$(package)_config_opts+=no-dtls
|
||||
$(package)_config_opts+=no-dtls1
|
||||
$(package)_config_opts+=no-dtls1-method
|
||||
$(package)_config_opts+=no-dynamic-engine
|
||||
#$(package)_config_opts+=no-ec2m
|
||||
#$(package)_config_opts+=no-ec_nistp_64_gcc_128
|
||||
$(package)_config_opts+=no-egd
|
||||
$(package)_config_opts+=no-engine
|
||||
#$(package)_config_opts+=no-err
|
||||
$(package)_config_opts+=no-gost
|
||||
$(package)_config_opts+=no-heartbeats
|
||||
#$(package)_config_opts+=no-idea
|
||||
$(package)_config_opts+=no-md2
|
||||
$(package)_config_opts+=no-md4
|
||||
$(package)_config_opts+=no-mdc2
|
||||
$(package)_config_opts+=no-multiblock
|
||||
$(package)_config_opts+=no-nextprotoneg
|
||||
$(package)_config_opts+=no-ocb
|
||||
#$(package)_config_opts+=no-ocsp
|
||||
#$(package)_config_opts+=no-poly1305
|
||||
#$(package)_config_opts+=no-posix-io
|
||||
$(package)_config_opts+=no-psk
|
||||
$(package)_config_opts+=no-rc2
|
||||
$(package)_config_opts+=no-rc4
|
||||
$(package)_config_opts+=no-rc5
|
||||
$(package)_config_opts+=no-rdrand
|
||||
$(package)_config_opts+=no-rfc3779
|
||||
$(package)_config_opts+=no-rmd160
|
||||
$(package)_config_opts+=no-scrypt
|
||||
$(package)_config_opts+=no-sctp
|
||||
$(package)_config_opts+=no-seed
|
||||
$(package)_config_opts+=no-shared
|
||||
#$(package)_config_opts+=no-sock
|
||||
$(package)_config_opts+=no-srp
|
||||
$(package)_config_opts+=no-srtp
|
||||
$(package)_config_opts+=no-ssl
|
||||
$(package)_config_opts+=no-ssl3
|
||||
$(package)_config_opts+=no-ssl3-method
|
||||
$(package)_config_opts+=no-ssl-trace
|
||||
#$(package)_config_opts+=no-stdio
|
||||
#$(package)_config_opts+=no-tls
|
||||
#$(package)_config_opts+=no-tls1
|
||||
#$(package)_config_opts+=no-tls1-method
|
||||
$(package)_config_opts+=no-ts
|
||||
$(package)_config_opts+=no-ui
|
||||
$(package)_config_opts+=no-unit-test
|
||||
$(package)_config_opts+=no-weak-ssl-ciphers
|
||||
$(package)_config_opts+=no-whirlpool
|
||||
#$(package)_config_opts+=no-zlib
|
||||
#$(package)_config_opts+=no-zlib-dynamic
|
||||
$(package)_config_opts+=$($(package)_cflags) $($(package)_cppflags)
|
||||
$(package)_config_opts+=-DPURIFY
|
||||
$(package)_config_opts_linux=-fPIC -Wa,--noexecstack
|
||||
$(package)_config_opts_x86_64_linux=linux-x86_64
|
||||
$(package)_config_opts_i686_linux=linux-generic32
|
||||
$(package)_config_opts_arm_linux=linux-generic32
|
||||
$(package)_config_opts_aarch64_linux=linux-generic64
|
||||
$(package)_config_opts_mipsel_linux=linux-generic32
|
||||
$(package)_config_opts_mips_linux=linux-generic32
|
||||
$(package)_config_opts_powerpc_linux=linux-generic32
|
||||
$(package)_config_opts_x86_64_darwin=darwin64-x86_64-cc
|
||||
$(package)_config_opts_x86_64_mingw32=mingw64
|
||||
$(package)_config_opts_i686_mingw32=mingw
|
||||
endef
|
||||
|
||||
define $(package)_preprocess_cmds
|
||||
sed -i.old 's/built on: $$$$date/built on: date not available/' util/mkbuildinf.pl && \
|
||||
sed -i.old "s|\"engines\", \"apps\", \"test\"|\"engines\"|" Configure
|
||||
endef
|
||||
|
||||
define $(package)_config_cmds
|
||||
./Configure $($(package)_config_opts)
|
||||
endef
|
||||
|
||||
define $(package)_build_cmds
|
||||
$(MAKE) -j1 build_libs libcrypto.pc libssl.pc openssl.pc
|
||||
endef
|
||||
|
||||
define $(package)_stage_cmds
|
||||
$(MAKE) DESTDIR=$($(package)_staging_dir) -j1 install_sw
|
||||
endef
|
||||
|
||||
define $(package)_postprocess_cmds
|
||||
rm -rf share bin etc
|
||||
endef
|
||||
@ -39,8 +39,8 @@ native_packages := native_ccache
|
||||
wallet_packages=bdb
|
||||
|
||||
ifeq ($(host_os),linux)
|
||||
packages := boost openssl libevent zeromq $(zcash_packages) googletest libcurl #googlemock
|
||||
packages := boost wolfssl libevent zeromq $(zcash_packages) googletest libcurl #googlemock
|
||||
else
|
||||
packages := boost openssl libevent zeromq $(zcash_packages) libcurl googletest #googlemock
|
||||
packages := boost wolfssl libevent zeromq $(zcash_packages) libcurl googletest #googlemock
|
||||
endif
|
||||
|
||||
|
||||
46
depends/packages/wolfssl.mk
Normal file
46
depends/packages/wolfssl.mk
Normal file
@ -0,0 +1,46 @@
|
||||
package=wolfssl
|
||||
$(package)_version=4.5.0
|
||||
$(package)_download_path=https://github.com/wolfSSL/wolfssl/archive
|
||||
$(package)_download_file=v$($(package)_version)-stable.tar.gz
|
||||
$(package)_file_name=wolfssl-$($(package)_version).tar.gz
|
||||
$(package)_sha256_hash=7de62300ce14daa0051bfefc7c4d6302f96cabc768b6ae49eda77523b118250c
|
||||
|
||||
define $(package)_set_vars
|
||||
$(package)_config_env=AR="$($(package)_ar)" RANLIB="$($(package)_ranlib)" CC="$($(package)_cc)"
|
||||
$(package)_config_opts=--prefix=$(host_prefix)
|
||||
$(package)_config_opts+=--enable-static
|
||||
$(package)_config_opts+=--disable-shared
|
||||
$(package)_config_opts+=--disable-examples
|
||||
$(package)_config_opts+=--disable-crypttests
|
||||
$(package)_config_opts+=--enable-keygen
|
||||
$(package)_config_opts+=--enable-certgen
|
||||
$(package)_config_opts+=--enable-enckeys
|
||||
$(package)_config_opts+=--enable-opensslall
|
||||
$(package)_config_opts+=--enable-opensslextra
|
||||
$(package)_config_opts+=--enable-harden
|
||||
endef
|
||||
|
||||
define $(package)_preprocess_cmds
|
||||
cd $($(package)_build_subdir); ./autogen.sh
|
||||
endef
|
||||
|
||||
define $(package)_config_cmds
|
||||
./configure $($(package)_config_opts)
|
||||
endef
|
||||
|
||||
#define $(package)_config_cmds
|
||||
# $($(package)_autoconf)
|
||||
#endef
|
||||
|
||||
define $(package)_build_cmds
|
||||
$(MAKE) -j1 src/libwolfssl.la
|
||||
endef
|
||||
|
||||
define $(package)_stage_cmds
|
||||
$(MAKE) DESTDIR=$($(package)_staging_dir) install-libLTLIBRARIES install-includeHEADERS install-nobase_includeHEADERS install-pkgconfigDATA
|
||||
endef
|
||||
|
||||
#define $(package)_postprocess_cmds
|
||||
# rm -rf bin share
|
||||
#endef
|
||||
|
||||
@ -19,7 +19,7 @@
|
||||
#include "crosschain.h"
|
||||
#include "primitives/transaction.h"
|
||||
#include "cc/CCinclude.h"
|
||||
#include <openssl/sha.h>
|
||||
#include <wolfssl/wolfcrypt/sha.h>
|
||||
#include "cc/CCtokens.h"
|
||||
|
||||
#include "key_io.h"
|
||||
|
||||
@ -1,13 +1,10 @@
|
||||
// Copyright (c) 2019-2020 The Hush developers
|
||||
// Distributed under the GPLv3 software license, see the accompanying
|
||||
// file COPYING or https://www.gnu.org/licenses/gpl-3.0.en.html
|
||||
#include <openssl/conf.h>
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/err.h>
|
||||
|
||||
#ifndef HEADER_DH_H
|
||||
#include <openssl/dh.h>
|
||||
#endif
|
||||
#include <wolfssl/options.h>
|
||||
#include <wolfssl/ssl.h>
|
||||
#include <wolfssl/openssl/dh.h>
|
||||
#include <wolfssl/wolfcrypt/asn.h>
|
||||
|
||||
#include <boost/filesystem.hpp>
|
||||
#include <boost/thread.hpp>
|
||||
@ -23,7 +20,7 @@ namespace hush
|
||||
// it is OK to hard code it (or as an alternative to read it from a file)
|
||||
// ----
|
||||
// generated via: openssl dhparam -C 2048
|
||||
static DH *get_dh2048(void)
|
||||
static WOLFSSL_DH *get_dh2048(void)
|
||||
{
|
||||
static unsigned char dhp_2048[] = {
|
||||
0xFF, 0x4A, 0xA8, 0x6C, 0x68, 0xD4, 0x4C, 0x41, 0x73, 0x8D,
|
||||
@ -56,24 +53,20 @@ static DH *get_dh2048(void)
|
||||
static unsigned char dhg_2048[] = {
|
||||
0x02
|
||||
};
|
||||
DH *dh = DH_new();
|
||||
BIGNUM *p, *g;
|
||||
|
||||
|
||||
WOLFSSL_DH *dh = wolfSSL_DH_new();
|
||||
|
||||
if (dh == NULL)
|
||||
return NULL;
|
||||
p = BN_bin2bn(dhp_2048, sizeof(dhp_2048), NULL);
|
||||
g = BN_bin2bn(dhg_2048, sizeof(dhg_2048), NULL);
|
||||
if (p == NULL || g == NULL
|
||||
|| !DH_set0_pqg(dh, p, NULL, g)) {
|
||||
DH_free(dh);
|
||||
BN_free(p);
|
||||
BN_free(g);
|
||||
|
||||
if (wc_DhSetKey((DhKey*)dh->internal, dhp_2048, sizeof(dhp_2048), dhg_2048, sizeof(dhg_2048)) != 0) {
|
||||
wolfSSL_DH_free(dh);
|
||||
return NULL;
|
||||
}
|
||||
return dh;
|
||||
}
|
||||
|
||||
DH *tmp_dh_callback(SSL *ssl, int is_export, int keylength)
|
||||
DH *tmp_dh_callback(WOLFSSL *ssl, int is_export, int keylength)
|
||||
{
|
||||
LogPrint("tls", "TLS: %s: %s():%d - Using Diffie-Hellman param for PFS: is_export=%d, keylength=%d\n",
|
||||
__FILE__, __func__, __LINE__, is_export, keylength);
|
||||
@ -82,64 +75,53 @@ DH *tmp_dh_callback(SSL *ssl, int is_export, int keylength)
|
||||
}
|
||||
|
||||
/** if 'tls' debug category is enabled, collect info about certificates relevant to the passed context and print them on logs */
|
||||
static void dumpCertificateDebugInfo(int preverify_ok, X509_STORE_CTX* chainContext)
|
||||
static void dumpCertificateDebugInfo(int preverify_ok, WOLFSSL_X509_STORE_CTX* chainContext)
|
||||
{
|
||||
if (!LogAcceptCategory("tls") )
|
||||
if (!LogAcceptCategory("tls")) {
|
||||
return;
|
||||
}
|
||||
|
||||
char buf[256] = {};
|
||||
X509 *cert;
|
||||
WOLFSSL_X509 *cert;
|
||||
int err, depth;
|
||||
|
||||
cert = X509_STORE_CTX_get_current_cert(chainContext);
|
||||
err = X509_STORE_CTX_get_error(chainContext);
|
||||
depth = X509_STORE_CTX_get_error_depth(chainContext);
|
||||
cert = wolfSSL_X509_STORE_CTX_get_current_cert(chainContext);
|
||||
err = wolfSSL_X509_STORE_CTX_get_error(chainContext);
|
||||
depth = wolfSSL_X509_STORE_CTX_get_error_depth(chainContext);
|
||||
|
||||
LogPrintf("TLS: %s: %s():%d - preverify_ok=%d, errCode=%d, depth=%d\n",
|
||||
__FILE__, __func__, __LINE__, preverify_ok, err, depth);
|
||||
|
||||
// is not useful checking preverify_ok because, after the chain root verification, it is set accordingly
|
||||
// to the return value of this callback, and we choose to always return 1
|
||||
if (err != X509_V_OK )
|
||||
{
|
||||
if (err != X509_V_OK ) {
|
||||
LogPrintf("TLS: %s: %s():%d - Certificate Verification ERROR=%d: [%s] at chain depth=%d\n",
|
||||
__FILE__, __func__, __LINE__, err, X509_verify_cert_error_string(err), depth);
|
||||
__FILE__, __func__, __LINE__, err, wolfSSL_X509_verify_cert_error_string(err), depth);
|
||||
|
||||
if (cert && err == X509_V_ERR_CERT_HAS_EXPIRED)
|
||||
{
|
||||
struct tm t = {};
|
||||
const ASN1_TIME * at = X509_get0_notAfter(cert);
|
||||
int ret = ASN1_TIME_to_tm(at, &t);
|
||||
if (ret == 1)
|
||||
{
|
||||
(void)strftime(buf, sizeof (buf), "%c", &t);
|
||||
if (cert && err == X509_V_ERR_CERT_HAS_EXPIRED) {
|
||||
char time_buf[MAX_TIME_STRING_SZ];
|
||||
ASN1_TIME * at = wolfSSL_X509_get_notAfter(cert);
|
||||
if (wolfSSL_ASN1_TIME_to_string(at, time_buf, sizeof(time_buf)) != NULL) {
|
||||
LogPrintf("TLS: %s: %s():%d - expired on=%s\n",
|
||||
__FILE__, __func__, __LINE__, buf);
|
||||
}
|
||||
}
|
||||
}
|
||||
else if (cert)
|
||||
{
|
||||
X509_NAME_oneline(X509_get_subject_name(cert), buf, 256);
|
||||
} else if (cert) {
|
||||
wolfSSL_X509_NAME_oneline(wolfSSL_X509_get_subject_name(cert), buf, 256);
|
||||
LogPrintf("TLS: %s: %s():%d - subj name=%s\n",
|
||||
__FILE__, __func__, __LINE__, buf);
|
||||
|
||||
X509_NAME_oneline(X509_get_issuer_name(cert), buf, 256);
|
||||
wolfSSL_X509_NAME_oneline(wolfSSL_X509_get_issuer_name(cert), buf, 256);
|
||||
LogPrintf("TLS: %s: %s():%d - issuer name=%s\n",
|
||||
__FILE__, __func__, __LINE__, buf);
|
||||
|
||||
struct tm t = {};
|
||||
const ASN1_TIME * at = X509_get0_notAfter(cert);
|
||||
int ret = ASN1_TIME_to_tm(at, &t);
|
||||
if (ret == 1)
|
||||
{
|
||||
(void)strftime(buf, sizeof (buf), "%c", &t);
|
||||
char time_buf[MAX_TIME_STRING_SZ];
|
||||
WOLFSSL_ASN1_TIME * at = wolfSSL_X509_get_notAfter(cert);
|
||||
if (wolfSSL_ASN1_TIME_to_string(at, time_buf, sizeof(time_buf)) != NULL) {
|
||||
LogPrintf("TLS: %s: %s():%d - expiring on=%s\n",
|
||||
__FILE__, __func__, __LINE__, buf);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
} else {
|
||||
// should never happen
|
||||
LogPrintf("TLS: %s: %s():%d - invalid cert/err\n", __FILE__, __func__, __LINE__);
|
||||
}
|
||||
@ -152,7 +134,7 @@ static void dumpCertificateDebugInfo(int preverify_ok, X509_STORE_CTX* chainCont
|
||||
* @param chainContext
|
||||
* @return int
|
||||
*/
|
||||
int tlsCertVerificationCallback(int preverify_ok, X509_STORE_CTX* chainContext)
|
||||
int tlsCertVerificationCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* chainContext)
|
||||
{
|
||||
dumpCertificateDebugInfo(preverify_ok, chainContext);
|
||||
|
||||
@ -175,23 +157,23 @@ int tlsCertVerificationCallback(int preverify_ok, X509_STORE_CTX* chainContext)
|
||||
* @param timeoutSec timeout in seconds.
|
||||
* @return int returns nError corresponding to the connection event.
|
||||
*/
|
||||
int TLSManager::waitFor(SSLConnectionRoutine eRoutine, SOCKET hSocket, SSL* ssl, int timeoutSec, unsigned long& err_code)
|
||||
int TLSManager::waitFor(SSLConnectionRoutine eRoutine, SOCKET hSocket, WOLFSSL* ssl, int timeoutSec, unsigned long& err_code)
|
||||
{
|
||||
int retOp = 0;
|
||||
err_code = 0;
|
||||
|
||||
while (true) {
|
||||
while (true)
|
||||
{
|
||||
// clear the current thread's error queue
|
||||
ERR_clear_error();
|
||||
wolfSSL_ERR_clear_error();
|
||||
|
||||
switch (eRoutine) {
|
||||
case SSL_CONNECT:
|
||||
{
|
||||
retOp = SSL_connect(ssl);
|
||||
if (retOp == 0)
|
||||
{
|
||||
err_code = ERR_get_error();
|
||||
const char* error_str = ERR_error_string(err_code, NULL);
|
||||
retOp = wolfSSL_connect(ssl);
|
||||
if (retOp == 0) {
|
||||
err_code = wolfSSL_ERR_get_error();
|
||||
const char* error_str = wolfSSL_ERR_error_string(err_code, NULL);
|
||||
LogPrint("tls", "TLS: WARNING: %s: %s():%d - SSL_CONNECT err: %s\n",
|
||||
__FILE__, __func__, __LINE__, error_str);
|
||||
return -1;
|
||||
@ -201,11 +183,10 @@ int TLSManager::waitFor(SSLConnectionRoutine eRoutine, SOCKET hSocket, SSL* ssl,
|
||||
|
||||
case SSL_ACCEPT:
|
||||
{
|
||||
retOp = SSL_accept(ssl);
|
||||
if (retOp == 0)
|
||||
{
|
||||
err_code = ERR_get_error();
|
||||
const char* error_str = ERR_error_string(err_code, NULL);
|
||||
retOp = wolfSSL_accept(ssl);
|
||||
if (retOp == 0) {
|
||||
err_code = wolfSSL_ERR_get_error();
|
||||
const char* error_str = wolfSSL_ERR_error_string(err_code, NULL);
|
||||
LogPrint("tls", "TLS: WARNING: %s: %s():%d - SSL_ACCEPT err: %s\n",
|
||||
__FILE__, __func__, __LINE__, error_str);
|
||||
return -1;
|
||||
@ -215,19 +196,17 @@ int TLSManager::waitFor(SSLConnectionRoutine eRoutine, SOCKET hSocket, SSL* ssl,
|
||||
|
||||
case SSL_SHUTDOWN:
|
||||
{
|
||||
if (hSocket != INVALID_SOCKET)
|
||||
{
|
||||
if (hSocket != INVALID_SOCKET) {
|
||||
std::string disconnectedPeer("no info");
|
||||
struct sockaddr_in addr;
|
||||
socklen_t serv_len = sizeof(addr);
|
||||
int ret = getpeername(hSocket, (struct sockaddr *)&addr, &serv_len);
|
||||
if (ret == 0)
|
||||
{
|
||||
if (ret == 0) {
|
||||
disconnectedPeer = std::string(inet_ntoa(addr.sin_addr)) + ":" + std::to_string(ntohs(addr.sin_port));
|
||||
}
|
||||
LogPrint("tls", "TLS: shutting down fd=%d, peer=%s\n", hSocket, disconnectedPeer);
|
||||
}
|
||||
retOp = SSL_shutdown(ssl);
|
||||
retOp = wolfSSL_shutdown(ssl);
|
||||
}
|
||||
break;
|
||||
|
||||
@ -236,41 +215,34 @@ int TLSManager::waitFor(SSLConnectionRoutine eRoutine, SOCKET hSocket, SSL* ssl,
|
||||
}
|
||||
|
||||
if (eRoutine == SSL_SHUTDOWN) {
|
||||
if (retOp == 0)
|
||||
{
|
||||
if (retOp == 0) {
|
||||
LogPrint("tls", "TLS: WARNING: %s: %s():%d - SSL_SHUTDOWN: The close_notify was sent but the peer did not send it back yet.\n",
|
||||
__FILE__, __func__, __LINE__);
|
||||
// do not call SSL_get_error() because it may misleadingly indicate an error even though no error occurred.
|
||||
break;
|
||||
}
|
||||
else
|
||||
if (retOp == 1)
|
||||
{
|
||||
} else if (retOp == 1) {
|
||||
LogPrint("tls", "TLS: %s: %s():%d - SSL_SHUTDOWN completed\n", __FILE__, __func__, __LINE__);
|
||||
break;
|
||||
}
|
||||
else
|
||||
{
|
||||
} else {
|
||||
LogPrint("tls", "TLS: %s: %s():%d - SSL_SHUTDOWN failed\n", __FILE__, __func__, __LINE__);
|
||||
// the error will be read afterwards
|
||||
}
|
||||
} else {
|
||||
if (retOp == 1)
|
||||
{
|
||||
if (retOp == 1) {
|
||||
LogPrint("tls", "TLS: %s: %s():%d - %s completed\n", __FILE__, __func__, __LINE__,
|
||||
eRoutine == SSL_CONNECT ? "SSL_CONNECT" : "SSL_ACCEPT");
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
int sslErr = SSL_get_error(ssl, retOp);
|
||||
int sslErr = wolfSSL_get_error(ssl, retOp);
|
||||
|
||||
if (sslErr != SSL_ERROR_WANT_READ && sslErr != SSL_ERROR_WANT_WRITE) {
|
||||
err_code = ERR_get_error();
|
||||
const char* error_str = ERR_error_string(err_code, NULL);
|
||||
if (sslErr != WOLFSSL_ERROR_WANT_READ && sslErr != WOLFSSL_ERROR_WANT_WRITE) {
|
||||
err_code = wolfSSL_ERR_get_error();
|
||||
const char* error_str = wolfSSL_ERR_error_string(err_code, NULL);
|
||||
LogPrint("tls", "TLS: WARNING: %s: %s():%d - routine(%d), sslErr[0x%x], retOp[%d], errno[0x%x], lib[0x%x], func[0x%x], reas[0x%x]-> err: %s\n",
|
||||
__FILE__, __func__, __LINE__,
|
||||
eRoutine, sslErr, retOp, errno, ERR_GET_LIB(err_code), ERR_GET_FUNC(err_code), ERR_GET_REASON(err_code), error_str);
|
||||
eRoutine, sslErr, retOp, errno, wolfSSL_ERR_GET_LIB(err_code), ERR_GET_FUNC(err_code), wolfSSL_ERR_GET_REASON(err_code), error_str);
|
||||
retOp = -1;
|
||||
break;
|
||||
}
|
||||
@ -281,7 +253,7 @@ int TLSManager::waitFor(SSLConnectionRoutine eRoutine, SOCKET hSocket, SSL* ssl,
|
||||
|
||||
struct timeval timeout = {timeoutSec, 0};
|
||||
|
||||
if (sslErr == SSL_ERROR_WANT_READ) {
|
||||
if (sslErr == WOLFSSL_ERROR_WANT_READ) {
|
||||
int result = select(hSocket + 1, &socketSet, NULL, NULL, &timeout);
|
||||
if (result == 0) {
|
||||
LogPrint("tls", "TLS: ERROR: %s: %s():%d - WANT_READ timeout on %s\n", __FILE__, __func__, __LINE__,
|
||||
@ -323,18 +295,18 @@ int TLSManager::waitFor(SSLConnectionRoutine eRoutine, SOCKET hSocket, SSL* ssl,
|
||||
* @param hSocket socket
|
||||
* @param addrConnect the outgoing address
|
||||
* @param tls_ctx_client TLS Client context
|
||||
* @return SSL* returns a ssl* if successful, otherwise returns NULL.
|
||||
* @return WOLFSSL* returns a ssl* if successful, otherwise returns NULL.
|
||||
*/
|
||||
SSL* TLSManager::connect(SOCKET hSocket, const CAddress& addrConnect, unsigned long& err_code)
|
||||
WOLFSSL* TLSManager::connect(SOCKET hSocket, const CAddress& addrConnect, unsigned long& err_code)
|
||||
{
|
||||
LogPrint("tls", "TLS: establishing connection (tid = %X), (peerid = %s)\n", pthread_self(), addrConnect.ToString());
|
||||
|
||||
err_code = 0;
|
||||
SSL* ssl = NULL;
|
||||
WOLFSSL* ssl = NULL;
|
||||
bool bConnectedTLS = false;
|
||||
|
||||
if ((ssl = SSL_new(tls_ctx_client))) {
|
||||
if (SSL_set_fd(ssl, hSocket)) {
|
||||
if ((ssl = wolfSSL_new(tls_ctx_client))) {
|
||||
if (wolfSSL_set_fd(ssl, hSocket)) {
|
||||
int ret = TLSManager::waitFor(SSL_CONNECT, hSocket, ssl, (DEFAULT_CONNECT_TIMEOUT / 1000), err_code);
|
||||
if (ret == 1)
|
||||
{
|
||||
@ -344,25 +316,25 @@ SSL* TLSManager::connect(SOCKET hSocket, const CAddress& addrConnect, unsigned l
|
||||
}
|
||||
else
|
||||
{
|
||||
err_code = ERR_get_error();
|
||||
const char* error_str = ERR_error_string(err_code, NULL);
|
||||
err_code = wolfSSL_ERR_get_error();
|
||||
const char* error_str = wolfSSL_ERR_error_string(err_code, NULL);
|
||||
LogPrint("tls", "TLS: %s: %s():%d - SSL_new failed err: %s\n",
|
||||
__FILE__, __func__, __LINE__, error_str);
|
||||
}
|
||||
|
||||
|
||||
if (bConnectedTLS) {
|
||||
LogPrintf("TLS: connection to %s has been established (tlsv = %s 0x%04x / ssl = %s 0x%x ). Using cipher: %s\n",
|
||||
addrConnect.ToString(), SSL_get_version(ssl), SSL_version(ssl), OpenSSL_version(OPENSSL_VERSION), OpenSSL_version_num(), SSL_get_cipher(ssl));
|
||||
addrConnect.ToString(), wolfSSL_get_version(ssl), wolfSSL_version(ssl), wolfSSL_OpenSSL_version(), wolfSSL_lib_version_hex(), wolfSSL_get_cipher_name(ssl));
|
||||
} else {
|
||||
LogPrintf("TLS: %s: %s():%d - TLS connection to %s failed (err_code 0x%X)\n",
|
||||
__FILE__, __func__, __LINE__, addrConnect.ToString(), err_code);
|
||||
|
||||
if (ssl) {
|
||||
SSL_free(ssl);
|
||||
wolfSSL_free(ssl);
|
||||
ssl = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
return ssl;
|
||||
}
|
||||
/**
|
||||
@ -372,9 +344,9 @@ SSL* TLSManager::connect(SOCKET hSocket, const CAddress& addrConnect, unsigned l
|
||||
* @param privateKeyFile private key file path
|
||||
* @param certificateFile certificate key file path
|
||||
* @param trustedDirs trusted directories
|
||||
* @return SSL_CTX* returns the context.
|
||||
* @return WOLSSL_CTX* returns the context.
|
||||
*/
|
||||
SSL_CTX* TLSManager::initCtx(
|
||||
WOLFSSL_CTX* TLSManager::initCtx(
|
||||
TLSContextType ctxType,
|
||||
const boost::filesystem::path& privateKeyFile,
|
||||
const boost::filesystem::path& certificateFile,
|
||||
@ -383,90 +355,87 @@ SSL_CTX* TLSManager::initCtx(
|
||||
LogPrintf("TLS: %s: %s():%d - Initializing %s context\n",
|
||||
__FILE__, __func__, __LINE__, ctxType == SERVER_CONTEXT ? "server" : "client");
|
||||
|
||||
if (!boost::filesystem::exists(privateKeyFile) ||
|
||||
!boost::filesystem::exists(certificateFile))
|
||||
return NULL;
|
||||
|
||||
if (!boost::filesystem::exists(privateKeyFile) || !boost::filesystem::exists(certificateFile)) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
bool bInitialized = false;
|
||||
SSL_CTX* tlsCtx = NULL;
|
||||
WOLFSSL_CTX* tlsCtx = NULL;
|
||||
|
||||
if ((tlsCtx = SSL_CTX_new(ctxType == SERVER_CONTEXT ? TLS_server_method() : TLS_client_method()))) {
|
||||
SSL_CTX_set_mode(tlsCtx, SSL_MODE_AUTO_RETRY);
|
||||
if ((tlsCtx = wolfSSL_CTX_new(ctxType == SERVER_CONTEXT ? wolfTLSv1_3_server_method() : wolfTLSv1_3_client_method()))) {
|
||||
wolfSSL_CTX_set_mode(tlsCtx, SSL_MODE_AUTO_RETRY);
|
||||
|
||||
// Disable TLS < 1.3
|
||||
int ret = SSL_CTX_set_min_proto_version(tlsCtx, TLS1_3_VERSION);
|
||||
if (ret == 0)
|
||||
{
|
||||
// Disable TLS < 1.3 ... imho redundant, because v1.3 is required via method
|
||||
int ret = wolfSSL_CTX_set_min_proto_version(tlsCtx, TLS1_3_VERSION);
|
||||
if (ret == 0) {
|
||||
LogPrintf("TLS: WARNING: %s: %s():%d - failed to set min TLS version\n", __FILE__, __func__, __LINE__);
|
||||
}
|
||||
|
||||
LogPrintf("TLS: %s: %s():%d - setting cipher list\n", __FILE__, __func__, __LINE__);
|
||||
|
||||
SSL_CTX_set_cipher_list(tlsCtx, ""); // removes all <= TLS1.2 ciphers
|
||||
// default is "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
|
||||
// Nodes will randomly choose to prefer one suite or the other, to create diversity on the network
|
||||
// Default TLSv1.3 cipher list is "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
|
||||
// Nodes will randomly choose to prefer first cipher or the second, to create diversity on the network
|
||||
// and not be in the situation where all nodes have the same list so the first is always used
|
||||
if(GetRand(100) > 50) {
|
||||
if (SSL_CTX_set_ciphersuites(tlsCtx, "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")) {
|
||||
if (wolfSSL_CTX_set_cipher_list(tlsCtx, "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256")) {
|
||||
LogPrintf("%s: Preferring TLS_AES256-GCM-SHA384\n", __func__);
|
||||
} else {
|
||||
LogPrintf("%s: Setting preferred cipher failed !!!\n", __func__);
|
||||
}
|
||||
} else {
|
||||
if (SSL_CTX_set_ciphersuites(tlsCtx, "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384")) {
|
||||
if (wolfSSL_CTX_set_cipher_list(tlsCtx, "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384")) {
|
||||
LogPrintf("%s: Preferring TLS_AES256-GCM-SHA384\n", __func__);
|
||||
} else {
|
||||
LogPrintf("%s: Setting preferred cipher failed !!!\n", __func__);
|
||||
}
|
||||
}
|
||||
|
||||
// TLS 1.3 has ephemeral Diffie-Hellman as the only key exchange mechanism, so that perfect forward
|
||||
// secrecy is ensured.
|
||||
// TLSv1.3 has ephemeral Diffie-Hellman as the only key exchange mechanism, so that perfect forward secrecy is ensured.
|
||||
|
||||
if (ctxType == SERVER_CONTEXT)
|
||||
{
|
||||
if (ctxType == SERVER_CONTEXT) {
|
||||
// amongst the Cl/Srv mutually-acceptable set, pick the one that the server prefers most instead of the one that
|
||||
// the client prefers most
|
||||
SSL_CTX_set_options(tlsCtx, SSL_OP_CIPHER_SERVER_PREFERENCE);
|
||||
wolfSSL_CTX_set_options(tlsCtx, SSL_OP_CIPHER_SERVER_PREFERENCE);
|
||||
|
||||
LogPrintf("TLS: %s: %s():%d - setting dh callback\n", __FILE__, __func__, __LINE__);
|
||||
SSL_CTX_set_tmp_dh_callback(tlsCtx, tmp_dh_callback);
|
||||
}
|
||||
|
||||
// Fix for Secure Client-Initiated Renegotiation DoS threat
|
||||
SSL_CTX_set_options(tlsCtx, SSL_OP_NO_RENEGOTIATION);
|
||||
|
||||
int min_ver = SSL_CTX_get_min_proto_version(tlsCtx);
|
||||
int max_ver = SSL_CTX_get_max_proto_version(tlsCtx); // 0x0 means auto
|
||||
int opt_mask = SSL_CTX_get_options(tlsCtx);
|
||||
|
||||
LogPrintf("TLS: proto version: min/max 0x%04x/0x04%x, opt_mask=0x%x\n", min_ver, max_ver, opt_mask);
|
||||
|
||||
// Fix for Secure Client-Initiated Renegotiation DoS threat:
|
||||
// In WolfSSL library renegotiation is disabled by default build config
|
||||
|
||||
// Support for TLSv1.3 should be the only one compiled
|
||||
// ./configure --disable-oldtls --disable-tlsv12
|
||||
|
||||
int rootCertsNum = LoadDefaultRootCertificates(tlsCtx);
|
||||
int trustedPathsNum = 0;
|
||||
|
||||
for (boost::filesystem::path trustedDir : trustedDirs) {
|
||||
if (SSL_CTX_load_verify_locations(tlsCtx, NULL, trustedDir.string().c_str()) == 1)
|
||||
for (boost::filesystem::path trustedDir : trustedDirs)
|
||||
{
|
||||
if (wolfSSL_CTX_load_verify_locations(tlsCtx, NULL, trustedDir.string().c_str()) == 1) {
|
||||
trustedPathsNum++;
|
||||
}
|
||||
}
|
||||
|
||||
if (rootCertsNum == 0 && trustedPathsNum == 0)
|
||||
if (rootCertsNum == 0 && trustedPathsNum == 0) {
|
||||
LogPrintf("TLS: WARNING: %s: %s: failed to set up verified certificates. It will be impossible to verify peer certificates. \n", __FILE__, __func__);
|
||||
}
|
||||
|
||||
SSL_CTX_set_verify(tlsCtx, SSL_VERIFY_PEER, tlsCertVerificationCallback);
|
||||
wolfSSL_CTX_set_verify(tlsCtx, WOLFSSL_VERIFY_PEER, tlsCertVerificationCallback);
|
||||
|
||||
if (SSL_CTX_use_certificate_file(tlsCtx, certificateFile.string().c_str(), SSL_FILETYPE_PEM) > 0) {
|
||||
if (SSL_CTX_use_PrivateKey_file(tlsCtx, privateKeyFile.string().c_str(), SSL_FILETYPE_PEM) > 0) {
|
||||
if (SSL_CTX_check_private_key(tlsCtx)) {
|
||||
if (wolfSSL_CTX_use_certificate_file(tlsCtx, certificateFile.string().c_str(), WOLFSSL_FILETYPE_PEM) > 0) {
|
||||
if (wolfSSL_CTX_use_PrivateKey_file(tlsCtx, privateKeyFile.string().c_str(), WOLFSSL_FILETYPE_PEM) > 0) {
|
||||
if (wolfSSL_CTX_check_private_key(tlsCtx)) {
|
||||
bInitialized = true;
|
||||
} else {
|
||||
LogPrintf("TLS: ERROR: %s: %s: private key does not match the certificate public key\n", __FILE__, __func__);
|
||||
}
|
||||
} else
|
||||
LogPrintf("TLS: ERROR: %s: %s: failed to use privateKey file\n", __FILE__, __func__);
|
||||
} else {
|
||||
LogPrintf("TLS: ERROR: %s: %s: failed to use privateKey file\n", __FILE__, __func__);
|
||||
}
|
||||
} else {
|
||||
LogPrintf("TLS: ERROR: %s: %s: failed to use certificate file\n", __FILE__, __func__);
|
||||
ERR_print_errors_fp(stderr);
|
||||
wolfSSL_ERR_dump_errors_fp(stderr);
|
||||
}
|
||||
} else {
|
||||
LogPrintf("TLS: ERROR: %s: %s: failed to create TLS context\n", __FILE__, __func__);
|
||||
@ -474,7 +443,7 @@ SSL_CTX* TLSManager::initCtx(
|
||||
|
||||
if (!bInitialized) {
|
||||
if (tlsCtx) {
|
||||
SSL_CTX_free(tlsCtx);
|
||||
wolfSSL_CTX_free(tlsCtx);
|
||||
tlsCtx = NULL;
|
||||
}
|
||||
}
|
||||
@ -524,18 +493,18 @@ bool TLSManager::prepareCredentials()
|
||||
* @param hSocket the TLS socket.
|
||||
* @param addr incoming address.
|
||||
* @param tls_ctx_server TLS server context.
|
||||
* @return SSL* returns pointer to the ssl object if successful, otherwise returns NULL
|
||||
* @return WOLFSSL* returns pointer to the ssl object if successful, otherwise returns NULL
|
||||
*/
|
||||
SSL* TLSManager::accept(SOCKET hSocket, const CAddress& addr, unsigned long& err_code)
|
||||
WOLFSSL* TLSManager::accept(SOCKET hSocket, const CAddress& addr, unsigned long& err_code)
|
||||
{
|
||||
LogPrint("tls", "TLS: accepting connection from %s (tid = %X)\n", addr.ToString(), pthread_self());
|
||||
|
||||
err_code = 0;
|
||||
SSL* ssl = NULL;
|
||||
WOLFSSL* ssl = NULL;
|
||||
bool bAcceptedTLS = false;
|
||||
|
||||
if ((ssl = SSL_new(tls_ctx_server))) {
|
||||
if (SSL_set_fd(ssl, hSocket)) {
|
||||
if ((ssl = wolfSSL_new(tls_ctx_server))) {
|
||||
if (wolfSSL_set_fd(ssl, hSocket)) {
|
||||
int ret = TLSManager::waitFor(SSL_ACCEPT, hSocket, ssl, (DEFAULT_CONNECT_TIMEOUT / 1000), err_code);
|
||||
if (ret == 1)
|
||||
{
|
||||
@ -545,20 +514,20 @@ SSL* TLSManager::accept(SOCKET hSocket, const CAddress& addr, unsigned long& err
|
||||
}
|
||||
else
|
||||
{
|
||||
err_code = ERR_get_error();
|
||||
const char* error_str = ERR_error_string(err_code, NULL);
|
||||
err_code = wolfSSL_ERR_get_error();
|
||||
const char* error_str = wolfSSL_ERR_error_string(err_code, NULL);
|
||||
LogPrint("tls", "TLS: %s: %s():%d - SSL_new failed err: %s\n",
|
||||
__FILE__, __func__, __LINE__, error_str);
|
||||
}
|
||||
|
||||
if (bAcceptedTLS) {
|
||||
LogPrintf("TLS: connection from %s has been accepted (tlsv = %s 0x%04x / ssl = %s 0x%x ). Using cipher: %s\n",
|
||||
addr.ToString(), SSL_get_version(ssl), SSL_version(ssl), OpenSSL_version(OPENSSL_VERSION), OpenSSL_version_num(), SSL_get_cipher(ssl));
|
||||
addr.ToString(), wolfSSL_get_version(ssl), wolfSSL_version(ssl), wolfSSL_OpenSSL_version(), wolfSSL_lib_version_hex(), wolfSSL_get_cipher(ssl));
|
||||
|
||||
STACK_OF(SSL_CIPHER) *sk = SSL_get_ciphers(ssl);
|
||||
for (int i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
|
||||
const SSL_CIPHER *c = sk_SSL_CIPHER_value(sk, i);
|
||||
LogPrint("tls", "TLS: supporting cipher: %s\n", SSL_CIPHER_get_name(c));
|
||||
WOLFSSL_STACK *sk = wolfSSL_get_ciphers_compat(ssl);
|
||||
for (int i = 0; i < wolfSSL_sk_SSL_CIPHER_num(sk); i++) {
|
||||
const WOLFSSL_CIPHER *c = wolfSSL_sk_SSL_CIPHER_value(sk, i);
|
||||
LogPrint("tls", "TLS: supporting cipher: %s\n", wolfSSL_CIPHER_get_name(c));
|
||||
}
|
||||
} else {
|
||||
LogPrintf("TLS: %s: %s():%d - TLS connection from %s failed (err_code 0x%X)\n",
|
||||
@ -663,9 +632,9 @@ int TLSManager::threadSocketHandler(CNode* pnode, fd_set& fdsetRecv, fd_set& fds
|
||||
bIsSSL = (pnode->ssl != NULL);
|
||||
|
||||
if (bIsSSL) {
|
||||
ERR_clear_error(); // clear the error queue, otherwise we may be reading an old error that occurred previously in the current thread
|
||||
nBytes = SSL_read(pnode->ssl, pchBuf, sizeof(pchBuf));
|
||||
nRet = SSL_get_error(pnode->ssl, nBytes);
|
||||
wolfSSL_ERR_clear_error(); // clear the error queue, otherwise we may be reading an old error that occurred previously in the current thread
|
||||
nBytes = wolfSSL_read(pnode->ssl, pchBuf, sizeof(pchBuf));
|
||||
nRet = wolfSSL_get_error(pnode->ssl, nBytes);
|
||||
} else {
|
||||
nBytes = recv(pnode->hSocket, pchBuf, sizeof(pchBuf), MSG_DONTWAIT);
|
||||
nRet = WSAGetLastError();
|
||||
@ -697,7 +666,7 @@ int TLSManager::threadSocketHandler(CNode* pnode, fd_set& fdsetRecv, fd_set& fds
|
||||
// error
|
||||
//
|
||||
if (bIsSSL) {
|
||||
if (nRet != SSL_ERROR_WANT_READ && nRet != SSL_ERROR_WANT_WRITE) // SSL_read() operation has to be repeated because of SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE (https://wiki.openssl.org/index.php/Manual:SSL_read(3)#NOTES)
|
||||
if (nRet != WOLFSSL_ERROR_WANT_READ && nRet != WOLFSSL_ERROR_WANT_WRITE)
|
||||
{
|
||||
if (!pnode->fDisconnect)
|
||||
LogPrintf("TSL: ERROR: SSL_read %s\n", ERR_error_string(nRet, NULL));
|
||||
@ -747,10 +716,10 @@ bool TLSManager::initialize()
|
||||
|
||||
// Initialization routines for the OpenSSL library
|
||||
//
|
||||
SSL_load_error_strings();
|
||||
ERR_load_crypto_strings();
|
||||
OpenSSL_add_ssl_algorithms(); // OpenSSL_add_ssl_algorithms() always returns "1", so it is safe to discard the return value.
|
||||
|
||||
wolfSSL_load_error_strings();
|
||||
wolfSSL_ERR_load_crypto_strings();
|
||||
wolfSSL_library_init();
|
||||
|
||||
namespace fs = boost::filesystem;
|
||||
fs::path certFile = GetArg("-tlscertpath", "");
|
||||
if (!fs::exists(certFile))
|
||||
@ -784,7 +753,7 @@ bool TLSManager::initialize()
|
||||
bInitializationStatus = true;
|
||||
} else {
|
||||
LogPrintf("TLS: ERROR: %s: %s: failed to initialize TLS client context\n", __FILE__, __func__);
|
||||
SSL_CTX_free (tls_ctx_server);
|
||||
wolfSSL_CTX_free (tls_ctx_server);
|
||||
}
|
||||
} else {
|
||||
LogPrintf("TLS: ERROR: %s: %s: failed to initialize TLS server context\n", __FILE__, __func__);
|
||||
|
||||
@ -1,9 +1,8 @@
|
||||
// Copyright (c) 2019-2020 The Hush developers
|
||||
// Distributed under the GPLv3 software license, see the accompanying
|
||||
// file COPYING or https://www.gnu.org/licenses/gpl-3.0.en.html
|
||||
#include <openssl/conf.h>
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/err.h>
|
||||
#include <wolfssl/options.h>
|
||||
#include <wolfssl/ssl.h>
|
||||
#include "tlsenums.h"
|
||||
#include <boost/filesystem.hpp>
|
||||
#include <boost/thread.hpp>
|
||||
@ -46,17 +45,17 @@ public:
|
||||
function code and reason code. */
|
||||
static const long SELECT_TIMEDOUT = 0xFFFFFFFF;
|
||||
|
||||
int waitFor(SSLConnectionRoutine eRoutine, SOCKET hSocket, SSL* ssl, int timeoutSec, unsigned long& err_code);
|
||||
int waitFor(SSLConnectionRoutine eRoutine, SOCKET hSocket, WOLFSSL* ssl, int timeoutSec, unsigned long& err_code);
|
||||
|
||||
SSL* connect(SOCKET hSocket, const CAddress& addrConnect, unsigned long& err_code);
|
||||
SSL_CTX* initCtx(
|
||||
WOLFSSL* connect(SOCKET hSocket, const CAddress& addrConnect, unsigned long& err_code);
|
||||
WOLFSSL_CTX* initCtx(
|
||||
TLSContextType ctxType,
|
||||
const boost::filesystem::path& privateKeyFile,
|
||||
const boost::filesystem::path& certificateFile,
|
||||
const std::vector<boost::filesystem::path>& trustedDirs);
|
||||
|
||||
bool prepareCredentials();
|
||||
SSL* accept(SOCKET hSocket, const CAddress& addr, unsigned long& err_code);
|
||||
WOLFSSL* accept(SOCKET hSocket, const CAddress& addr, unsigned long& err_code);
|
||||
bool isNonTLSAddr(const string& strAddr, const vector<NODE_ADDR>& vPool, CCriticalSection& cs);
|
||||
void cleanNonTLSPool(std::vector<NODE_ADDR>& vPool, CCriticalSection& cs);
|
||||
int threadSocketHandler(CNode* pnode, fd_set& fdsetRecv, fd_set& fdsetSend, fd_set& fdsetError);
|
||||
|
||||
@ -6,11 +6,9 @@
|
||||
#include <stdio.h>
|
||||
#include <vector>
|
||||
|
||||
#include <openssl/rsa.h>
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/pem.h>
|
||||
#include <openssl/rand.h>
|
||||
#include <openssl/ssl.h>
|
||||
#include <wolfssl/options.h>
|
||||
#include <wolfssl/ssl.h>
|
||||
#include <wolfssl/wolfcrypt/rsa.h>
|
||||
#include <boost/filesystem/path.hpp>
|
||||
#include <boost/filesystem/operations.hpp>
|
||||
|
||||
@ -67,37 +65,31 @@ static const char defaultRootCerts[] =
|
||||
};
|
||||
|
||||
// Generates RSA keypair (a private key of 'bits' length for a specified 'uPublicKey')
|
||||
//
|
||||
static EVP_PKEY* GenerateRsaKey(int bits, BN_ULONG uPublicKey)
|
||||
// obsolete since we use EC instead of RSA
|
||||
static WOLFSSL_EVP_PKEY* GenerateRsaKey(int bits, WOLFSSL_BN_ULONG uPublicKey)
|
||||
{
|
||||
EVP_PKEY *evpPrivKey = NULL;
|
||||
|
||||
BIGNUM *pubKey = BN_new();
|
||||
if (pubKey)
|
||||
{
|
||||
if (BN_set_word(pubKey, uPublicKey))
|
||||
{
|
||||
RSA *privKey = RSA_new();
|
||||
if (privKey)
|
||||
{
|
||||
if (RAND_poll() && // The pseudo-random number generator must be seeded prior to calling RSA_generate_key_ex(). (https://www.openssl.org/docs/man1.1.0/crypto/RSA_generate_key.html)
|
||||
RSA_generate_key_ex(privKey, bits, pubKey, NULL))
|
||||
{
|
||||
if ((evpPrivKey = EVP_PKEY_new()))
|
||||
{
|
||||
if (!EVP_PKEY_assign_RSA(evpPrivKey, privKey))
|
||||
{
|
||||
EVP_PKEY_free(evpPrivKey);
|
||||
WOLFSSL_EVP_PKEY *evpPrivKey = NULL;
|
||||
|
||||
WOLFSSL_BIGNUM *pubKey = wolfSSL_BN_new();
|
||||
if (pubKey) {
|
||||
if (wolfSSL_BN_set_word(pubKey, uPublicKey)) {
|
||||
WOLFSSL_RSA *privKey = wolfSSL_RSA_new();
|
||||
if (privKey) {
|
||||
if (wolfSSL_RAND_poll() && wolfSSL_RSA_generate_key_ex(privKey, bits, pubKey, NULL)) {
|
||||
if ((evpPrivKey = wolfSSL_EVP_PKEY_new())) {
|
||||
if (!wolfSSL_EVP_PKEY_assign_RSA(evpPrivKey, privKey)) {
|
||||
wolfSSL_EVP_PKEY_free(evpPrivKey);
|
||||
evpPrivKey = NULL;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if(!evpPrivKey) // EVP_PKEY_assign_RSA uses the supplied key internally
|
||||
RSA_free(privKey);
|
||||
if(!evpPrivKey) {
|
||||
wolfSSL_RSA_free(privKey);
|
||||
}
|
||||
}
|
||||
}
|
||||
BN_free(pubKey);
|
||||
wolfSSL_BN_free(pubKey);
|
||||
}
|
||||
|
||||
return evpPrivKey;
|
||||
@ -105,27 +97,24 @@ static EVP_PKEY* GenerateRsaKey(int bits, BN_ULONG uPublicKey)
|
||||
|
||||
// Generates EC keypair
|
||||
//
|
||||
static EVP_PKEY* GenerateEcKey(int nid = NID_X9_62_prime256v1)
|
||||
static WOLFSSL_EVP_PKEY* GenerateEcKey(int nid = NID_X9_62_prime256v1)
|
||||
{
|
||||
EVP_PKEY *evpPrivKey = NULL;
|
||||
EC_KEY *privKey = EC_KEY_new_by_curve_name(nid);
|
||||
if (privKey)
|
||||
{
|
||||
EC_KEY_set_asn1_flag(privKey, OPENSSL_EC_NAMED_CURVE);
|
||||
if (EC_KEY_generate_key(privKey))
|
||||
{
|
||||
if ((evpPrivKey = EVP_PKEY_new()))
|
||||
{
|
||||
if (!EVP_PKEY_assign_EC_KEY(evpPrivKey, privKey))
|
||||
{
|
||||
EVP_PKEY_free(evpPrivKey);
|
||||
WOLFSSL_EVP_PKEY *evpPrivKey = NULL;
|
||||
WOLFSSL_EC_KEY *privKey = wolfSSL_EC_KEY_new_by_curve_name(nid);
|
||||
if (privKey) {
|
||||
wolfSSL_EC_KEY_set_asn1_flag(privKey, OPENSSL_EC_NAMED_CURVE);
|
||||
if (wolfSSL_EC_KEY_generate_key(privKey)) {
|
||||
if ((evpPrivKey = wolfSSL_EVP_PKEY_new())) {
|
||||
if (!wolfSSL_EVP_PKEY_assign_EC_KEY(evpPrivKey, privKey)) {
|
||||
wolfSSL_EVP_PKEY_free(evpPrivKey);
|
||||
evpPrivKey = NULL;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if(!evpPrivKey)
|
||||
EC_KEY_free(privKey);
|
||||
if(!evpPrivKey) {
|
||||
wolfSSL_EC_KEY_free(privKey);
|
||||
}
|
||||
}
|
||||
|
||||
return evpPrivKey;
|
||||
@ -133,42 +122,30 @@ static EVP_PKEY* GenerateEcKey(int nid = NID_X9_62_prime256v1)
|
||||
|
||||
// Generates certificate for a specified public key using a corresponding private key (both of them should be specified in the 'keypair').
|
||||
//
|
||||
static X509* GenerateCertificate(EVP_PKEY *keypair)
|
||||
static WOLFSSL_X509* GenerateCertificate(WOLFSSL_EVP_PKEY *keypair)
|
||||
{
|
||||
if (!keypair)
|
||||
if (!keypair) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
X509 *cert = X509_new();
|
||||
if (cert)
|
||||
{
|
||||
WOLFSSL_X509 *cert = wolfSSL_X509_new();
|
||||
if (cert) {
|
||||
bool bCertSigned = false;
|
||||
long sn = 0;
|
||||
|
||||
if (RAND_bytes((unsigned char*)&sn, sizeof sn) &&
|
||||
ASN1_INTEGER_set(X509_get_serialNumber(cert), sn))
|
||||
{
|
||||
X509_gmtime_adj(X509_get_notBefore(cert), 0);
|
||||
X509_gmtime_adj(X509_get_notAfter(cert), (60 * 60 * 24 * CERT_VALIDITY_DAYS));
|
||||
|
||||
if (wolfSSL_RAND_bytes((unsigned char*)&sn, sizeof(sn)) &&wolfSSL_ASN1_INTEGER_set(wolfSSL_X509_get_serialNumber(cert), sn)) {
|
||||
wolfSSL_X509_gmtime_adj(wolfSSL_X509_get_notBefore(cert), 0);
|
||||
wolfSSL_X509_gmtime_adj(wolfSSL_X509_get_notAfter(cert), (60 * 60 * 24 * CERT_VALIDITY_DAYS));
|
||||
|
||||
// setting a public key from the keypair
|
||||
if (X509_set_pubkey(cert, keypair))
|
||||
{
|
||||
X509_NAME *subjectName = X509_get_subject_name(cert);
|
||||
if (subjectName)
|
||||
{
|
||||
// an issuer name is the same as a subject name, due to certificate is self-signed
|
||||
if (X509_set_issuer_name(cert, subjectName))
|
||||
{
|
||||
// private key from keypair is used; signature will be set inside of the cert
|
||||
bCertSigned = X509_sign(cert, keypair, EVP_sha512());
|
||||
}
|
||||
}
|
||||
if (wolfSSL_X509_set_pubkey(cert, keypair)) {
|
||||
// private key from keypair is used; signature will be set inside of the cert
|
||||
bCertSigned = wolfSSL_X509_sign(cert, keypair, wolfSSL_EVP_sha512());
|
||||
}
|
||||
}
|
||||
|
||||
if (!bCertSigned)
|
||||
{
|
||||
X509_free(cert);
|
||||
if (!bCertSigned) {
|
||||
wolfSSL_X509_free(cert);
|
||||
cert = NULL;
|
||||
}
|
||||
}
|
||||
@ -178,7 +155,7 @@ static X509* GenerateCertificate(EVP_PKEY *keypair)
|
||||
|
||||
// Stores key to file, specified by the 'filePath'
|
||||
//
|
||||
static bool StoreKey(EVP_PKEY *key, const boost::filesystem::path &filePath, const std::string &passphrase)
|
||||
static bool StoreKey(WOLFSSL_EVP_PKEY *key, const boost::filesystem::path &filePath, const std::string &passphrase)
|
||||
{
|
||||
if (!key)
|
||||
return false;
|
||||
@ -188,12 +165,17 @@ static bool StoreKey(EVP_PKEY *key, const boost::filesystem::path &filePath, con
|
||||
FILE *keyfd = fopen(filePath.string().c_str(), "wb");
|
||||
if (keyfd)
|
||||
{
|
||||
const EVP_CIPHER* pCipher = NULL;
|
||||
WOLFSSL_EC_KEY *ec_key = NULL;
|
||||
ec_key = wolfSSL_EVP_PKEY_get0_EC_KEY(key);
|
||||
if (ec_key != NULL)
|
||||
{
|
||||
const WOLFSSL_EVP_CIPHER* pCipher = NULL;
|
||||
|
||||
if (passphrase.length() && (pCipher = EVP_aes_256_cbc()))
|
||||
bStored = PEM_write_PrivateKey(keyfd, key, pCipher, NULL, 0, NULL, (void*)passphrase.c_str());
|
||||
else
|
||||
bStored = PEM_write_PrivateKey(keyfd, key, NULL, NULL, 0, NULL, NULL);
|
||||
if (passphrase.length() && (pCipher = wolfSSL_EVP_aes_256_cbc()))
|
||||
bStored = wolfSSL_PEM_write_ECPrivateKey(keyfd, ec_key, pCipher, NULL, 0, NULL, (void*)passphrase.c_str());
|
||||
else
|
||||
bStored = wolfSSL_PEM_write_ECPrivateKey(keyfd, ec_key, NULL, NULL, 0, NULL, NULL);
|
||||
}
|
||||
|
||||
fclose(keyfd);
|
||||
}
|
||||
@ -203,7 +185,7 @@ static bool StoreKey(EVP_PKEY *key, const boost::filesystem::path &filePath, con
|
||||
|
||||
// Stores certificate to file, specified by the 'filePath'
|
||||
//
|
||||
static bool StoreCertificate(X509 *cert, const boost::filesystem::path &filePath)
|
||||
static bool StoreCertificate(WOLFSSL_X509 *cert, const boost::filesystem::path &filePath)
|
||||
{
|
||||
if (!cert)
|
||||
return false;
|
||||
@ -213,7 +195,7 @@ static bool StoreCertificate(X509 *cert, const boost::filesystem::path &filePath
|
||||
FILE *certfd = fopen(filePath.string().c_str(), "wb");
|
||||
if (certfd)
|
||||
{
|
||||
bStored = PEM_write_X509(certfd, cert);
|
||||
bStored = wolfSSL_PEM_write_X509(certfd, cert);
|
||||
fclose(certfd);
|
||||
}
|
||||
|
||||
@ -222,34 +204,74 @@ static bool StoreCertificate(X509 *cert, const boost::filesystem::path &filePath
|
||||
|
||||
// Loads key from file, specified by the 'filePath'
|
||||
//
|
||||
static EVP_PKEY* LoadKey(const boost::filesystem::path &filePath, const std::string &passphrase)
|
||||
static WOLFSSL_EVP_PKEY* old_LoadKey(const boost::filesystem::path &filePath, const std::string &passphrase)
|
||||
{
|
||||
if (!boost::filesystem::exists(filePath))
|
||||
return NULL;
|
||||
|
||||
EVP_PKEY *key = NULL;
|
||||
WOLFSSL_EVP_PKEY *key = wolfSSL_EVP_PKEY_new();
|
||||
FILE *keyfd = fopen(filePath.string().c_str(), "rb");
|
||||
if (keyfd)
|
||||
{
|
||||
key = PEM_read_PrivateKey(keyfd, NULL, NULL, passphrase.length() ? (void*)passphrase.c_str() : NULL);
|
||||
key = wolfSSL_PEM_read_PrivateKey(keyfd, NULL, NULL, passphrase.length() ? (void*)passphrase.c_str() : NULL);
|
||||
fclose(keyfd);
|
||||
}
|
||||
|
||||
return key;
|
||||
}
|
||||
|
||||
// Loads key from file, specified by the 'filePath'
|
||||
//
|
||||
static WOLFSSL_EVP_PKEY* LoadKey(const boost::filesystem::path &filePath, const std::string &passphrase)
|
||||
{
|
||||
if (!boost::filesystem::exists(filePath))
|
||||
return NULL;
|
||||
|
||||
WOLFSSL_EVP_PKEY *key = NULL;
|
||||
FILE *keyfd = fopen(filePath.string().c_str(), "rb");
|
||||
byte der[4096];
|
||||
byte pem[4096];
|
||||
WOLFSSL_EC_KEY *ecKey;
|
||||
ecKey = wolfSSL_EC_KEY_new();
|
||||
word32 idx = 0;
|
||||
|
||||
if (keyfd)
|
||||
{
|
||||
int fileSz = fread(pem, 1, 4096, keyfd);
|
||||
fclose(keyfd);
|
||||
|
||||
if (fileSz > 0)
|
||||
{
|
||||
if (ecKey)
|
||||
{
|
||||
int derSz = wc_KeyPemToDer(pem, fileSz, der, 4096, passphrase.c_str());
|
||||
int ret_decode = wc_EccPrivateKeyDecode(der, &idx, (ecc_key*)ecKey->internal, derSz);
|
||||
if (ret_decode == 0)
|
||||
{
|
||||
if (key = wolfSSL_EVP_PKEY_new())
|
||||
{
|
||||
wolfSSL_EVP_PKEY_assign_EC_KEY(key, ecKey);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return key;
|
||||
}
|
||||
|
||||
// Loads certificate from file, specified by the 'filePath'
|
||||
//
|
||||
static X509* LoadCertificate(const boost::filesystem::path &filePath)
|
||||
static WOLFSSL_X509* LoadCertificate(const boost::filesystem::path &filePath)
|
||||
{
|
||||
if (!boost::filesystem::exists(filePath))
|
||||
return NULL;
|
||||
|
||||
X509 *cert = NULL;
|
||||
WOLFSSL_X509 *cert = NULL;
|
||||
FILE *certfd = fopen(filePath.string().c_str(), "rb");
|
||||
if (certfd)
|
||||
{
|
||||
cert = PEM_read_X509(certfd, NULL, NULL, NULL);
|
||||
cert = wolfSSL_PEM_read_X509(certfd, NULL, NULL, NULL);
|
||||
fclose(certfd);
|
||||
}
|
||||
|
||||
@ -259,59 +281,24 @@ static X509* LoadCertificate(const boost::filesystem::path &filePath)
|
||||
// Verifies if the private key in 'key' matches the public key in 'cert'
|
||||
// (Signs random bytes on 'key' and verifies signature correctness on public key from 'cert')
|
||||
//
|
||||
static bool IsMatching(EVP_PKEY *key, X509 *cert)
|
||||
static bool IsMatching(WOLFSSL_EVP_PKEY *key, WOLFSSL_X509 *cert)
|
||||
{
|
||||
if (!key || !cert)
|
||||
return false;
|
||||
|
||||
bool bIsMatching = false;
|
||||
|
||||
EVP_PKEY_CTX *ctxSign = EVP_PKEY_CTX_new(key, NULL);
|
||||
if (ctxSign)
|
||||
if (wolfSSL_X509_verify(cert, key) == WOLFSSL_SUCCESS)
|
||||
{
|
||||
if (EVP_PKEY_sign_init(ctxSign) == 1 &&
|
||||
EVP_PKEY_CTX_set_signature_md(ctxSign, EVP_sha512()) > 0)
|
||||
{
|
||||
unsigned char digest[SHA512_DIGEST_LENGTH] = { 0 };
|
||||
size_t digestSize = sizeof digest, signatureSize = 0;
|
||||
|
||||
if (RAND_bytes((unsigned char*)&digest, digestSize) && // set random bytes as a digest
|
||||
EVP_PKEY_sign(ctxSign, NULL, &signatureSize, digest, digestSize) == 1) // determine buffer length
|
||||
{
|
||||
unsigned char *signature = (unsigned char*)OPENSSL_malloc(signatureSize);
|
||||
if (signature)
|
||||
{
|
||||
if (EVP_PKEY_sign(ctxSign, signature, &signatureSize, digest, digestSize) == 1)
|
||||
{
|
||||
EVP_PKEY *pubkey = X509_get_pubkey(cert);
|
||||
if (pubkey)
|
||||
{
|
||||
EVP_PKEY_CTX *ctxVerif = EVP_PKEY_CTX_new(pubkey, NULL);
|
||||
if (ctxVerif)
|
||||
{
|
||||
if (EVP_PKEY_verify_init(ctxVerif) == 1 &&
|
||||
EVP_PKEY_CTX_set_signature_md(ctxVerif, EVP_sha512()) > 0)
|
||||
{
|
||||
bIsMatching = (EVP_PKEY_verify(ctxVerif, signature, signatureSize, digest, digestSize) == 1);
|
||||
}
|
||||
EVP_PKEY_CTX_free(ctxVerif);
|
||||
}
|
||||
EVP_PKEY_free(pubkey);
|
||||
}
|
||||
}
|
||||
OPENSSL_free(signature);
|
||||
}
|
||||
}
|
||||
}
|
||||
EVP_PKEY_CTX_free(ctxSign);
|
||||
return true;
|
||||
}
|
||||
|
||||
return bIsMatching;
|
||||
|
||||
LogPrintf("Loaded key and certificate do not match, delete them to generate new credentials!!!\n");
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
// Checks the correctness of a private-public key pair and the validity of a certificate using public key from key pair
|
||||
//
|
||||
static bool CheckCredentials(EVP_PKEY *key, X509 *cert)
|
||||
static bool CheckCredentials(WOLFSSL_EVP_PKEY *key, WOLFSSL_X509 *cert)
|
||||
{
|
||||
if (!key || !cert)
|
||||
return false;
|
||||
@ -320,31 +307,29 @@ static bool CheckCredentials(EVP_PKEY *key, X509 *cert)
|
||||
|
||||
// Validating the correctness of a private-public key pair, depending on a key type
|
||||
//
|
||||
switch (EVP_PKEY_base_id(key))
|
||||
switch (wolfSSL_EVP_PKEY_base_id(key))
|
||||
{
|
||||
case EVP_PKEY_RSA:
|
||||
case EVP_PKEY_RSA2:
|
||||
{
|
||||
RSA *rsaKey = EVP_PKEY_get1_RSA(key);
|
||||
WOLFSSL_RSA *rsaKey = wolfSSL_EVP_PKEY_get1_RSA(key);
|
||||
if (rsaKey)
|
||||
{
|
||||
bIsOk = (RSA_check_key(rsaKey) == 1);
|
||||
RSA_free(rsaKey);
|
||||
bIsOk = (wc_CheckRsaKey((RsaKey*)rsaKey->internal) == 0);
|
||||
wolfSSL_RSA_free(rsaKey);
|
||||
}
|
||||
break;
|
||||
}
|
||||
case EVP_PKEY_EC:
|
||||
{
|
||||
EC_KEY *eccKey = EVP_PKEY_get1_EC_KEY(key);
|
||||
WOLFSSL_EC_KEY *eccKey = wolfSSL_EVP_PKEY_get1_EC_KEY(key);
|
||||
if (eccKey)
|
||||
{
|
||||
bIsOk = (EC_KEY_check_key(eccKey) == 1);
|
||||
EC_KEY_free(eccKey);
|
||||
bIsOk = (wc_ecc_check_key((ecc_key*)eccKey->internal) == 0);
|
||||
wolfSSL_EC_KEY_free(eccKey);
|
||||
}
|
||||
break;
|
||||
}
|
||||
// Currently only RSA & EC keys are supported.
|
||||
// Other key types can be added here in further.
|
||||
|
||||
default:
|
||||
bIsOk = false;
|
||||
@ -366,24 +351,28 @@ CredentialsStatus VerifyCredentials(
|
||||
{
|
||||
CredentialsStatus status = credAbsent;
|
||||
|
||||
EVP_PKEY *key = NULL;
|
||||
X509 *cert = NULL;
|
||||
WOLFSSL_EVP_PKEY *key = NULL;
|
||||
WOLFSSL_X509 *cert = NULL;
|
||||
|
||||
key = LoadKey(keyPath, passphrase);
|
||||
cert = LoadCertificate(certPath);
|
||||
|
||||
if (key && cert)
|
||||
if (key && cert) {
|
||||
status = CheckCredentials(key, cert) ? credOk : credNonConsistent;
|
||||
else if (!key && !cert)
|
||||
} else if (!key && !cert) {
|
||||
status = credAbsent;
|
||||
else
|
||||
} else {
|
||||
status = credPartiallyAbsent;
|
||||
|
||||
if (key)
|
||||
EVP_PKEY_free(key);
|
||||
if (cert)
|
||||
X509_free(cert);
|
||||
|
||||
}
|
||||
|
||||
if (key) {
|
||||
wolfSSL_EVP_PKEY_free(key);
|
||||
}
|
||||
|
||||
if (cert) {
|
||||
wolfSSL_X509_free(cert);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
@ -396,10 +385,10 @@ bool GenerateCredentials(
|
||||
{
|
||||
bool bGenerated = false;
|
||||
|
||||
EVP_PKEY *key = NULL;
|
||||
X509 *cert = NULL;
|
||||
WOLFSSL_EVP_PKEY *key = NULL;
|
||||
WOLFSSL_X509 *cert = NULL;
|
||||
|
||||
// Generating RSA key and the self-signed certificate for it
|
||||
// Generating key and the self-signed certificate for it
|
||||
//
|
||||
//key = GenerateRsaKey(TLS_RSA_KEY_SIZE, RSA_F4);
|
||||
//key = GenerateEcKey(NID_secp256k1);
|
||||
@ -409,16 +398,18 @@ bool GenerateCredentials(
|
||||
cert = GenerateCertificate(key);
|
||||
if (cert)
|
||||
{
|
||||
if (StoreKey(key, keyPath, passphrase) &&
|
||||
StoreCertificate(cert, certPath))
|
||||
bool bKey = StoreKey(key, keyPath, passphrase);
|
||||
bool bCert = StoreCertificate(cert, certPath);
|
||||
|
||||
if ( bKey && bCert )
|
||||
{
|
||||
bGenerated = true;
|
||||
LogPrintStr("TLS: New private key and self-signed certificate were generated successfully\n");
|
||||
}
|
||||
|
||||
X509_free(cert);
|
||||
wolfSSL_X509_free(cert);
|
||||
}
|
||||
EVP_PKEY_free(key);
|
||||
wolfSSL_EVP_PKEY_free(key);
|
||||
}
|
||||
|
||||
return bGenerated;
|
||||
@ -429,42 +420,35 @@ bool GenerateCredentials(
|
||||
// Validates peer certificate using a chain of CA certificates.
|
||||
// If some of intermediate CA certificates are absent in the trusted certificates store, then validation status will be 'false')
|
||||
//
|
||||
bool ValidatePeerCertificate(SSL *ssl)
|
||||
bool ValidatePeerCertificate(WOLFSSL *ssl)
|
||||
{
|
||||
if (!ssl)
|
||||
return false;
|
||||
|
||||
bool bIsOk = false;
|
||||
|
||||
X509 *cert = SSL_get_peer_certificate (ssl);
|
||||
if (cert)
|
||||
{
|
||||
// NOTE: SSL_get_verify_result() is only useful in connection with SSL_get_peer_certificate
|
||||
// (https://www.openssl.org/docs/man1.1.1/ssl/SSL_get_verify_result.html)
|
||||
long errCode = SSL_get_verify_result(ssl);
|
||||
WOLFSSL_X509 *cert = wolfSSL_get_peer_certificate (ssl);
|
||||
if (cert) {
|
||||
long errCode = wolfSSL_get_verify_result(ssl);
|
||||
if (errCode != X509_V_OK)
|
||||
{
|
||||
LogPrint("tls", "TLS: %s: %s():%d - Certificate Verification ERROR=%d: [%s]\n",
|
||||
__FILE__, __func__, __LINE__, errCode, X509_verify_cert_error_string(errCode));
|
||||
}
|
||||
else
|
||||
{
|
||||
__FILE__, __func__, __LINE__, errCode, wolfSSL_X509_verify_cert_error_string(errCode));
|
||||
} else {
|
||||
bIsOk = true;
|
||||
|
||||
char buf[256];
|
||||
X509_NAME_oneline(X509_get_subject_name(cert), buf, 256);
|
||||
char buf[256];
|
||||
wolfSSL_X509_NAME_oneline(wolfSSL_X509_get_subject_name(cert), buf, 256);
|
||||
LogPrint("tls", "TLS: %s: %s():%d - subj name=%s\n",
|
||||
__FILE__, __func__, __LINE__, buf);
|
||||
|
||||
X509_NAME_oneline(X509_get_issuer_name(cert), buf, 256);
|
||||
wolfSSL_X509_NAME_oneline(wolfSSL_X509_get_issuer_name(cert), buf, 256);
|
||||
LogPrint("tls", "TLS: %s: %s():%d - issuer name=%s\n",
|
||||
__FILE__, __func__, __LINE__, buf);
|
||||
}
|
||||
|
||||
X509_free(cert);
|
||||
}
|
||||
else
|
||||
{
|
||||
wolfSSL_X509_free(cert);
|
||||
} else {
|
||||
LogPrint("tls", "TLS: %s: %s():%d - WARNING: Peer does not have certificate\n",
|
||||
__FILE__, __func__, __LINE__);
|
||||
}
|
||||
@ -473,24 +457,21 @@ bool ValidatePeerCertificate(SSL *ssl)
|
||||
|
||||
// Check if a given context is set up with a cert that can be validated by this context
|
||||
//
|
||||
bool ValidateCertificate(SSL_CTX *ssl_ctx)
|
||||
bool ValidateCertificate(WOLFSSL_CTX *ssl_ctx)
|
||||
{
|
||||
if (!ssl_ctx)
|
||||
if (!ssl_ctx) {
|
||||
return false;
|
||||
|
||||
}
|
||||
|
||||
bool bIsOk = false;
|
||||
|
||||
X509_STORE *store = SSL_CTX_get_cert_store(ssl_ctx);
|
||||
WOLFSSL_X509_STORE *store = wolfSSL_CTX_get_cert_store(ssl_ctx);
|
||||
|
||||
if (store)
|
||||
{
|
||||
X509_STORE_CTX *ctx = X509_STORE_CTX_new();
|
||||
if (ctx)
|
||||
{
|
||||
if (X509_STORE_CTX_init(ctx, store, SSL_CTX_get0_certificate(ssl_ctx), NULL) == 1)
|
||||
bIsOk = X509_verify_cert(ctx) == 1;
|
||||
|
||||
X509_STORE_CTX_free(ctx);
|
||||
if (store) {
|
||||
WOLFSSL_X509_STORE_CTX *ctx = wolfSSL_X509_STORE_CTX_new();
|
||||
if (ctx) {
|
||||
bIsOk = (wolfSSL_X509_verify_cert(ctx) == WOLFSSL_SUCCESS);
|
||||
wolfSSL_X509_STORE_CTX_free(ctx);
|
||||
}
|
||||
}
|
||||
|
||||
@ -504,20 +485,14 @@ std::vector<boost::filesystem::path> GetDefaultTrustedDirectories()
|
||||
namespace fs = boost::filesystem;
|
||||
std::vector<fs::path> defaultDirectoriesList;
|
||||
|
||||
// Default certificates directory specified in OpenSSL build
|
||||
fs::path libDefaultDir = X509_get_default_cert_dir();
|
||||
|
||||
if (fs::exists(libDefaultDir))
|
||||
defaultDirectoriesList.push_back(libDefaultDir);
|
||||
|
||||
// Check and set all possible standard default directories
|
||||
for (const char *dir : defaultTrustedDirs)
|
||||
{
|
||||
fs::path defaultDir(dir);
|
||||
|
||||
if (defaultDir != libDefaultDir &&
|
||||
fs::exists(defaultDir))
|
||||
if (fs::exists(defaultDir)) {
|
||||
defaultDirectoriesList.push_back(defaultDir);
|
||||
}
|
||||
}
|
||||
|
||||
return defaultDirectoriesList;
|
||||
@ -526,26 +501,27 @@ std::vector<boost::filesystem::path> GetDefaultTrustedDirectories()
|
||||
// Loads default root certificates (placed in the 'defaultRootCerts') into the specified context.
|
||||
// Returns the number of loaded certificates.
|
||||
//
|
||||
int LoadDefaultRootCertificates(SSL_CTX *ctx)
|
||||
int LoadDefaultRootCertificates(WOLFSSL_CTX *ctx)
|
||||
{
|
||||
if (!ctx)
|
||||
if (!ctx) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
int certsLoaded = 0;
|
||||
|
||||
// Certificate text buffer 'defaultRootCerts' is a C string with certificates in PEM format
|
||||
BIO *memBuf = BIO_new_mem_buf(defaultRootCerts, -1);
|
||||
if (memBuf)
|
||||
{
|
||||
X509 *cert = NULL;
|
||||
while ((cert = PEM_read_bio_X509(memBuf, NULL, 0, NULL)))
|
||||
WOLFSSL_BIO *memBuf = wolfSSL_BIO_new_mem_buf(defaultRootCerts, -1);
|
||||
if (memBuf) {
|
||||
WOLFSSL_X509 *cert = NULL;
|
||||
while ((cert = wolfSSL_PEM_read_bio_X509(memBuf, NULL, 0, NULL)))
|
||||
{
|
||||
if (X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx), cert) > 0)
|
||||
if (wolfSSL_X509_STORE_add_cert(wolfSSL_CTX_get_cert_store(ctx), cert) > 0) {
|
||||
certsLoaded++;
|
||||
}
|
||||
|
||||
X509_free(cert);
|
||||
wolfSSL_X509_free(cert);
|
||||
}
|
||||
BIO_free(memBuf);
|
||||
wolfSSL_BIO_free(memBuf);
|
||||
}
|
||||
|
||||
return certsLoaded;
|
||||
|
||||
@ -37,20 +37,20 @@ bool GenerateCredentials(
|
||||
// Validates peer certificate using a chain of CA certificates.
|
||||
// If some of intermediate CA certificates are absent in the trusted certificates store, then validation status will be 'false')
|
||||
//
|
||||
bool ValidatePeerCertificate(SSL *ssl);
|
||||
bool ValidatePeerCertificate(WOLFSSL *ssl);
|
||||
|
||||
// Check if a given context is set up with a cert that can be validated by this context
|
||||
//
|
||||
bool ValidateCertificate(SSL_CTX *ssl_ctx);
|
||||
bool ValidateCertificate(WOLFSSL_CTX *ssl_ctx);
|
||||
|
||||
// Creates the list of available OpenSSL default directories for trusted certificates storage
|
||||
// Creates the list of available default directories for trusted certificates storage
|
||||
//
|
||||
std::vector<boost::filesystem::path> GetDefaultTrustedDirectories();
|
||||
|
||||
// Loads default root certificates (placed in the 'defaultRootCerts') into the specified context.
|
||||
// Returns the number of loaded certificates.
|
||||
//
|
||||
int LoadDefaultRootCertificates(SSL_CTX *ctx);
|
||||
int LoadDefaultRootCertificates(WOLFSSL_CTX *ctx);
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -77,7 +77,8 @@
|
||||
#include <boost/interprocess/sync/file_lock.hpp>
|
||||
#include <boost/thread.hpp>
|
||||
#include <chrono>
|
||||
#include <openssl/crypto.h>
|
||||
#include <wolfssl/options.h>
|
||||
#include <wolfssl/ssl.h>
|
||||
#include <thread>
|
||||
|
||||
#if ENABLE_ZMQ
|
||||
@ -1435,7 +1436,7 @@ bool AppInit2(boost::thread_group& threadGroup, CScheduler& scheduler)
|
||||
|
||||
if (fPrintToDebugLog)
|
||||
OpenDebugLog();
|
||||
LogPrintf("Using OpenSSL version %s\n", SSLeay_version(SSLEAY_VERSION));
|
||||
LogPrintf("Using WolfSSL version %s\n", wolfSSL_lib_version());
|
||||
#ifdef ENABLE_WALLET
|
||||
LogPrintf("Using BerkeleyDB version %s\n", DbEnv::version(0, 0, 0));
|
||||
#endif
|
||||
|
||||
@ -44,9 +44,8 @@
|
||||
#include <boost/filesystem.hpp>
|
||||
#include <boost/thread.hpp>
|
||||
|
||||
#include <openssl/conf.h>
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/err.h>
|
||||
#include <wolfssl/options.h>
|
||||
#include <wolfssl/ssl.h>
|
||||
#include <hush/tlsmanager.cpp>
|
||||
using namespace hush;
|
||||
|
||||
@ -747,7 +746,7 @@ void CNode::copyStats(CNodeStats &stats, const std::vector<bool> &m_asmap)
|
||||
// If ssl != NULL it means TLS connection was established successfully
|
||||
{
|
||||
LOCK(cs_hSocket);
|
||||
stats.fTLSEstablished = (ssl != NULL) && (SSL_get_state(ssl) == TLS_ST_OK);
|
||||
stats.fTLSEstablished = (ssl != NULL) && (wolfSSL_is_init_finished(ssl) == 1);
|
||||
stats.fTLSVerified = (ssl != NULL) && ValidatePeerCertificate(ssl);
|
||||
}
|
||||
}
|
||||
|
||||
@ -46,9 +46,9 @@
|
||||
#include <boost/foreach.hpp>
|
||||
#include <boost/signals2/signal.hpp>
|
||||
|
||||
// Enable OpenSSL Support for Hush
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/ssl.h>
|
||||
// Enable WolfSSL Support for Hush
|
||||
#include <wolfssl/options.h>
|
||||
#include <wolfssl/ssl.h>
|
||||
|
||||
class CAddrMan;
|
||||
class CBlockIndex;
|
||||
|
||||
43
src/util.cpp
43
src/util.cpp
@ -101,8 +101,6 @@
|
||||
#include <boost/program_options/detail/config_file.hpp>
|
||||
#include <boost/program_options/parsers.hpp>
|
||||
#include <boost/thread.hpp>
|
||||
#include <openssl/crypto.h>
|
||||
#include <openssl/conf.h>
|
||||
|
||||
// Work around clang compilation problem in Boost 1.46:
|
||||
// /usr/include/boost/program_options/detail/config_file.hpp:163:17: error: call to function 'to_internal' that is neither visible in the template definition nor found by argument-dependent lookup
|
||||
@ -133,47 +131,6 @@ bool fLogIPs = DEFAULT_LOGIPS;
|
||||
std::atomic<bool> fReopenDebugLog(false);
|
||||
CTranslationInterface translationInterface;
|
||||
|
||||
/** Init OpenSSL library multithreading support */
|
||||
static CCriticalSection** ppmutexOpenSSL;
|
||||
void locking_callback(int mode, int i, const char* file, int line) NO_THREAD_SAFETY_ANALYSIS
|
||||
{
|
||||
if (mode & CRYPTO_LOCK) {
|
||||
ENTER_CRITICAL_SECTION(*ppmutexOpenSSL[i]);
|
||||
} else {
|
||||
LEAVE_CRITICAL_SECTION(*ppmutexOpenSSL[i]);
|
||||
}
|
||||
}
|
||||
|
||||
// Init
|
||||
static class CInit
|
||||
{
|
||||
public:
|
||||
CInit()
|
||||
{
|
||||
// Init OpenSSL library multithreading support
|
||||
ppmutexOpenSSL = (CCriticalSection**)OPENSSL_malloc(CRYPTO_num_locks() * sizeof(CCriticalSection*));
|
||||
for (int i = 0; i < CRYPTO_num_locks(); i++)
|
||||
ppmutexOpenSSL[i] = new CCriticalSection();
|
||||
CRYPTO_set_locking_callback(locking_callback);
|
||||
|
||||
// OpenSSL can optionally load a config file which lists optional loadable modules and engines.
|
||||
// We don't use them so we don't require the config. However some of our libs may call functions
|
||||
// which attempt to load the config file, possibly resulting in an exit() or crash if it is missing
|
||||
// or corrupt. Explicitly tell OpenSSL not to try to load the file. The result for our libs will be
|
||||
// that the config appears to have been loaded and there are no modules/engines available.
|
||||
OPENSSL_no_config();
|
||||
}
|
||||
~CInit()
|
||||
{
|
||||
// Shutdown OpenSSL library multithreading support
|
||||
CRYPTO_set_locking_callback(NULL);
|
||||
for (int i = 0; i < CRYPTO_num_locks(); i++)
|
||||
delete ppmutexOpenSSL[i];
|
||||
OPENSSL_free(ppmutexOpenSSL);
|
||||
}
|
||||
}
|
||||
instance_of_cinit;
|
||||
|
||||
/**
|
||||
* LogPrintf() has been broken a couple of times now
|
||||
* by well-meaning people adding mutexes in the most straightforward way.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user