Codebase list getdns / fdd3992
openssl 1.1 support Willem Toorop 8 years ago
6 changed file(s) with 70 addition(s) and 36 deletion(s). Raw diff Collapse all Expand all
+13
-1
configure.ac less more
222222 fi
223223 AC_CHECK_HEADERS([openssl/conf.h],,, [AC_INCLUDES_DEFAULT])
224224 AC_CHECK_HEADERS([openssl/engine.h],,, [AC_INCLUDES_DEFAULT])
225 AC_CHECK_FUNCS([OPENSSL_config EVP_md5 EVP_sha1 EVP_sha224 EVP_sha256 EVP_sha384 EVP_sha512 FIPS_mode])
225 AC_CHECK_FUNCS([OPENSSL_config EVP_md5 EVP_sha1 EVP_sha224 EVP_sha256 EVP_sha384 EVP_sha512 FIPS_mode ENGINE_load_cryptodev EVP_PKEY_keygen ECDSA_SIG_get0 EVP_MD_CTX_new EVP_PKEY_base_id HMAC_CTX_new HMAC_CTX_free TLS_client_method])
226226 AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [
227227 AC_INCLUDES_DEFAULT
228228 #ifdef HAVE_OPENSSL_ERR_H
403403 ;;
404404 esac
405405
406 AC_ARG_ENABLE(dsa, AC_HELP_STRING([--disable-dsa], [Disable DSA support]))
407 case "$enable_dsa" in
408 no)
409 ;;
410 *) dnl default
411 # detect if DSA is supported, and turn it off if not.
412 AC_CHECK_FUNC(EVP_dss1, [
413 AC_DEFINE_UNQUOTED([USE_DSA], [1], [Define this to enable DSA support.])
414 ], [if test "x$enable_dsa" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support DSA and you used --enable-dsa.])
415 fi ])
416 ;;
417 esac
406418
407419 AC_ARG_ENABLE(draft-dnssec-roadblock-avoidance, AC_HELP_STRING([--enable-draft-dnssec-roadblock-avoidance], [Enable experimental dnssec roadblock avoidance]))
408420 AC_ARG_ENABLE(draft-edns-cookies, AC_HELP_STRING([--enable-draft-edns-cookies], [Enable experimental edns cookies]))
+13
-13
m4/acx_openssl.m4 less more
4646 ACX_RUNTIME_PATH_ADD([$ssldir/lib])
4747 fi
4848
49 AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto])
49 AC_MSG_CHECKING([for HMAC_Update in -lcrypto])
5050 LIBS="-lssl -lcrypto $LIBS"
5151 LIBSSL_LIBS="-lssl -lcrypto $LIBSSL_LIBS"
5252 AC_TRY_LINK(, [
53 int HMAC_CTX_init(void);
54 (void)HMAC_CTX_init();
53 int HMAC_Update(void);
54 (void)HMAC_Update();
5555 ], [
56 AC_DEFINE([HAVE_HMAC_UPDATE], 1,
57 [If you have HMAC_Update])
5658 AC_MSG_RESULT(yes)
57 AC_DEFINE([HAVE_HMAC_CTX_INIT], 1,
58 [If you have HMAC_CTX_init])
5959 ], [
6060 AC_MSG_RESULT(no)
6161 # check if -lwsock32 or -lgdi32 are needed.
6565 LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32"
6666 AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
6767 AC_TRY_LINK([], [
68 int HMAC_CTX_init(void);
69 (void)HMAC_CTX_init();
68 int HMAC_Update(void);
69 (void)HMAC_Update();
7070 ],[
71 AC_DEFINE([HAVE_HMAC_CTX_INIT], 1,
72 [If you have HMAC_CTX_init])
71 AC_DEFINE([HAVE_HMAC_UPDATE], 1,
72 [If you have HMAC_Update])
7373 AC_MSG_RESULT(yes)
7474 ],[
7575 AC_MSG_RESULT(no)
7979 LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
8080 AC_MSG_CHECKING([if -lcrypto needs -ldl])
8181 AC_TRY_LINK([], [
82 int HMAC_CTX_init(void);
83 (void)HMAC_CTX_init();
82 int HMAC_Update(void);
83 (void)HMAC_Update();
8484 ],[
85 AC_DEFINE([HAVE_HMAC_CTX_INIT], 1,
86 [If you have HMAC_CTX_init])
85 AC_DEFINE([HAVE_HMAC_UPDATE], 1,
86 [If you have HMAC_Update])
8787 AC_MSG_RESULT(yes)
8888 ],[
8989 AC_MSG_RESULT(no)
+21
-6
src/context.c less more
12311231 result->edns_do_bit = 0;
12321232 result->edns_client_subnet_private = 0;
12331233 result->tls_query_padding_blocksize = 1; /* default is to not try to pad */
1234 result-> tls_ctx = NULL;
1234 result->tls_ctx = NULL;
12351235
12361236 result->extension = &result->default_eventloop.loop;
12371237 _getdns_default_eventloop_init(&result->default_eventloop);
19251925 getdns_context_set_dns_root_servers(
19261926 getdns_context *context, getdns_list *addresses)
19271927 {
1928 #if defined(HAVE_LIBUNBOUND) && !defined(HAVE_UB_CTX_SET_STUB)
1928 #ifdef HAVE_LIBUNBOUND
1929 # ifndef HAVE_UB_CTX_SET_STUB
19291930 char tmpfn[FILENAME_MAX] = P_tmpdir "/getdns-root-dns-servers-XXXXXX";
19301931 FILE *fh;
19311932 int fd;
19321933 size_t dst_len;
1933 #endif
1934 # endif
19341935 size_t i;
19351936 getdns_dict *rr_dict;
19361937 getdns_return_t r;
19371938 getdns_bindata *addr_bd;
19381939 char dst[2048];
1940 #endif
19391941 getdns_list *newlist;
19401942
19411943 if (!context)
28922894 if (context->tls_ctx == NULL) {
28932895 #ifdef HAVE_TLS_v1_2
28942896 /* Create client context, use TLS v1.2 only for now */
2897 # ifdef HAVE_TLS_CLIENT_METHOD
2898 context->tls_ctx = SSL_CTX_new(TLS_client_method());
2899 # else
28952900 context->tls_ctx = SSL_CTX_new(TLSv1_2_client_method());
2901 # endif
28962902 if(context->tls_ctx == NULL)
28972903 return GETDNS_RETURN_BAD_CONTEXT;
2904
2905 # ifdef HAVE_TLS_CLIENT_METHOD
2906 if (!SSL_CTX_set_min_proto_version(
2907 context->tls_ctx, TLS1_2_VERSION)) {
2908 SSL_CTX_free(context->tls_ctx);
2909 context->tls_ctx = NULL;
2910 return GETDNS_RETURN_BAD_CONTEXT;
2911 }
2912 # endif
28982913 /* Be strict and only use the cipher suites recommended in RFC7525
28992914 Unless we later fallback to opportunistic. */
29002915 const char* const PREFERRED_CIPHERS = "EECDH+aRSA+AESGCM:EECDH+aECDSA+AESGCM:EDH+aRSA+AESGCM";
29022917 return GETDNS_RETURN_BAD_CONTEXT;
29032918 /* For strict authentication, we must have local root certs available
29042919 Set up is done only when the tls_ctx is created (per getdns_context)*/
2905 #ifndef USE_WINSOCK
2920 # ifndef USE_WINSOCK
29062921 if (!SSL_CTX_set_default_verify_paths(context->tls_ctx)) {
2907 #else
2922 # else
29082923 if (!add_WIN_cacerts_to_openssl_store(context->tls_ctx)) {
2909 #endif /* USE_WINSOCK */
2924 # endif /* USE_WINSOCK */
29102925 if (context->tls_auth_min == GETDNS_AUTHENTICATION_REQUIRED)
29112926 return GETDNS_RETURN_BAD_CONTEXT;
29122927 }
+1
-6
src/pubkey-pinning.c less more
392392 }
393393
394394 x = sk_X509_value(store->untrusted, i);
395 if (x->cert_info == NULL)
396 continue;
397395 #if defined(STUB_DEBUG) && STUB_DEBUG
398396 DEBUG_STUB("%s %-35s: Name of cert: %d ",
399397 STUB_DEBUG_SETUP_TLS, __FUNCTION__, i);
400398 if (x->cert_info->subject != NULL)
401 X509_NAME_print_ex_fp(stderr, x->cert_info->subject, 1, XN_FLAG_ONELINE);
399 X509_NAME_print_ex_fp(stderr, X509_get_subject_name(x), 1, XN_FLAG_ONELINE);
402400 fprintf(stderr, "\n");
403401 #endif
404 if (x->cert_info->key == NULL)
405 continue;
406
407402 /* digest the cert with sha256 */
408403 len = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x), NULL);
409404 if (len > sizeof(raw)) {
+20
-10
src/request-internal.c less more
458458 unsigned int result_mac_len = EVP_MAX_MD_SIZE;
459459 uint16_t original_id;
460460 const EVP_MD *digester;
461 HMAC_CTX ctx;
461 HMAC_CTX *ctx;
462 #ifndef HAVE_HMAC_CTX_NEW
463 HMAC_CTX ctx_space;
464 #endif
462465
463466 DEBUG_STUB("%s %-35s: Validate TSIG\n", STUB_DEBUG_TSIG, __FUNCTION__);
464467 for ( rr = _getdns_rr_iter_init(&rr_spc, req->query,
586589 #endif
587590 default : return;
588591 }
589
590 HMAC_CTX_init(&ctx);
591 (void) HMAC_Init_ex(&ctx, req->upstream->tsig_key,
592 #ifdef HAVE_HMAC_CTX_NEW
593 ctx = HMAC_CTX_new();
594 #else
595 ctx = &ctx_space;
596 HMAC_CTX_init(ctx);
597 #endif
598 (void) HMAC_Init_ex(ctx, req->upstream->tsig_key,
592599 req->upstream->tsig_size, digester, NULL);
593 (void) HMAC_Update(&ctx, request_mac - 2, request_mac_len + 2);
594 (void) HMAC_Update(&ctx, req->response, rr->pos - req->response);
595 (void) HMAC_Update(&ctx, tsig_vars, gldns_buffer_position(&gbuf));
596 HMAC_Final(&ctx, result_mac, &result_mac_len);
600 (void) HMAC_Update(ctx, request_mac - 2, request_mac_len + 2);
601 (void) HMAC_Update(ctx, req->response, rr->pos - req->response);
602 (void) HMAC_Update(ctx, tsig_vars, gldns_buffer_position(&gbuf));
603 HMAC_Final(ctx, result_mac, &result_mac_len);
597604
598605 DEBUG_STUB("%s %-35s: Result MAC length: %d\n",
599606 STUB_DEBUG_TSIG, __FUNCTION__, (int)(result_mac_len));
601608 memcmp(result_mac, response_mac, result_mac_len) == 0)
602609 req->tsig_status = GETDNS_DNSSEC_SECURE;
603610
604 HMAC_CTX_cleanup(&ctx);
605
611 #ifdef HAVE_HMAC_CTX_FREE
612 HMAC_CTX_free(ctx);
613 #else
614 HMAC_CTX_cleanup(ctx);
615 #endif
606616 gldns_write_uint16(req->response, gldns_read_uint16(req->query));
607617 gldns_write_uint16(req->response + 10,
608618 gldns_read_uint16(req->response + 10) + 1);
+2
-0
src/sync.c less more
5656 static getdns_return_t
5757 getdns_sync_data_init(getdns_context *context, getdns_sync_data *data)
5858 {
59 #ifdef HAVE_LIBUNBOUND
5960 getdns_eventloop *ext = &context->sync_eventloop.loop;
61 #endif
6062
6163 data->context = context;
6264 data->to_run = 1;