Codebase list librelp / b4a4997
Merge tag 'upstream/1.2.5' Upstream version 1.2.5 Michael Biebl 10 years ago
6 changed file(s) with 127 addition(s) and 29 deletion(s). Raw diff Collapse all Expand all
+5
-0
ChangeLog less more
0 ----------------------------------------------------------------------
1 Version 1.2.5 - 2014-03-20
2 - permit to use anonymous TLS on platforms where GnuTLS misses
3 certificate verification function. This permits to use at least
4 anon TLS on platforms like RHEL and CENTOS 6.
05 ----------------------------------------------------------------------
16 Version 1.2.4 - 2014-03-17
27 - correct API/ABI change in 1.2.3
+3
-0
config.h.in less more
1717
1818 /* Define to 1 if you have the `epoll_create1' function. */
1919 #undef HAVE_EPOLL_CREATE1
20
21 /* do we have gnutls_certificate_set_verify_function */
22 #undef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION
2023
2124 /* Define to 1 if you have the <inttypes.h> header file. */
2225 #undef HAVE_INTTYPES_H
+70
-24
configure less more
00 #! /bin/sh
11 # Guess values for system-dependent variables and create Makefiles.
2 # Generated by GNU Autoconf 2.69 for librelp 1.2.4.
2 # Generated by GNU Autoconf 2.69 for librelp 1.2.5.
33 #
44 # Report bugs to <rgerhards@adiscon.com>.
55 #
589589 # Identity of this package.
590590 PACKAGE_NAME='librelp'
591591 PACKAGE_TARNAME='librelp'
592 PACKAGE_VERSION='1.2.4'
593 PACKAGE_STRING='librelp 1.2.4'
592 PACKAGE_VERSION='1.2.5'
593 PACKAGE_STRING='librelp 1.2.5'
594594 PACKAGE_BUGREPORT='rgerhards@adiscon.com'
595595 PACKAGE_URL=''
596596
13221322 # Omit some internal or obsolete options to make the list less imposing.
13231323 # This message is too long to be a string in the A/UX 3.1 sh.
13241324 cat <<_ACEOF
1325 \`configure' configures librelp 1.2.4 to adapt to many kinds of systems.
1325 \`configure' configures librelp 1.2.5 to adapt to many kinds of systems.
13261326
13271327 Usage: $0 [OPTION]... [VAR=VALUE]...
13281328
13921392
13931393 if test -n "$ac_init_help"; then
13941394 case $ac_init_help in
1395 short | recursive ) echo "Configuration of librelp 1.2.4:";;
1395 short | recursive ) echo "Configuration of librelp 1.2.5:";;
13961396 esac
13971397 cat <<\_ACEOF
13981398
15071507 test -n "$ac_init_help" && exit $ac_status
15081508 if $ac_init_version; then
15091509 cat <<\_ACEOF
1510 librelp configure 1.2.4
1510 librelp configure 1.2.5
15111511 generated by GNU Autoconf 2.69
15121512
15131513 Copyright (C) 2012 Free Software Foundation, Inc.
20332033 This file contains any messages produced by compilers while
20342034 running configure, to aid debugging if configure makes a mistake.
20352035
2036 It was created by librelp $as_me 1.2.4, which was
2036 It was created by librelp $as_me 1.2.5, which was
20372037 generated by GNU Autoconf 2.69. Invocation command line was
20382038
20392039 $ $0 $@
28962896
28972897 # Define the identity of the package.
28982898 PACKAGE='librelp'
2899 VERSION='1.2.4'
2899 VERSION='1.2.5'
29002900
29012901
29022902 cat >>confdefs.h <<_ACEOF
29692969
29702970 # Define the identity of the package.
29712971 PACKAGE='librelp'
2972 VERSION='1.2.4'
2972 VERSION='1.2.5'
29732973
29742974
29752975 cat >>confdefs.h <<_ACEOF
1261812618 pkg_cv_GNUTLS_CFLAGS="$GNUTLS_CFLAGS"
1261912619 elif test -n "$PKG_CONFIG"; then
1262012620 if test -n "$PKG_CONFIG" && \
12621 { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"gnutls >= 2.9.10\""; } >&5
12622 ($PKG_CONFIG --exists --print-errors "gnutls >= 2.9.10") 2>&5
12621 { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"gnutls >= 2.0.0\""; } >&5
12622 ($PKG_CONFIG --exists --print-errors "gnutls >= 2.0.0") 2>&5
1262312623 ac_status=$?
1262412624 $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
1262512625 test $ac_status = 0; }; then
12626 pkg_cv_GNUTLS_CFLAGS=`$PKG_CONFIG --cflags "gnutls >= 2.9.10" 2>/dev/null`
12626 pkg_cv_GNUTLS_CFLAGS=`$PKG_CONFIG --cflags "gnutls >= 2.0.0" 2>/dev/null`
1262712627 test "x$?" != "x0" && pkg_failed=yes
1262812628 else
1262912629 pkg_failed=yes
1263512635 pkg_cv_GNUTLS_LIBS="$GNUTLS_LIBS"
1263612636 elif test -n "$PKG_CONFIG"; then
1263712637 if test -n "$PKG_CONFIG" && \
12638 { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"gnutls >= 2.9.10\""; } >&5
12639 ($PKG_CONFIG --exists --print-errors "gnutls >= 2.9.10") 2>&5
12638 { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"gnutls >= 2.0.0\""; } >&5
12639 ($PKG_CONFIG --exists --print-errors "gnutls >= 2.0.0") 2>&5
1264012640 ac_status=$?
1264112641 $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
1264212642 test $ac_status = 0; }; then
12643 pkg_cv_GNUTLS_LIBS=`$PKG_CONFIG --libs "gnutls >= 2.9.10" 2>/dev/null`
12643 pkg_cv_GNUTLS_LIBS=`$PKG_CONFIG --libs "gnutls >= 2.0.0" 2>/dev/null`
1264412644 test "x$?" != "x0" && pkg_failed=yes
1264512645 else
1264612646 pkg_failed=yes
1266112661 _pkg_short_errors_supported=no
1266212662 fi
1266312663 if test $_pkg_short_errors_supported = yes; then
12664 GNUTLS_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "gnutls >= 2.9.10" 2>&1`
12664 GNUTLS_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "gnutls >= 2.0.0" 2>&1`
1266512665 else
12666 GNUTLS_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "gnutls >= 2.9.10" 2>&1`
12666 GNUTLS_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "gnutls >= 2.0.0" 2>&1`
1266712667 fi
1266812668 # Put the nasty error message in config.log where it belongs
1266912669 echo "$GNUTLS_PKG_ERRORS" >&5
1267012670
12671 as_fn_error $? "Package requirements (gnutls >= 2.9.10) were not met:
12671 as_fn_error $? "Package requirements (gnutls >= 2.0.0) were not met:
1267212672
1267312673 $GNUTLS_PKG_ERRORS
1267412674
1270312703
1270412704 $as_echo "#define ENABLE_TLS 1" >>confdefs.h
1270512705
12706 fi
12706 # Check if we have support for proper cert validation
12707 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we have gnutls_certificate_set_verify_function" >&5
12708 $as_echo_n "checking if we have gnutls_certificate_set_verify_function... " >&6; }
12709 save_CFLAGS="$CFLAGS"
12710 CFLAGS="$CFLAGS $GNUTLS_CFLAGS"
12711 save_LIBS="$LIBS"
12712 LIBS="$LIBS $GNUTLS_LIBS"
12713 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
12714 /* end confdefs.h. */
12715
12716 #include <gnutls/gnutls.h>
12717 #include <gnutls/x509.h>
12718
12719 int
12720 main ()
12721 {
12722
12723 gnutls_certificate_set_verify_function(NULL, NULL);
12724
12725 ;
12726 return 0;
12727 }
12728 _ACEOF
12729 if ac_fn_c_try_link "$LINENO"; then :
12730
12731 { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
12732 $as_echo "yes" >&6; }
12733
12734 $as_echo "#define HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION 1" >>confdefs.h
12735
12736 have_gnutls_certificate_set_verify_function=yes
12737
12738 else
12739
12740 { $as_echo "$as_me:${as_lineno-$LINENO}: result: no; authentication disabled" >&5
12741 $as_echo "no; authentication disabled" >&6; }
12742 have_gnutls_certificate_set_verify_function=no
12743
12744
12745 fi
12746 rm -f core conftest.err conftest.$ac_objext \
12747 conftest$ac_exeext conftest.$ac_ext
12748 CFLAGS="$save_CFLAGS"
12749 LIBS="$save_LIBS"
12750 fi
12751
1270712752
1270812753 # debug mode settings
1270912754 # Check whether --enable-debug was given.
1327513320 # report actual input values of CONFIG_FILES etc. instead of their
1327613321 # values after options handling.
1327713322 ac_log="
13278 This file was extended by librelp $as_me 1.2.4, which was
13323 This file was extended by librelp $as_me 1.2.5, which was
1327913324 generated by GNU Autoconf 2.69. Invocation command line was
1328013325
1328113326 CONFIG_FILES = $CONFIG_FILES
1334113386 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
1334213387 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
1334313388 ac_cs_version="\\
13344 librelp config.status 1.2.4
13389 librelp config.status 1.2.5
1334513390 configured by $0, generated by GNU Autoconf 2.69,
1334613391 with options \\"\$ac_cs_config\\"
1334713392
1511515160 echo "*****************************************************"
1511615161 echo "librelp will be compiled with the following settings:"
1511715162 echo
15118 echo "Debug mode enabled: $enable_debug"
15119 echo "TLS enabled: $enable_tls"
15120
15163 echo "Debug mode enabled: $enable_debug"
15164 echo "TLS enabled: $enable_tls"
15165 echo "TLS authentication supported: $have_gnutls_certificate_set_verify_function"
15166
+29
-4
configure.ac less more
11 # Process this file with autoconf to produce a configure script.
22
33 AC_PREREQ(2.61)
4 AC_INIT([librelp], [1.2.4], [rgerhards@adiscon.com])
4 AC_INIT([librelp], [1.2.5], [rgerhards@adiscon.com])
55 AM_INIT_AUTOMAKE
66 AM_INIT_AUTOMAKE
77 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
5757 [enable_tls="yes"]
5858 )
5959 if test "$enable_tls" = "yes"; then
60 PKG_CHECK_MODULES(GNUTLS, gnutls >= 2.9.10)
60 PKG_CHECK_MODULES(GNUTLS, gnutls >= 2.0.0)
6161 AC_DEFINE(ENABLE_TLS, 1, [Defined if TLS support is enabled])
62 # Check if we have support for proper cert validation
63 AC_MSG_CHECKING(if we have gnutls_certificate_set_verify_function)
64 save_CFLAGS="$CFLAGS"
65 CFLAGS="$CFLAGS $GNUTLS_CFLAGS"
66 save_LIBS="$LIBS"
67 LIBS="$LIBS $GNUTLS_LIBS"
68 AC_TRY_LINK(
69 [
70 #include <gnutls/gnutls.h>
71 #include <gnutls/x509.h>
72 ], [
73 gnutls_certificate_set_verify_function(NULL, NULL);
74 ],[
75 AC_MSG_RESULT(yes)
76 AC_DEFINE(HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION, 1, [do we have gnutls_certificate_set_verify_function])
77 have_gnutls_certificate_set_verify_function=yes
78 ],[
79 AC_MSG_RESULT(no; authentication disabled)
80 have_gnutls_certificate_set_verify_function=no
81 ]
82 )
83 CFLAGS="$save_CFLAGS"
84 LIBS="$save_LIBS"
6285 fi
86
6387
6488 # debug mode settings
6589 AC_ARG_ENABLE(debug,
90114 echo "*****************************************************"
91115 echo "librelp will be compiled with the following settings:"
92116 echo
93 echo "Debug mode enabled: $enable_debug"
94 echo "TLS enabled: $enable_tls"
117 echo "Debug mode enabled: $enable_debug"
118 echo "TLS enabled: $enable_tls"
119 echo "TLS authentication supported: $have_gnutls_certificate_set_verify_function"
95120
+2
-1
src/librelp.h less more
150150 #define RELP_RET_ERR_INVAL RELPERR_BASE + 41 /**< some parameter is invalid (like EINVAL) */
151151 #define RELP_RET_ERR_EPOLL_CTL RELPERR_BASE + 42 /**< epoll_ctl() failed */
152152 #define RELP_RET_ERR_INTERNAL RELPERR_BASE + 43 /**< internal error in librelp (bug) */
153 #define RELP_RET_WRN_NO_KEEPALIVE RELPERR_BASE + 44/**< KEEPALIVE cannot be enabled */
153 #define RELP_RET_WRN_NO_KEEPALIVE RELPERR_BASE + 44 /**< KEEPALIVE cannot be enabled */
154154 #define RELP_RET_ERR_NO_TLS RELPERR_BASE + 45 /**< librelp compiled without TLS support */
155 #define RELP_RET_ERR_NO_TLS_AUTH RELPERR_BASE + 46 /**< platform does not provide TLS auth support */
155156
156157 /* some macros to work with librelp error codes */
157158 #define CHKRet(code) if((iRet = code) != RELP_RET_OK) goto finalize_it
+18
-0
src/tcp.c less more
22 * Copyright 2008-2014 by Rainer Gerhards and Adiscon GmbH.
33 *
44 * This file is part of librelp.
5 *
6 * Note: gnutls_certificate_set_verify_function is problematic, as it
7 * is not available in old GnuTLS versions, but rather important
8 * for verifying certificates correctly.
59 *
610 * Librelp is free software: you can redistribute it and/or modify
711 * it under the terms of the GNU General Public License as published by
6165
6266 #ifdef ENABLE_TLS
6367 /* forward definitions */
68 #ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION
6469 static int relpTcpVerifyCertificateCallback(gnutls_session_t session);
70 #endif /* #ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION */
6571 static relpRetVal relpTcpPermittedPeerWildcardCompile(tcpPermittedPeerEntry_t *pEtry);
6672
6773 /* helper to free permittedPeer structure */
750756 }
751757
752758 #ifdef ENABLE_TLS
759 #ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION
753760 /* Convert a fingerprint to printable data. The function must be provided a
754761 * sufficiently large buffer. 512 bytes shall always do.
755762 */
804811 }
805812 return r;
806813 }
814 #endif /* #ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION */
807815
808816 /* add a wildcard entry to this permitted peer. Entries are always
809817 * added at the tail of the list. pszStr and lenStr identify the wildcard
931939 LEAVE_RELPFUNC;
932940 }
933941
942 #ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION
934943 /* check a peer against a wildcard entry. This is a more lengthy
935944 * operation.
936945 */
12321241 gnutls_x509_crt_deinit(cert);
12331242 return r;
12341243 }
1244 #endif /* #ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION */
12351245
12361246 #if 0 /* enable if needed for debugging */
12371247 static void logFunction(int level, const char *msg)
12701280 }
12711281 gnutls_anon_set_server_dh_params(pThis->anoncredSrv, pThis->dh_params);
12721282 } else {
1283 # ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION
12731284 r = gnutls_certificate_allocate_credentials(&pThis->xcred);
12741285 if(chkGnutlsCode(pThis, "Failed to allocate certificate credentials", RELP_RET_ERR_TLS_SETUP, r)) {
12751286 ABORT_FINALIZE(RELP_RET_ERR_TLS_SETUP);
12911302 if(pThis->authmode == eRelpAuthMode_None)
12921303 pThis->authmode = eRelpAuthMode_Fingerprint;
12931304 gnutls_certificate_set_verify_function(pThis->xcred, relpTcpVerifyCertificateCallback);
1305 # else /* #ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION */
1306 ABORT_FINALIZE(RELP_RET_ERR_NO_TLS_AUTH);
1307 # endif /* #ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION */
12941308 }
12951309 finalize_it:
12961310 LEAVE_RELPFUNC;
16051619 ABORT_FINALIZE(RELP_RET_ERR_TLS_SETUP);
16061620 }
16071621 } else {
1622 # ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION
16081623 r = gnutls_certificate_allocate_credentials(&pThis->xcred);
16091624 if(chkGnutlsCode(pThis, "Failed to allocate certificate credentials", RELP_RET_ERR_TLS_SETUP, r)) {
16101625 ABORT_FINALIZE(RELP_RET_ERR_TLS_SETUP);
16321647 if(pThis->authmode == eRelpAuthMode_None)
16331648 pThis->authmode = eRelpAuthMode_Fingerprint;
16341649 gnutls_certificate_set_verify_function(pThis->xcred, relpTcpVerifyCertificateCallback);
1650 # else /* #ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION */
1651 ABORT_FINALIZE(RELP_RET_ERR_NO_TLS_AUTH);
1652 # endif /* #ifdef HAVE_GNUTLS_CERTIFICATE_SET_VERIFY_FUNCTION */
16351653 }
16361654
16371655 gnutls_transport_set_ptr(pThis->session, (gnutls_transport_ptr_t) pThis->sock);