Commits
Jan Starý authored and Joshua Root committed 913892e8640
1 + | --- src/http.c.orig 2017-08-03 02:27:06.000000000 +0200 |
2 + | +++ src/http.c 2018-01-11 17:23:29.000000000 +0100 |
3 + | |
4 + | return ret; |
5 + | } |
6 + | |
7 + | -# if OPENSSL_VERSION_NUMBER<0x10100000L |
8 + | +# if OPENSSL_VERSION_NUMBER<0x10100000L || defined(LIBRESSL_VERSION_NUMBER) |
9 + | # define BIO_set_data(_b,_ptr) ((_b)->ptr=(_ptr)) |
10 + | # define BIO_set_init(_b,_init) ((_b)->init=(_init)) |
11 + | # define ASN1_STRING_get0_data ASN1_STRING_data |
12 + | |
13 + | |
14 + | static int op_bio_retry_new(BIO *_b){ |
15 + | BIO_set_init(_b,1); |
16 + | -# if OPENSSL_VERSION_NUMBER<0x10100000L |
17 + | +# if OPENSSL_VERSION_NUMBER<0x10100000L || defined(LIBRESSL_VERSION_NUMBER) |
18 + | _b->num=0; |
19 + | # endif |
20 + | BIO_set_data(_b,NULL); |
21 + | |
22 + | return _b!=NULL; |
23 + | } |
24 + | |
25 + | -# if OPENSSL_VERSION_NUMBER<0x10100000L |
26 + | +# if OPENSSL_VERSION_NUMBER<0x10100000L || defined(LIBRESSL_VERSION_NUMBER) |
27 + | /*This is not const because OpenSSL doesn't allow it, even though it won't |
28 + | write to it.*/ |
29 + | static BIO_METHOD op_bio_retry_method={ |
30 + | |
31 + | proxying https URL requests.*/ |
32 + | static int op_http_conn_establish_tunnel(OpusHTTPStream *_stream, |
33 + | OpusHTTPConn *_conn,op_sock _fd,SSL *_ssl_conn,BIO *_ssl_bio){ |
34 + | -# if OPENSSL_VERSION_NUMBER>=0x10100000L |
35 + | +# if OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) |
36 + | BIO_METHOD *bio_retry_method; |
37 + | # endif |
38 + | BIO *retry_bio; |
39 + | |
40 + | ret=op_http_conn_write_fully(_conn, |
41 + | _stream->proxy_connect.buf,_stream->proxy_connect.nbuf); |
42 + | if(OP_UNLIKELY(ret<0))return ret; |
43 + | -# if OPENSSL_VERSION_NUMBER>=0x10100000L |
44 + | +# if OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) |
45 + | bio_retry_method=BIO_meth_new(BIO_TYPE_NULL,"retry"); |
46 + | if(bio_retry_method==NULL)return OP_EFAULT; |
47 + | BIO_meth_set_write(bio_retry_method,op_bio_retry_write); |
48 + | |
49 + | /*This shouldn't succeed, since we can't read yet.*/ |
50 + | OP_ALWAYS_TRUE(SSL_connect(_ssl_conn)<0); |
51 + | SSL_set_bio(_ssl_conn,_ssl_bio,_ssl_bio); |
52 + | -# if OPENSSL_VERSION_NUMBER>=0x10100000L |
53 + | +# if OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) |
54 + | BIO_meth_free(bio_retry_method); |
55 + | # endif |
56 + | /*Only now do we disable write coalescing, to allow the CONNECT |
57 + | |
58 + | return NULL; |
59 + | } |
60 + | |
61 + | -# if OPENSSL_VERSION_NUMBER<0x10002000L |
62 + | +# if OPENSSL_VERSION_NUMBER<0x10002000L || defined(LIBRESSL_VERSION_NUMBER) |
63 + | /*Match a host name against a host with a possible wildcard pattern according |
64 + | to the rules of RFC 6125 Section 6.4.3. |
65 + | Return: 0 if the pattern doesn't match, and a non-zero value if it does.*/ |
66 + | |
67 + | SSL_set_tlsext_host_name(_ssl_conn,_stream->url.host); |
68 + | # endif |
69 + | skip_certificate_check=_stream->skip_certificate_check; |
70 + | -# if OPENSSL_VERSION_NUMBER>=0x10002000L |
71 + | +# if OPENSSL_VERSION_NUMBER>=0x10002000L && !defined(LIBRESSL_VERSION_NUMBER) |
72 + | /*As of version 1.0.2, OpenSSL can finally do hostname checks automatically. |
73 + | Of course, they make it much more complicated than it needs to be.*/ |
74 + | if(!skip_certificate_check){ |
75 + | |
76 + | if(OP_UNLIKELY(ret<=0))return OP_FALSE; |
77 + | ssl_session=_stream->ssl_session; |
78 + | if(ssl_session==NULL |
79 + | -# if OPENSSL_VERSION_NUMBER<0x10002000L |
80 + | +# if OPENSSL_VERSION_NUMBER<0x10002000L || defined(LIBRESSL_VERSION_NUMBER) |
81 + | ||!skip_certificate_check |
82 + | # endif |
83 + | ){ |
84 + | ret=op_do_ssl_step(_ssl_conn,_fd,SSL_do_handshake); |
85 + | if(OP_UNLIKELY(ret<=0))return OP_FALSE; |
86 + | -# if OPENSSL_VERSION_NUMBER<0x10002000L |
87 + | +# if OPENSSL_VERSION_NUMBER<0x10002000L || defined(LIBRESSL_VERSION_NUMBER) |
88 + | /*OpenSSL before version 1.0.2 does not do automatic hostname verification, |
89 + | despite the fact that we just passed it the hostname above in the call |
90 + | to SSL_set_tlsext_host_name(). |
91 + | |
92 + | /*Initialize the SSL library if necessary.*/ |
93 + | if(OP_URL_IS_SSL(&_stream->url)&&_stream->ssl_ctx==NULL){ |
94 + | SSL_CTX *ssl_ctx; |
95 + | -# if OPENSSL_VERSION_NUMBER<0x10100000L |
96 + | +# if OPENSSL_VERSION_NUMBER<0x10100000L || defined(LIBRESSL_VERSION_NUMBER) |
97 + | # if !defined(OPENSSL_NO_LOCKING) |
98 + | /*The documentation says SSL_library_init() is not reentrant. |
99 + | We don't want to add our own depenencies on a threading library, and it |