ustream-openssl: wolfSSL: Add compatibility for wolfssl >= 5.0

[project/ustream-ssl.git] / ustream-openssl.c

diff --git a/ustream-openssl.c b/ustream-openssl.c
index 049aa407168c2e3d283321e8f4fb778ca3d19cb6..894dddb5afb1de7183284f7018243a1aeea581f6 100644 (file)
--- a/ustream-openssl.c
+++ b/ustream-openssl.c
@@ -20,7 +20,10 @@
 #include <ctype.h>
 #include "ustream-ssl.h"
 #include "ustream-internal.h"
+
+#if !defined(HAVE_WOLFSSL)
 #include <openssl/x509v3.h>
+#endif
 
 /* Ciphersuite preference:
  * - for server, no weak ciphers are used if you use an ECDSA key.
@@ -127,7 +130,15 @@ __ustream_ssl_context_new(bool server)
        if (!c)
                return NULL;
 
+#if defined(HAVE_WOLFSSL)
+       if (server)
+               SSL_CTX_set_verify(c, SSL_VERIFY_NONE, NULL);
+       else
+               SSL_CTX_set_verify(c, SSL_VERIFY_PEER, NULL);
+#else
        SSL_CTX_set_verify(c, SSL_VERIFY_NONE, NULL);
+#endif
+
        SSL_CTX_set_options(c, SSL_OP_NO_COMPRESSION | SSL_OP_SINGLE_ECDH_USE |
                               SSL_OP_CIPHER_SERVER_PREFERENCE);
 #if defined(SSL_CTX_set_ecdh_auto) && OPENSSL_VERSION_NUMBER < 0x10100000L
@@ -200,6 +211,18 @@ __hidden int __ustream_ssl_set_ciphers(struct ustream_ssl_ctx *ctx, const char *
        return 0;
 }
 
+__hidden int __ustream_ssl_set_require_validation(struct ustream_ssl_ctx *ctx, bool require)
+{
+       int mode = SSL_VERIFY_PEER;
+
+       if (!require)
+               mode = SSL_VERIFY_NONE;
+
+       SSL_CTX_set_verify((void *) ctx, mode, NULL);
+
+       return 0;
+}
+
 __hidden void __ustream_ssl_context_free(struct ustream_ssl_ctx *ctx)
 {
        SSL_CTX_free((void *) ctx);
@@ -207,8 +230,15 @@ __hidden void __ustream_ssl_context_free(struct ustream_ssl_ctx *ctx)
 
 void __ustream_ssl_session_free(void *ssl)
 {
+       BIO *bio = SSL_get_wbio(ssl);
+       struct bio_ctx *ctx = BIO_get_data(bio);
+
        SSL_shutdown(ssl);
        SSL_free(ssl);
+       if (ctx) {
+               BIO_meth_free(ctx->meth);
+               free(ctx);
+       }
 }
 
 static void ustream_ssl_error(struct ustream_ssl *us, int ret)
@@ -217,8 +247,6 @@ static void ustream_ssl_error(struct ustream_ssl *us, int ret)
        uloop_timeout_set(&us->error_timer, 0);
 }
 
-#ifndef NO_X509_CHECK_HOST
-
 static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert)
 {
        int ret;
@@ -234,8 +262,6 @@ static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert)
        return ret == 1;
 }
 
-#endif
-
 static void ustream_ssl_verify_cert(struct ustream_ssl *us)
 {
        void *ssl = us->ssl;
@@ -254,18 +280,69 @@ static void ustream_ssl_verify_cert(struct ustream_ssl *us)
                return;
 
        us->valid_cert = true;
-#ifndef NO_X509_CHECK_HOST
        us->valid_cn = ustream_ssl_verify_cn(us, cert);
-#endif
+
        X509_free(cert);
 }
 
+#ifdef WOLFSSL_SSL_H
+static bool handle_wolfssl_asn_error(struct ustream_ssl *us, int r)
+{
+       switch (r) {
+       case ASN_PARSE_E:
+       case ASN_VERSION_E:
+       case ASN_GETINT_E:
+       case ASN_RSA_KEY_E:
+       case ASN_OBJECT_ID_E:
+       case ASN_TAG_NULL_E:
+       case ASN_EXPECT_0_E:
+       case ASN_BITSTR_E:
+       case ASN_UNKNOWN_OID_E:
+       case ASN_DATE_SZ_E:
+       case ASN_BEFORE_DATE_E:
+       case ASN_AFTER_DATE_E:
+       case ASN_SIG_OID_E:
+       case ASN_TIME_E:
+       case ASN_INPUT_E:
+       case ASN_SIG_CONFIRM_E:
+       case ASN_SIG_HASH_E:
+       case ASN_SIG_KEY_E:
+       case ASN_DH_KEY_E:
+#if LIBWOLFSSL_VERSION_HEX < 0x05000000
+       case ASN_NTRU_KEY_E:
+#endif
+       case ASN_CRIT_EXT_E:
+       case ASN_ALT_NAME_E:
+       case ASN_NO_PEM_HEADER:
+       case ASN_ECC_KEY_E:
+       case ASN_NO_SIGNER_E:
+       case ASN_CRL_CONFIRM_E:
+       case ASN_CRL_NO_SIGNER_E:
+       case ASN_OCSP_CONFIRM_E:
+       case ASN_NAME_INVALID_E:
+       case ASN_NO_SKID:
+       case ASN_NO_AKID:
+       case ASN_NO_KEYUSAGE:
+       case ASN_COUNTRY_SIZE_E:
+       case ASN_PATHLEN_SIZE_E:
+       case ASN_PATHLEN_INV_E:
+       case ASN_SELF_SIGNED_E:
+               if (us->notify_verify_error)
+                       us->notify_verify_error(us, r, wc_GetErrorString(r));
+               return true;
+       }
+
+       return false;
+}
+#endif
 
 __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
 {
        void *ssl = us->ssl;
        int r;
 
+       ERR_clear_error();
+
        if (us->server)
                r = SSL_accept(ssl);
        else
@@ -280,6 +357,11 @@ __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
        if (r == SSL_ERROR_WANT_READ || r == SSL_ERROR_WANT_WRITE)
                return U_SSL_PENDING;
 
+#ifdef WOLFSSL_SSL_H
+       if (handle_wolfssl_asn_error(us, r))
+               return U_SSL_OK;
+#endif
+
        ustream_ssl_error(us, r);
        return U_SSL_ERROR;
 }
@@ -287,7 +369,11 @@ __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
 __hidden int __ustream_ssl_write(struct ustream_ssl *us, const char *buf, int len)
 {
        void *ssl = us->ssl;
-       int ret = SSL_write(ssl, buf, len);
+       int ret;
+
+       ERR_clear_error();
+
+       ret = SSL_write(ssl, buf, len);
 
        if (ret < 0) {
                int err = SSL_get_error(ssl, ret);
@@ -303,7 +389,11 @@ __hidden int __ustream_ssl_write(struct ustream_ssl *us, const char *buf, int le
 
 __hidden int __ustream_ssl_read(struct ustream_ssl *us, char *buf, int len)
 {
-       int ret = SSL_read(us->ssl, buf, len);
+       int ret;
+
+       ERR_clear_error();
+
+       ret = SSL_read(us->ssl, buf, len);
 
        if (ret < 0) {
                ret = SSL_get_error(us->ssl, ret);