aboutsummaryrefslogtreecommitdiff
path: root/openssl/src
diff options
context:
space:
mode:
Diffstat (limited to 'openssl/src')
-rw-r--r--openssl/src/aes.rs115
-rw-r--r--openssl/src/asn1.rs20
-rw-r--r--openssl/src/bn.rs14
-rw-r--r--openssl/src/crypto.rs61
-rw-r--r--openssl/src/ec.rs84
-rw-r--r--openssl/src/lib.rs9
-rw-r--r--openssl/src/ocsp.rs274
-rw-r--r--openssl/src/ssl/connector.rs56
-rw-r--r--openssl/src/ssl/mod.rs222
-rw-r--r--openssl/src/ssl/tests/mod.rs70
-rw-r--r--openssl/src/string.rs74
-rw-r--r--openssl/src/symm.rs60
-rw-r--r--openssl/src/x509/mod.rs20
-rw-r--r--openssl/src/x509/store.rs35
-rw-r--r--openssl/src/x509/tests.rs36
15 files changed, 1025 insertions, 125 deletions
diff --git a/openssl/src/aes.rs b/openssl/src/aes.rs
new file mode 100644
index 00000000..d226c515
--- /dev/null
+++ b/openssl/src/aes.rs
@@ -0,0 +1,115 @@
+//! Low level AES functionality
+//!
+//! The `symm` module should be used in preference to this module in most cases.
+use ffi;
+use std::mem;
+use libc::c_int;
+
+use symm::Mode;
+
+#[derive(Debug)]
+pub struct KeyError(());
+
+pub struct AesKey(ffi::AES_KEY);
+
+impl AesKey {
+ /// Prepares a key for encryption.
+ ///
+ /// # Failure
+ ///
+ /// Returns an error if the key is not 128, 192, or 256 bits.
+ pub fn new_encrypt(key: &[u8]) -> Result<AesKey, KeyError> {
+ unsafe {
+ assert!(key.len() <= c_int::max_value() as usize / 8);
+
+ let mut aes_key = mem::uninitialized();
+ let r = ffi::AES_set_encrypt_key(key.as_ptr() as *const _,
+ key.len() as c_int * 8,
+ &mut aes_key);
+ if r == 0 {
+ Ok(AesKey(aes_key))
+ } else {
+ Err(KeyError(()))
+ }
+ }
+ }
+
+ /// Prepares a key for decryption.
+ ///
+ /// # Failure
+ ///
+ /// Returns an error if the key is not 128, 192, or 256 bits.
+ pub fn new_decrypt(key: &[u8]) -> Result<AesKey, KeyError> {
+ unsafe {
+ assert!(key.len() <= c_int::max_value() as usize / 8);
+
+ let mut aes_key = mem::uninitialized();
+ let r = ffi::AES_set_decrypt_key(key.as_ptr() as *const _,
+ key.len() as c_int * 8,
+ &mut aes_key);
+
+ if r == 0 {
+ Ok(AesKey(aes_key))
+ } else {
+ Err(KeyError(()))
+ }
+ }
+ }
+}
+
+/// Performs AES IGE encryption or decryption
+///
+/// # Panics
+///
+/// Panics if `in_` is not the same length as `out`, if that length is not a multiple of 16, or if
+/// `iv` is not at least 32 bytes.
+pub fn aes_ige(in_: &[u8], out: &mut [u8], key: &AesKey, iv: &mut [u8], mode: Mode) {
+ unsafe {
+ assert!(in_.len() == out.len());
+ assert!(in_.len() % ffi::AES_BLOCK_SIZE as usize == 0);
+ assert!(iv.len() >= ffi::AES_BLOCK_SIZE as usize * 2);
+
+ let mode = match mode {
+ Mode::Encrypt => ffi::AES_ENCRYPT,
+ Mode::Decrypt => ffi::AES_DECRYPT,
+ };
+ ffi::AES_ige_encrypt(in_.as_ptr() as *const _,
+ out.as_mut_ptr() as *mut _,
+ in_.len(),
+ &key.0,
+ iv.as_mut_ptr() as *mut _,
+ mode);
+ }
+}
+
+#[cfg(test)]
+mod test {
+ use hex::FromHex;
+
+ use symm::Mode;
+ use super::*;
+
+ // From https://www.mgp25.com/AESIGE/
+ #[test]
+ fn ige_vector_1() {
+ let raw_key = "000102030405060708090A0B0C0D0E0F";
+ let raw_iv = "000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F";
+ let raw_pt = "0000000000000000000000000000000000000000000000000000000000000000";
+ let raw_ct = "1A8519A6557BE652E9DA8E43DA4EF4453CF456B4CA488AA383C79C98B34797CB";
+
+ let key = AesKey::new_encrypt(&Vec::from_hex(raw_key).unwrap()).unwrap();
+ let mut iv = Vec::from_hex(raw_iv).unwrap();
+ let pt = Vec::from_hex(raw_pt).unwrap();
+ let ct = Vec::from_hex(raw_ct).unwrap();
+
+ let mut ct_actual = vec![0; ct.len()];
+ aes_ige(&pt, &mut ct_actual, &key, &mut iv, Mode::Encrypt);
+ assert_eq!(ct_actual, ct);
+
+ let key = AesKey::new_decrypt(&Vec::from_hex(raw_key).unwrap()).unwrap();
+ let mut iv = Vec::from_hex(raw_iv).unwrap();
+ let mut pt_actual = vec![0; pt.len()];
+ aes_ige(&ct, &mut pt_actual, &key, &mut iv, Mode::Decrypt);
+ assert_eq!(pt_actual, pt);
+ }
+}
diff --git a/openssl/src/asn1.rs b/openssl/src/asn1.rs
index c0a23591..d177885e 100644
--- a/openssl/src/asn1.rs
+++ b/openssl/src/asn1.rs
@@ -1,5 +1,5 @@
use ffi;
-use libc::c_long;
+use libc::{c_long, c_char};
use std::fmt;
use std::ptr;
use std::slice;
@@ -7,9 +7,21 @@ use std::str;
use {cvt, cvt_p};
use bio::MemBio;
-use crypto::CryptoString;
use error::ErrorStack;
use types::{OpenSslType, OpenSslTypeRef};
+use string::OpensslString;
+
+type_!(Asn1GeneralizedTime, Asn1GeneralizedTimeRef, ffi::ASN1_GENERALIZEDTIME, ffi::ASN1_GENERALIZEDTIME_free);
+
+impl fmt::Display for Asn1GeneralizedTimeRef {
+ fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ unsafe {
+ let mem_bio = try!(MemBio::new());
+ try!(cvt(ffi::ASN1_GENERALIZEDTIME_print(mem_bio.as_ptr(), self.as_ptr())));
+ write!(f, "{}", str::from_utf8_unchecked(mem_bio.get_buf()))
+ }
+ }
+}
type_!(Asn1Time, Asn1TimeRef, ffi::ASN1_TIME, ffi::ASN1_TIME_free);
@@ -42,7 +54,7 @@ impl Asn1Time {
type_!(Asn1String, Asn1StringRef, ffi::ASN1_STRING, ffi::ASN1_STRING_free);
impl Asn1StringRef {
- pub fn as_utf8(&self) -> Result<CryptoString, ErrorStack> {
+ pub fn as_utf8(&self) -> Result<OpensslString, ErrorStack> {
unsafe {
let mut ptr = ptr::null_mut();
let len = ffi::ASN1_STRING_to_UTF8(&mut ptr, self.as_ptr());
@@ -50,7 +62,7 @@ impl Asn1StringRef {
return Err(ErrorStack::get());
}
- Ok(CryptoString::from_raw_parts(ptr, len as usize))
+ Ok(OpensslString::from_ptr(ptr as *mut c_char))
}
}
diff --git a/openssl/src/bn.rs b/openssl/src/bn.rs
index a8bb9619..01c0b428 100644
--- a/openssl/src/bn.rs
+++ b/openssl/src/bn.rs
@@ -6,8 +6,8 @@ use std::{fmt, ptr};
use std::ops::{Add, Div, Mul, Neg, Rem, Shl, Shr, Sub, Deref};
use {cvt, cvt_p, cvt_n};
-use crypto::CryptoString;
use error::ErrorStack;
+use string::OpensslString;
use types::{OpenSslType, OpenSslTypeRef};
#[cfg(ossl10x)]
@@ -484,12 +484,12 @@ impl BigNumRef {
/// # use openssl::bn::BigNum;
/// let s = -BigNum::from_u32(12345).unwrap();
///
- /// assert_eq!(&*s.to_dec_str().unwrap(), "-12345");
+ /// assert_eq!(&**s.to_dec_str().unwrap(), "-12345");
/// ```
- pub fn to_dec_str(&self) -> Result<CryptoString, ErrorStack> {
+ pub fn to_dec_str(&self) -> Result<OpensslString, ErrorStack> {
unsafe {
let buf = try!(cvt_p(ffi::BN_bn2dec(self.as_ptr())));
- Ok(CryptoString::from_null_terminated(buf))
+ Ok(OpensslString::from_ptr(buf))
}
}
@@ -499,12 +499,12 @@ impl BigNumRef {
/// # use openssl::bn::BigNum;
/// let s = -BigNum::from_u32(0x99ff).unwrap();
///
- /// assert_eq!(&*s.to_hex_str().unwrap(), "-99FF");
+ /// assert_eq!(&**s.to_hex_str().unwrap(), "-99FF");
/// ```
- pub fn to_hex_str(&self) -> Result<CryptoString, ErrorStack> {
+ pub fn to_hex_str(&self) -> Result<OpensslString, ErrorStack> {
unsafe {
let buf = try!(cvt_p(ffi::BN_bn2hex(self.as_ptr())));
- Ok(CryptoString::from_null_terminated(buf))
+ Ok(OpensslString::from_ptr(buf))
}
}
}
diff --git a/openssl/src/crypto.rs b/openssl/src/crypto.rs
index ce83cbae..9853d99c 100644
--- a/openssl/src/crypto.rs
+++ b/openssl/src/crypto.rs
@@ -1,59 +1,4 @@
-use libc::{c_char, c_int, c_void};
-use std::fmt;
-use std::ffi::CStr;
-use std::slice;
-use std::ops::Deref;
-use std::str;
+use string::OpensslString;
-pub struct CryptoString(&'static str);
-
-impl Drop for CryptoString {
- fn drop(&mut self) {
- unsafe {
- CRYPTO_free(self.0.as_ptr() as *mut c_void,
- concat!(file!(), "\0").as_ptr() as *const c_char,
- line!() as c_int);
- }
- }
-}
-
-impl Deref for CryptoString {
- type Target = str;
-
- fn deref(&self) -> &str {
- self.0
- }
-}
-
-impl CryptoString {
- pub unsafe fn from_raw_parts(buf: *mut u8, len: usize) -> CryptoString {
- let slice = slice::from_raw_parts(buf, len);
- CryptoString(str::from_utf8_unchecked(slice))
- }
-
- pub unsafe fn from_null_terminated(buf: *mut c_char) -> CryptoString {
- let slice = CStr::from_ptr(buf).to_bytes();
- CryptoString(str::from_utf8_unchecked(slice))
- }
-}
-
-impl fmt::Display for CryptoString {
- fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
- fmt::Display::fmt(self.0, f)
- }
-}
-
-impl fmt::Debug for CryptoString {
- fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
- fmt::Debug::fmt(self.0, f)
- }
-}
-
-#[cfg(not(ossl110))]
-#[allow(non_snake_case)]
-unsafe fn CRYPTO_free(buf: *mut c_void, _: *const c_char, _: c_int) {
- ::ffi::CRYPTO_free(buf);
-}
-
-#[cfg(ossl110)]
-use ffi::CRYPTO_free;
+#[deprecated(note = "renamed to OpensslString", since = "0.9.7")]
+pub type CryptoString = OpensslString;
diff --git a/openssl/src/ec.rs b/openssl/src/ec.rs
index 592c4026..ebb631e8 100644
--- a/openssl/src/ec.rs
+++ b/openssl/src/ec.rs
@@ -1,11 +1,13 @@
use ffi;
use std::ptr;
+use std::mem;
+use libc::c_int;
use {cvt, cvt_n, cvt_p, init};
use bn::{BigNumRef, BigNumContextRef};
use error::ErrorStack;
use nid::Nid;
-use types::OpenSslTypeRef;
+use types::{OpenSslType, OpenSslTypeRef};
pub const POINT_CONVERSION_COMPRESSED: PointConversionForm =
PointConversionForm(ffi::point_conversion_form_t::POINT_CONVERSION_COMPRESSED);
@@ -16,9 +18,17 @@ pub const POINT_CONVERSION_UNCOMPRESSED: PointConversionForm =
pub const POINT_CONVERSION_HYBRID: PointConversionForm =
PointConversionForm(ffi::point_conversion_form_t::POINT_CONVERSION_HYBRID);
+// OPENSSL_EC_EXPLICIT_CURVE, but that was only added in 1.1.
+// Man page documents that 0 can be used in older versions.
+pub const EXPLICIT_CURVE: Asn1Flag = Asn1Flag(0);
+pub const NAMED_CURVE: Asn1Flag = Asn1Flag(ffi::OPENSSL_EC_NAMED_CURVE);
+
#[derive(Copy, Clone)]
pub struct PointConversionForm(ffi::point_conversion_form_t);
+#[derive(Copy, Clone)]
+pub struct Asn1Flag(c_int);
+
type_!(EcGroup, EcGroupRef, ffi::EC_GROUP, ffi::EC_GROUP_free);
impl EcGroup {
@@ -80,6 +90,17 @@ impl EcGroupRef {
cvt(ffi::EC_GROUP_get_order(self.as_ptr(), order.as_ptr(), ctx.as_ptr())).map(|_| ())
}
}
+
+ /// Sets the flag determining if the group corresponds to a named curve or must be explicitly
+ /// parameterized.
+ ///
+ /// This defaults to `EXPLICIT_CURVE` in OpenSSL 1.0.1 and 1.0.2, but `NAMED_CURVE` in OpenSSL
+ /// 1.1.0.
+ pub fn set_asn1_flag(&mut self, flag: Asn1Flag) {
+ unsafe {
+ ffi::EC_GROUP_set_asn1_flag(self.as_ptr(), flag.0);
+ }
+ }
}
type_!(EcPoint, EcPointRef, ffi::EC_POINT, ffi::EC_POINT_free);
@@ -311,22 +332,18 @@ impl EcKey {
/// let key = EcKey::from_public_key(&group, &point);
/// ```
pub fn from_public_key(group: &EcGroupRef, public_key: &EcPointRef) -> Result<EcKey, ErrorStack> {
- unsafe {
- let key = EcKey(try!(cvt_p(ffi::EC_KEY_new())));
- try!(cvt(ffi::EC_KEY_set_group(key.as_ptr(), group.as_ptr())));
- try!(cvt(ffi::EC_KEY_set_public_key(key.as_ptr(), public_key.as_ptr())));
- Ok(key)
- }
+ let mut builder = try!(EcKeyBuilder::new());
+ try!(builder.set_group(group));
+ try!(builder.set_public_key(public_key));
+ Ok(builder.build())
}
/// Generates a new public/private key pair on the specified curve.
pub fn generate(group: &EcGroupRef) -> Result<EcKey, ErrorStack> {
- unsafe {
- let key = EcKey(try!(cvt_p(ffi::EC_KEY_new())));
- try!(cvt(ffi::EC_KEY_set_group(key.as_ptr(), group.as_ptr())));
- try!(cvt(ffi::EC_KEY_generate_key(key.as_ptr())));
- Ok(key)
- }
+ let mut builder = try!(EcKeyBuilder::new());
+ try!(builder.set_group(group));
+ try!(builder.generate_key());
+ Ok(builder.build())
}
#[deprecated(since = "0.9.2", note = "use from_curve_name")]
@@ -338,6 +355,47 @@ impl EcKey {
private_key_from_der!(EcKey, ffi::d2i_ECPrivateKey);
}
+type_!(EcKeyBuilder, EcKeyBuilderRef, ffi::EC_KEY, ffi::EC_KEY_free);
+
+impl EcKeyBuilder {
+ pub fn new() -> Result<EcKeyBuilder, ErrorStack> {
+ unsafe {
+ init();
+ cvt_p(ffi::EC_KEY_new()).map(EcKeyBuilder)
+ }
+ }
+
+ pub fn build(self) -> EcKey {
+ unsafe {
+ let key = EcKey::from_ptr(self.as_ptr());
+ mem::forget(self);
+ key
+ }
+ }
+}
+
+impl EcKeyBuilderRef {
+ pub fn set_group(&mut self, group: &EcGroupRef) -> Result<&mut EcKeyBuilderRef, ErrorStack> {
+ unsafe {
+ cvt(ffi::EC_KEY_set_group(self.as_ptr(), group.as_ptr())).map(|_| self)
+ }
+ }
+
+ pub fn set_public_key(&mut self,
+ public_key: &EcPointRef)
+ -> Result<&mut EcKeyBuilderRef, ErrorStack> {
+ unsafe {
+ cvt(ffi::EC_KEY_set_public_key(self.as_ptr(), public_key.as_ptr())).map(|_| self)
+ }
+ }
+
+ pub fn generate_key(&mut self) -> Result<&mut EcKeyBuilderRef, ErrorStack> {
+ unsafe {
+ cvt(ffi::EC_KEY_generate_key(self.as_ptr())).map(|_| self)
+ }
+ }
+}
+
#[cfg(test)]
mod test {
use bn::BigNumContext;
diff --git a/openssl/src/lib.rs b/openssl/src/lib.rs
index 8b773ff6..ea71a269 100644
--- a/openssl/src/lib.rs
+++ b/openssl/src/lib.rs
@@ -1,4 +1,4 @@
-#![doc(html_root_url="https://docs.rs/openssl/0.9.5")]
+#![doc(html_root_url="https://docs.rs/openssl/0.9.6")]
#[macro_use]
extern crate bitflags;
@@ -24,6 +24,7 @@ mod macros;
mod bio;
mod util;
+pub mod aes;
pub mod asn1;
pub mod bn;
pub mod crypto;
@@ -35,18 +36,20 @@ pub mod error;
pub mod hash;
pub mod memcmp;
pub mod nid;
+pub mod ocsp;
pub mod pkcs12;
pub mod pkcs5;
pub mod pkey;
pub mod rand;
-pub mod types;
pub mod rsa;
pub mod sign;
pub mod ssl;
+pub mod stack;
+pub mod string;
pub mod symm;
+pub mod types;
pub mod version;
pub mod x509;
-pub mod stack;
#[cfg(any(ossl102, ossl110))]
mod verify;
diff --git a/openssl/src/ocsp.rs b/openssl/src/ocsp.rs
new file mode 100644
index 00000000..708c3561
--- /dev/null
+++ b/openssl/src/ocsp.rs
@@ -0,0 +1,274 @@
+use ffi;
+use libc::{c_int, c_long, c_ulong};
+use std::ptr;
+use std::mem;
+
+use {cvt, cvt_p};
+use asn1::Asn1GeneralizedTimeRef;
+use error::ErrorStack;
+use hash::MessageDigest;
+use stack::StackRef;
+use types::OpenSslTypeRef;
+use x509::store::X509StoreRef;
+use x509::{X509, X509Ref};
+
+bitflags! {
+ pub flags Flag: c_ulong {
+ const FLAG_NO_CERTS = ffi::OCSP_NOCERTS,
+ const FLAG_NO_INTERN = ffi::OCSP_NOINTERN,
+ const FLAG_NO_CHAIN = ffi::OCSP_NOCHAIN,
+ const FLAG_NO_VERIFY = ffi::OCSP_NOVERIFY,
+ const FLAG_NO_EXPLICIT = ffi::OCSP_NOEXPLICIT,
+ const FLAG_NO_CA_SIGN = ffi::OCSP_NOCASIGN,
+ const FLAG_NO_DELEGATED = ffi::OCSP_NODELEGATED,
+ const FLAG_NO_CHECKS = ffi::OCSP_NOCHECKS,
+ const FLAG_TRUST_OTHER = ffi::OCSP_TRUSTOTHER,
+ const FLAG_RESPID_KEY = ffi::OCSP_RESPID_KEY,
+ const FLAG_NO_TIME = ffi::OCSP_NOTIME,
+ }
+}
+
+pub const RESPONSE_STATUS_SUCCESSFUL: OcspResponseStatus =
+ OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_SUCCESSFUL);
+pub const RESPONSE_STATUS_MALFORMED_REQUEST: OcspResponseStatus =
+ OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_MALFORMEDREQUEST);
+pub const RESPONSE_STATUS_INTERNAL_ERROR: OcspResponseStatus =
+ OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_INTERNALERROR);
+pub const RESPONSE_STATUS_TRY_LATER: OcspResponseStatus =
+ OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_TRYLATER);
+pub const RESPONSE_STATUS_SIG_REQUIRED: OcspResponseStatus =
+ OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_SIGREQUIRED);
+pub const RESPONSE_STATUS_UNAUTHORIZED: OcspResponseStatus =
+ OcspResponseStatus(ffi::OCSP_RESPONSE_STATUS_UNAUTHORIZED);
+
+pub const CERT_STATUS_GOOD: OcspCertStatus = OcspCertStatus(ffi::V_OCSP_CERTSTATUS_GOOD);
+pub const CERT_STATUS_REVOKED: OcspCertStatus = OcspCertStatus(ffi::V_OCSP_CERTSTATUS_REVOKED);
+pub const CERT_STATUS_UNKNOWN: OcspCertStatus = OcspCertStatus(ffi::V_OCSP_CERTSTATUS_UNKNOWN);
+
+pub const REVOKED_STATUS_NO_STATUS: OcspRevokedStatus =
+ OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_NOSTATUS);
+pub const REVOKED_STATUS_UNSPECIFIED: OcspRevokedStatus =
+ OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_UNSPECIFIED);
+pub const REVOKED_STATUS_KEY_COMPROMISE: OcspRevokedStatus =
+ OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_KEYCOMPROMISE);
+pub const REVOKED_STATUS_CA_COMPROMISE: OcspRevokedStatus =
+ OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_CACOMPROMISE);
+pub const REVOKED_STATUS_AFFILIATION_CHANGED: OcspRevokedStatus =
+ OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_AFFILIATIONCHANGED);
+pub const REVOKED_STATUS_SUPERSEDED: OcspRevokedStatus =
+ OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_SUPERSEDED);
+pub const REVOKED_STATUS_CESSATION_OF_OPERATION: OcspRevokedStatus =
+ OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_CESSATIONOFOPERATION);
+pub const REVOKED_STATUS_CERTIFICATE_HOLD: OcspRevokedStatus =
+ OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_CERTIFICATEHOLD);
+pub const REVOKED_STATUS_REMOVE_FROM_CRL: OcspRevokedStatus =
+ OcspRevokedStatus(ffi::OCSP_REVOKED_STATUS_REMOVEFROMCRL);
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub struct OcspResponseStatus(c_int);
+
+impl OcspResponseStatus {
+ pub fn from_raw(raw: c_int) -> OcspResponseStatus {
+ OcspResponseStatus(raw)
+ }
+
+ pub fn as_raw(&self) -> c_int {
+ self.0
+ }
+}
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub struct OcspCertStatus(c_int);
+
+impl OcspCertStatus {
+ pub fn from_raw(raw: c_int) -> OcspCertStatus {
+ OcspCertStatus(raw)
+ }
+
+ pub fn as_raw(&self) -> c_int {
+ self.0
+ }
+}
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub struct OcspRevokedStatus(c_int);
+
+impl OcspRevokedStatus {
+ pub fn from_raw(raw: c_int) -> OcspRevokedStatus {
+ OcspRevokedStatus(raw)
+ }
+
+ pub fn as_raw(&self) -> c_int {
+ self.0
+ }
+}
+
+pub struct Status<'a> {
+ /// The overall status of the response.
+ pub status: OcspCertStatus,
+ /// If `status` is `CERT_STATUS_REVOKED`, the reason for the revocation.
+ pub reason: OcspRevokedStatus,
+ /// If `status` is `CERT_STATUS_REVOKED`, the time at which the certificate was revoked.
+ pub revocation_time: Option<&'a Asn1GeneralizedTimeRef>,
+ /// The time that this revocation check was performed.
+ pub this_update: &'a Asn1GeneralizedTimeRef,
+ /// The time at which this revocation check expires.
+ pub next_update: &'a Asn1GeneralizedTimeRef,
+}
+
+impl<'a> Status<'a> {
+ /// Checks validity of the `this_update` and `next_update` fields.
+ ///
+ /// The `nsec` parameter specifies an amount of slack time that will be used when comparing
+ /// those times with the current time to account for delays and clock skew.
+ ///
+ /// The `maxsec` parameter limits the maximum age of the `this_update` parameter to prohibit
+ /// very old responses.
+ pub fn check_validity(&self, nsec: u32, maxsec: Option<u32>) -> Result<(), ErrorStack> {
+ unsafe {
+ cvt(ffi::OCSP_check_validity(self.this_update.as_ptr(),
+ self.next_update.as_ptr(),
+ nsec as c_long,
+ maxsec.map(|n| n as c_long).unwrap_or(-1)))
+ .map(|_| ())
+ }
+ }
+}
+
+type_!(OcspBasicResponse, OcspBasicResponseRef, ffi::OCSP_BASICRESP, ffi::OCSP_BASICRESP_free);
+
+impl OcspBasicResponseRef {
+ /// Verifies the validity of the response.
+ ///
+ /// The `certs` parameter contains a set of certificates that will be searched when locating the
+ /// OCSP response signing certificate. Some responders do not include this in the response.
+ pub fn verify(&self,
+ certs: &StackRef<X509>,
+ store: &X509StoreRef,
+ flags: Flag)
+ -> Result<(), ErrorStack> {
+ unsafe {
+ cvt(ffi::OCSP_basic_verify(self.as_ptr(), certs.as_ptr(), store.as_ptr(), flags.bits()))
+ .map(|_| ())
+ }
+ }
+
+ /// Looks up the status for the specified certificate ID.
+ pub fn find_status<'a>(&'a self, id: &OcspCertIdRef) -> Option<Status<'a>> {
+ unsafe {
+ let mut status = ffi::V_OCSP_CERTSTATUS_UNKNOWN;
+ let mut reason = ffi::OCSP_REVOKED_STATUS_NOSTATUS;
+ let mut revocation_time = ptr::null_mut();
+ let mut this_update = ptr::null_mut();
+ let mut next_update = ptr::null_mut();
+
+ let r = ffi::OCSP_resp_find_status(self.as_ptr(),
+ id.as_ptr(),
+ &mut status,
+ &mut reason,
+ &mut revocation_time,
+ &mut this_update,
+ &mut next_update);
+ if r == 1 {
+ let revocation_time = if revocation_time.is_null() {
+ None
+ } else {
+ Some(Asn1GeneralizedTimeRef::from_ptr(revocation_time))
+ };
+ Some(Status {
+ status: OcspCertStatus(status),
+ reason: OcspRevokedStatus(status),
+ revocation_time: revocation_time,
+ this_update: Asn1GeneralizedTimeRef::from_ptr(this_update),
+ next_update: Asn1GeneralizedTimeRef::from_ptr(next_update),
+ })
+ } else {
+ None
+ }
+ }
+ }
+}
+
+type_!(OcspCertId, OcspCertIdRef, ffi::OCSP_CERTID, ffi::OCSP_CERTID_free);
+
+impl OcspCertId {
+ /// Constructs a certificate ID for certificate `subject`.
+ pub fn from_cert(digest: MessageDigest,
+ subject: &X509Ref,
+ issuer: &X509Ref)
+ -> Result<OcspCertId, ErrorStack> {
+ unsafe {
+ cvt_p(ffi::OCSP_cert_to_id(digest.as_ptr(), subject.as_ptr(), issuer.as_ptr()))
+ .map(OcspCertId)
+ }
+ }
+}
+
+type_!(OcspResponse, OcspResponseRef, ffi::OCSP_RESPONSE, ffi::OCSP_RESPONSE_free);
+
+impl OcspResponse {
+ /// Creates an OCSP response from the status and optional body.
+ ///
+ /// A body should only be provided if `status` is `RESPONSE_STATUS_SUCCESSFUL`.
+ pub fn create(status: OcspResponseStatus,
+ body: Option<&OcspBasicResponseRef>)
+ -> Result<OcspResponse, ErrorStack> {
+ unsafe {
+ ffi::init();
+
+ cvt_p(ffi::OCSP_response_create(status.as_raw(),
+ body.map(|r| r.as_ptr()).unwrap_or(ptr::null_mut())))
+ .map(OcspResponse)
+ }
+ }
+
+ from_der!(OcspResponse, ffi::d2i_OCSP_RESPONSE);
+}
+
+impl OcspResponseRef {
+ to_der!(ffi::i2d_OCSP_RESPONSE);
+
+ /// Returns the status of the response.
+ pub fn status(&self) -> OcspResponseStatus {
+ unsafe {
+ OcspResponseStatus(ffi::OCSP_response_status(self.as_ptr()))
+ }
+ }
+
+ /// Returns the basic response.
+ ///
+ /// This will only succeed if `status()` returns `RESPONSE_STATUS_SUCCESSFUL`.
+ pub fn basic(&self) -> Result<OcspBasicResponse, ErrorStack> {
+ unsafe {
+ cvt_p(ffi::OCSP_response_get1_basic(self.as_ptr())).map(OcspBasicResponse)
+ }
+ }
+}
+
+type_!(OcspRequest, OcspRequestRef, ffi::OCSP_REQUEST, ffi::OCSP_REQUEST_free);
+
+impl OcspRequest {
+ pub fn new() -> Result<OcspRequest, ErrorStack> {
+ unsafe {
+ ffi::init();
+
+ cvt_p(ffi::OCSP_REQUEST_new()).map(OcspRequest)
+ }
+ }
+
+ from_der!(OcspRequest, ffi::d2i_OCSP_REQUEST);
+}
+
+impl OcspRequestRef {
+ to_der!(ffi::i2d_OCSP_REQUEST);
+
+ pub fn add_id(&mut self, id: OcspCertId) -> Result<&mut OcspOneReqRef, ErrorStack> {
+ unsafe {
+ let ptr = try!(cvt_p(ffi::OCSP_request_add0_id(self.as_ptr(), id.as_ptr())));
+ mem::forget(id);
+ Ok(OcspOneReqRef::from_ptr_mut(ptr))
+ }
+ }
+}
+
+type_!(OcspOneReq, OcspOneReqRef, ffi::OCSP_ONEREQ, ffi::OCSP_ONEREQ_free);
diff --git a/openssl/src/ssl/connector.rs b/openssl/src/ssl/connector.rs
index 43dad17d..73d7b675 100644
--- a/openssl/src/ssl/connector.rs
+++ b/openssl/src/ssl/connector.rs
@@ -136,6 +136,30 @@ impl SslAcceptorBuilder {
where I: IntoIterator,
I::Item: AsRef<X509Ref>
{
+ let builder = try!(SslAcceptorBuilder::mozilla_intermediate_raw(method));
+ builder.finish_setup(private_key, certificate, chain)
+ }
+
+ /// Creates a new builder configured to connect to modern clients.
+ ///
+ /// This corresponds to the modern configuration of Mozilla's server side TLS recommendations.
+ /// See its [documentation][docs] for more details on specifics.
+ ///
+ /// [docs]: https://wiki.mozilla.org/Security/Server_Side_TLS
+ pub fn mozilla_modern<I>(method: SslMethod,
+ private_key: &PKeyRef,
+ certificate: &X509Ref,
+ chain: I)
+ -> Result<SslAcceptorBuilder, ErrorStack>
+ where I: IntoIterator,
+ I::Item: AsRef<X509Ref>
+ {
+ let builder = try!(SslAcceptorBuilder::mozilla_modern_raw(method));
+ builder.finish_setup(private_key, certificate, chain)
+ }
+
+ /// Like `mozilla_intermediate`, but does not load the certificate chain and private key.
+ pub fn mozilla_intermediate_raw(method: SslMethod) -> Result<SslAcceptorBuilder, ErrorStack> {
let mut ctx = try!(ctx(method));
let dh = try!(Dh::from_pem(DHPARAM_PEM.as_bytes()));
try!(ctx.set_tmp_dh(&dh));
@@ -154,23 +178,11 @@ impl SslAcceptorBuilder {
EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:\
AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:\
DES-CBC3-SHA:!DSS"));
- SslAcceptorBuilder::finish_setup(ctx, private_key, certificate, chain)
+ Ok(SslAcceptorBuilder(ctx))
}
- /// Creates a new builder configured to connect to modern clients.
- ///
- /// This corresponds to the modern configuration of Mozilla's server side TLS recommendations.
- /// See its [documentation][docs] for more details on specifics.
- ///
- /// [docs]: https://wiki.mozilla.org/Security/Server_Side_TLS
- pub fn mozilla_modern<I>(method: SslMethod,
- private_key: &PKeyRef,
- certificate: &X509Ref,
- chain: I)
- -> Result<SslAcceptorBuilder, ErrorStack>
- where I: IntoIterator,
- I::Item: AsRef<X509Ref>
- {
+ /// Like `mozilla_modern`, but does not load the certificate chain and private key.
+ pub fn mozilla_modern_raw(method: SslMethod) -> Result<SslAcceptorBuilder, ErrorStack> {
let mut ctx = try!(ctx(method));
try!(setup_curves(&mut ctx));
try!(ctx.set_cipher_list("ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:\
@@ -178,10 +190,10 @@ impl SslAcceptorBuilder {
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\
ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:\
ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"));
- SslAcceptorBuilder::finish_setup(ctx, private_key, certificate, chain)
+ Ok(SslAcceptorBuilder(ctx))
}
- fn finish_setup<I>(mut ctx: SslContextBuilder,
+ fn finish_setup<I>(mut self,
private_key: &PKeyRef,
certificate: &X509Ref,
chain: I)
@@ -189,13 +201,13 @@ impl SslAcceptorBuilder {
where I: IntoIterator,
I::Item: AsRef<X509Ref>
{
- try!(ctx.set_private_key(private_key));
- try!(ctx.set_certificate(certificate));
- try!(ctx.check_private_key());
+ try!(self.0.set_private_key(private_key));
+ try!(self.0.set_certificate(certificate));
+ try!(self.0.check_private_key());
for cert in chain {
- try!(ctx.add_extra_chain_cert(cert.as_ref().to_owned()));
+ try!(self.0.add_extra_chain_cert(cert.as_ref().to_owned()));
}
- Ok(SslAcceptorBuilder(ctx))
+ Ok(self)
}
/// Returns a shared reference to the inner `SslContextBuilder`.
diff --git a/openssl/src/ssl/mod.rs b/openssl/src/ssl/mod.rs
index 722225e7..dd7f72cc 100644
--- a/openssl/src/ssl/mod.rs
+++ b/openssl/src/ssl/mod.rs
@@ -97,14 +97,14 @@ use ec::EcKeyRef;
#[cfg(any(all(feature = "v101", ossl101), all(feature = "v102", ossl102)))]
use ec::EcKey;
use x509::{X509StoreContextRef, X509FileType, X509, X509Ref, X509VerifyError, X509Name};
-use x509::store::X509StoreBuilderRef;
+use x509::store::{X509StoreBuilderRef, X509StoreRef};
#[cfg(any(ossl102, ossl110))]
use verify::X509VerifyParamRef;
use pkey::PKeyRef;
use error::ErrorStack;
use types::{OpenSslType, OpenSslTypeRef};
use util::Opaque;
-use stack::Stack;
+use stack::{Stack, StackRef};
mod error;
mod connector;
@@ -217,6 +217,22 @@ bitflags! {
}
}
+#[derive(Copy, Clone)]
+pub struct StatusType(c_int);
+
+impl StatusType {
+ pub fn from_raw(raw: c_int) -> StatusType {
+ StatusType(raw)
+ }
+
+ pub fn as_raw(&self) -> c_int {
+ self.0
+ }
+}
+
+/// An OSCP status.
+pub const STATUS_TYPE_OCSP: StatusType = StatusType(ffi::TLSEXT_STATUSTYPE_ocsp);
+
lazy_static! {
static ref INDEXES: Mutex<HashMap<TypeId, c_int>> = Mutex::new(HashMap::new());
static ref SSL_INDEXES: Mutex<HashMap<TypeId, c_int>> = Mutex::new(HashMap::new());
@@ -475,6 +491,37 @@ unsafe extern fn raw_tmp_ecdh_ssl<F>(ssl: *mut ffi::SSL,
}
}
+unsafe extern fn raw_tlsext_status<F>(ssl: *mut ffi::SSL, _: *mut c_void) -> c_int
+ where F: Fn(&mut SslRef) -> Result<bool, ErrorStack> + Any + 'static + Sync + Send
+{
+ let ssl_ctx = ffi::SSL_get_SSL_CTX(ssl as *const _);
+ let callback = ffi::SSL_CTX_get_ex_data(ssl_ctx, get_callback_idx::<F>());
+ let callback = &*(callback as *mut F);
+
+ let ssl = SslRef::from_ptr_mut(ssl);
+ let ret = callback(ssl);
+
+ if ssl.is_server() {
+ match ret {
+ Ok(true) => ffi::SSL_TLSEXT_ERR_OK,
+ Ok(false) => ffi::SSL_TLSEXT_ERR_NOACK,
+ Err(_) => {
+ // FIXME reset error stack
+ ffi::SSL_TLSEXT_ERR_ALERT_FATAL
+ }
+ }
+ } else {
+ match ret {
+ Ok(true) => 1,
+ Ok(false) => 0,
+ Err(_) => {
+ // FIXME reset error stack
+ -1
+ }
+ }
+ }
+}
+
/// The function is given as the callback to `SSL_CTX_set_next_protos_advertised_cb`.
///
/// It causes the parameter `out` to point at a `*const c_uchar` instance that
@@ -702,7 +749,7 @@ impl SslContextBuilder {
}
}
- /// Specifies the file that contains certificate
+ /// Loads a certificate from a file.
pub fn set_certificate_file<P: AsRef<Path>>(&mut self,
file: P,
file_type: X509FileType)
@@ -716,7 +763,11 @@ impl SslContextBuilder {
}
}
- /// Specifies the file that contains certificate chain
+ /// Loads a certificate chain from a file.
+ ///
+ /// The file should contain a sequence of PEM-formatted certificates, the first being the leaf
+ /// certificate, and the remainder forming the chain of certificates up to and including the
+ /// trusted root certificate.
pub fn set_certificate_chain_file<P: AsRef<Path>>(&mut self,
file: P)
-> Result<(), ErrorStack> {
@@ -727,13 +778,15 @@ impl SslContextBuilder {
}
}
- /// Specifies the certificate
+ /// Sets the certificate.
pub fn set_certificate(&mut self, cert: &X509Ref) -> Result<(), ErrorStack> {
unsafe { cvt(ffi::SSL_CTX_use_certificate(self.as_ptr(), cert.as_ptr())).map(|_| ()) }
}
- /// Adds a certificate to the certificate chain presented together with the
- /// certificate specified using set_certificate()
+ /// Appends a certificate to the certificate chain.
+ ///
+ /// This chain should contain all certificates necessary to go from the certificate specified by
+ /// `set_certificate` to a trusted root.
pub fn add_extra_chain_cert(&mut self, cert: X509) -> Result<(), ErrorStack> {
unsafe {
try!(cvt(ffi::SSL_CTX_add_extra_chain_cert(self.as_ptr(), cert.as_ptr()) as c_int));
@@ -742,7 +795,7 @@ impl SslContextBuilder {
}
}
- /// Specifies the file that contains private key
+ /// Loads the private key from a file.
pub fn set_private_key_file<P: AsRef<Path>>(&mut self,
file: P,
file_type: X509FileType)
@@ -756,11 +809,14 @@ impl SslContextBuilder {
}
}
- /// Specifies the private key
+ /// Sets the private key.
pub fn set_private_key(&mut self, key: &PKeyRef) -> Result<(), ErrorStack> {
unsafe { cvt(ffi::SSL_CTX_use_PrivateKey(self.as_ptr(), key.as_ptr())).map(|_| ()) }
}
+ /// Sets the cipher configuration.
+ ///
+ /// See `man 1 ciphers` for details on the format.
pub fn set_cipher_list(&mut self, cipher_list: &str) -> Result<(), ErrorStack> {
let cipher_list = CString::new(cipher_list).unwrap();
unsafe {
@@ -769,9 +825,7 @@ impl SslContextBuilder {
}
}
- /// If `onoff` is set to `true`, enable ECDHE for key exchange with
- /// compatible clients, and automatically select an appropriate elliptic
- /// curve.
+ /// Enables ECDHE key exchange with an automatically chosen curve list.
///
/// Requires the `v102` feature and OpenSSL 1.0.2.
#[cfg(all(feature = "v102", any(ossl102, libressl)))]
@@ -880,6 +934,31 @@ impl SslContextBuilder {
unsafe { X509StoreBuilderRef::from_ptr_mut(ffi::SSL_CTX_get_cert_store(self.as_ptr())) }
}
+ /// Sets the callback dealing with OCSP stapling.
+ ///
+ /// On the client side, this callback is responsible for validating the OCSP status response
+ /// returned by the server. The status may be retrieved with the `SslRef::ocsp_status` method.
+ /// A response of `Ok(true)` indicates that the OCSP status is valid, and a response of
+ /// `Ok(false)` indicates that the OCSP status is invalid and the handshake should be
+ /// terminated.
+ ///
+ /// On the server side, this callback is resopnsible for setting the OCSP status response to be
+ /// returned to clients. The status may be set with the `SslRef::set_ocsp_status` method. A
+ /// response of `Ok(true)` indicates that the OCSP status should be returned to the client, and
+ /// `Ok(false)` indicates that the status should not be returned to the client.
+ pub fn set_status_callback<F>(&mut self, callback: F) -> Result<(), ErrorStack>
+ where F: Fn(&mut SslRef) -> Result<bool, ErrorStack> + Any + 'static + Sync + Send
+ {
+ unsafe {
+ let callback = Box::new(callback);
+ ffi::SSL_CTX_set_ex_data(self.as_ptr(),
+ get_callback_idx::<F>(),
+ Box::into_raw(callback) as *mut c_void);
+ let f: unsafe extern fn (_, _) -> _ = raw_tlsext_status::<F>;
+ cvt(ffi::SSL_CTX_set_tlsext_status_cb(self.as_ptr(), Some(f)) as c_int).map(|_| ())
+ }
+ }
+
pub fn build(self) -> SslContext {
let ctx = SslContext(self.0);
mem::forget(self);
@@ -944,6 +1023,22 @@ impl SslContextRef {
}
}
}
+
+ /// Returns the certificate store used for verification.
+ pub fn cert_store(&self) -> &X509StoreRef {
+ unsafe {
+ X509StoreRef::from_ptr(ffi::SSL_CTX_get_cert_store(self.as_ptr()))
+ }
+ }
+
+ pub fn extra_chain_certs(&self) -> &StackRef<X509> {
+ unsafe {
+ let mut chain = ptr::null_mut();
+ ffi::SSL_CTX_get_extra_chain_certs(self.as_ptr(), &mut chain);
+ assert!(!chain.is_null());
+ StackRef::from_ptr(chain)
+ }
+ }
}
pub struct CipherBits {
@@ -1029,6 +1124,31 @@ impl SslCipherRef {
}
}
+type_!(SslSession, SslSessionRef, ffi::SSL_SESSION, ffi::SSL_SESSION_free);
+
+impl SslSessionRef {
+ /// Returns the SSL session ID.
+ pub fn id(&self) -> &[u8] {
+ unsafe {
+ let mut len = 0;
+ let p = ffi::SSL_SESSION_get_id(self.as_ptr(), &mut len);
+ slice::from_raw_parts(p as *const u8, len as usize)
+ }
+ }
+
+ /// Returns the length of the master key.
+ pub fn master_key_len(&self) -> usize {
+ unsafe { compat::SSL_SESSION_get_master_key(self.as_ptr(), ptr::null_mut(), 0) }
+ }
+
+ /// Copies the master key into the provided buffer.
+ ///
+ /// Returns the number of bytes written.
+ pub fn master_key(&self, buf: &mut [u8]) -> usize {
+ unsafe { compat::SSL_SESSION_get_master_key(self.as_ptr(), buf.as_mut_ptr(), buf.len()) }
+ }
+}
+
type_!(Ssl, SslRef, ffi::SSL, ffi::SSL_free);
impl fmt::Debug for SslRef {
@@ -1334,6 +1454,61 @@ impl SslRef {
pub fn verify_result(&self) -> Option<X509VerifyError> {
unsafe { X509VerifyError::from_raw(ffi::SSL_get_verify_result(self.as_ptr())) }
}
+
+ /// Returns the SSL session.
+ pub fn session(&self) -> Option<&SslSessionRef> {
+ unsafe {
+ let p = ffi::SSL_get_session(self.as_ptr());
+ if p.is_null() {
+ None
+ } else {
+ Some(SslSessionRef::from_ptr(p))
+ }
+ }
+ }
+
+ /// Sets the status response a client wishes the server to reply with.
+ pub fn set_status_type(&mut self, type_: StatusType) -> Result<(), ErrorStack> {
+ unsafe {
+ cvt(ffi::SSL_set_tlsext_status_type(self.as_ptr(), type_.as_raw()) as c_int).map(|_| ())
+ }
+ }
+
+ /// Returns the server's OCSP response, if present.
+ pub fn ocsp_status(&self) -> Option<&[u8]> {
+ unsafe {
+ let mut p = ptr::null_mut();
+ let len = ffi::SSL_get_tlsext_status_ocsp_resp(self.as_ptr(), &mut p);
+
+ if len < 0 {
+ None
+ } else {
+ Some(slice::from_raw_parts(p as *const u8, len as usize))
+ }
+ }
+ }
+
+ /// Sets the OCSP response to be returned to the client.
+ pub fn set_ocsp_status(&mut self, response: &[u8]) -> Result<(), ErrorStack> {
+ unsafe {
+ assert!(response.len() <= c_int::max_value() as usize);
+ let p = try!(cvt_p(ffi::CRYPTO_malloc(response.len() as _,
+ concat!(file!(), "\0").as_ptr() as *const _,
+ line!() as c_int)));
+ ptr::copy_nonoverlapping(response.as_ptr(), p as *mut u8, response.len());
+ cvt(ffi::SSL_set_tlsext_status_ocsp_resp(self.as_ptr(),
+ p as *mut c_uchar,
+ response.len() as c_long) as c_int)
+ .map(|_| ())
+ }
+ }
+
+ /// Determines if this `Ssl` is configured for server-side or client-side use.
+ pub fn is_server(&self) -> bool {
+ unsafe {
+ compat::SSL_is_server(self.as_ptr()) != 0
+ }
+ }
}
unsafe impl Sync for Ssl {}
@@ -1701,8 +1876,8 @@ mod compat {
use ffi;
use libc::c_int;
- pub use ffi::{SSL_CTX_get_options, SSL_CTX_set_options};
- pub use ffi::{SSL_CTX_clear_options, SSL_CTX_up_ref};
+ pub use ffi::{SSL_CTX_get_options, SSL_CTX_set_options, SSL_CTX_clear_options, SSL_CTX_up_ref,
+ SSL_SESSION_get_master_key, SSL_is_server};
pub unsafe fn get_new_idx(f: ffi::CRYPTO_EX_free) -> c_int {
ffi::CRYPTO_get_ex_new_index(ffi::CRYPTO_EX_INDEX_SSL_CTX,
@@ -1737,7 +1912,7 @@ mod compat {
use std::ptr;
use ffi;
- use libc::{self, c_long, c_ulong, c_int};
+ use libc::{self, c_long, c_ulong, c_int, size_t, c_uchar};
pub unsafe fn SSL_CTX_get_options(ctx: *const ffi::SSL_CTX) -> c_ulong {
ffi::SSL_CTX_ctrl(ctx as *mut _, ffi::SSL_CTRL_OPTIONS, 0, ptr::null_mut()) as c_ulong
@@ -1774,6 +1949,19 @@ mod compat {
0
}
+ pub unsafe fn SSL_SESSION_get_master_key(session: *const ffi::SSL_SESSION,
+ out: *mut c_uchar,
+ mut outlen: size_t) -> size_t {
+ if outlen == 0 {
+ return (*session).master_key_length as size_t;
+ }
+ if outlen > (*session).master_key_length as size_t {
+ outlen = (*session).master_key_length as size_t;
+ }
+ ptr::copy_nonoverlapping((*session).master_key.as_ptr(), out, outlen);
+ outlen
+ }
+
pub fn tls_method() -> *const ffi::SSL_METHOD {
unsafe { ffi::SSLv23_method() }
}
@@ -1781,4 +1969,8 @@ mod compat {
pub fn dtls_method() -> *const ffi::SSL_METHOD {
unsafe { ffi::DTLSv1_method() }
}
+
+ pub unsafe fn SSL_is_server(s: *mut ffi::SSL) -> c_int {
+ (*s).server
+ }
}
diff --git a/openssl/src/ssl/tests/mod.rs b/openssl/src/ssl/tests/mod.rs
index e685d658..536088ab 100644
--- a/openssl/src/ssl/tests/mod.rs
+++ b/openssl/src/ssl/tests/mod.rs
@@ -16,9 +16,11 @@ use tempdir::TempDir;
use dh::Dh;
use hash::MessageDigest;
+use ocsp::{OcspResponse, RESPONSE_STATUS_UNAUTHORIZED};
use ssl;
use ssl::{SslMethod, HandshakeError, SslContext, SslStream, Ssl, ShutdownResult,
- SslConnectorBuilder, SslAcceptorBuilder, Error, SSL_VERIFY_PEER, SSL_VERIFY_NONE};
+ SslConnectorBuilder, SslAcceptorBuilder, Error, SSL_VERIFY_PEER, SSL_VERIFY_NONE,
+ STATUS_TYPE_OCSP};
use x509::{X509StoreContext, X509, X509Name, X509_FILETYPE_PEM};
#[cfg(any(all(feature = "v102", ossl102), all(feature = "v110", ossl110)))]
use x509::verify::X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS;
@@ -98,6 +100,7 @@ impl Server {
Server::new_tcp(&["-www"])
}
+ #[allow(dead_code)]
fn new_alpn() -> (Server, TcpStream) {
Server::new_tcp(&["-www",
"-nextprotoneg",
@@ -1372,6 +1375,71 @@ fn tmp_ecdh_callback_ssl() {
assert!(CALLED_BACK.load(Ordering::SeqCst));
}
+#[test]
+fn idle_session() {
+ let ctx = SslContext::builder(SslMethod::tls()).unwrap().build();
+ let ssl = Ssl::new(&ctx).unwrap();
+ assert!(ssl.session().is_none());
+}
+
+#[test]
+fn active_session() {
+ let connector = SslConnectorBuilder::new(SslMethod::tls()).unwrap().build();
+
+ let s = TcpStream::connect("google.com:443").unwrap();
+ let socket = connector.connect("google.com", s).unwrap();
+ let session = socket.ssl().session().unwrap();
+ let len = session.master_key_len();
+ let mut buf = vec![0; len - 1];
+ let copied = session.master_key(&mut buf);
+ assert_eq!(copied, buf.len());
+ let mut buf = vec![0; len + 1];
+ let copied = session.master_key(&mut buf);
+ assert_eq!(copied, len);
+}
+
+#[test]
+fn status_callbacks() {
+ static CALLED_BACK_SERVER: AtomicBool = ATOMIC_BOOL_INIT;
+ static CALLED_BACK_CLIENT: AtomicBool = ATOMIC_BOOL_INIT;
+
+ let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+ let port = listener.local_addr().unwrap().port();
+
+ let guard = thread::spawn(move || {
+ let stream = listener.accept().unwrap().0;
+ let mut ctx = SslContext::builder(SslMethod::tls()).unwrap();
+ ctx.set_certificate_file(&Path::new("test/cert.pem"), X509_FILETYPE_PEM).unwrap();
+ ctx.set_private_key_file(&Path::new("test/key.pem"), X509_FILETYPE_PEM).unwrap();
+ ctx.set_status_callback(|ssl| {
+ CALLED_BACK_SERVER.store(true, Ordering::SeqCst);
+ let response = OcspResponse::create(RESPONSE_STATUS_UNAUTHORIZED, None).unwrap();
+ let response = response.to_der().unwrap();
+ ssl.set_ocsp_status(&response).unwrap();
+ Ok(true)
+ }).unwrap();
+ let ssl = Ssl::new(&ctx.build()).unwrap();
+ ssl.accept(stream).unwrap();
+ });
+
+ let stream = TcpStream::connect(("127.0.0.1", port)).unwrap();
+ let mut ctx = SslContext::builder(SslMethod::tls()).unwrap();
+ ctx.set_status_callback(|ssl| {
+ CALLED_BACK_CLIENT.store(true, Ordering::SeqCst);
+ let response = OcspResponse::from_der(ssl.ocsp_status().unwrap()).unwrap();
+ assert_eq!(response.status(), RESPONSE_STATUS_UNAUTHORIZED);
+ Ok(true)
+ }).unwrap();
+ let mut ssl = Ssl::new(&ctx.build()).unwrap();
+ ssl.set_status_type(STATUS_TYPE_OCSP).unwrap();
+ ssl.connect(stream).unwrap();
+
+ assert!(CALLED_BACK_SERVER.load(Ordering::SeqCst));
+ assert!(CALLED_BACK_CLIENT.load(Ordering::SeqCst));
+
+ guard.join().unwrap();
+}
+
fn _check_kinds() {
fn is_send<T: Send>() {}
fn is_sync<T: Sync>() {}
diff --git a/openssl/src/string.rs b/openssl/src/string.rs
new file mode 100644
index 00000000..37d44d16
--- /dev/null
+++ b/openssl/src/string.rs
@@ -0,0 +1,74 @@
+use ffi;
+use libc::{c_char, c_void};
+use std::fmt;
+use std::ffi::CStr;
+use std::ops::Deref;
+use std::str;
+
+use types::{OpenSslType, OpenSslTypeRef};
+use stack::Stackable;
+
+type_!(OpensslString, OpensslStringRef, c_char, free);
+
+impl OpensslString {
+ #[deprecated(note = "use from_ptr", since = "0.9.7")]
+ pub unsafe fn from_raw_parts(buf: *mut u8, _: usize) -> OpensslString {
+ OpensslString::from_ptr(buf as *mut c_char)
+ }
+
+ #[deprecated(note = "use from_ptr", since = "0.9.7")]
+ pub unsafe fn from_null_terminated(buf: *mut c_char) -> OpensslString {
+ OpensslString::from_ptr(buf)
+ }
+}
+
+impl fmt::Display for OpensslString {
+ fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ fmt::Display::fmt(&**self, f)
+ }
+}
+
+impl fmt::Debug for OpensslString {
+ fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ fmt::Debug::fmt(&**self, f)
+ }
+}
+
+impl Stackable for OpensslString {
+ type StackType = ffi::stack_st_OPENSSL_STRING;
+}
+
+impl Deref for OpensslStringRef {
+ type Target = str;
+
+ fn deref(&self) -> &str {
+ unsafe {
+ let slice = CStr::from_ptr(self.as_ptr()).to_bytes();
+ str::from_utf8_unchecked(slice)
+ }
+ }
+}
+
+impl fmt::Display for OpensslStringRef {
+ fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ fmt::Display::fmt(&**self, f)
+ }
+}
+
+impl fmt::Debug for OpensslStringRef {
+ fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+ fmt::Debug::fmt(&**self, f)
+ }
+}
+
+#[cfg(not(ossl110))]
+unsafe fn free(buf: *mut c_char) {
+ ::ffi::CRYPTO_free(buf as *mut c_void);
+}
+
+#[cfg(ossl110)]
+unsafe fn free(buf: *mut c_char) {
+ ::ffi::CRYPTO_free(buf as *mut c_void,
+ concat!(file!(), "\0").as_ptr() as *const c_char,
+ line!() as ::libc::c_int);
+}
diff --git a/openssl/src/symm.rs b/openssl/src/symm.rs
index 99ee4c67..5cf1ce0b 100644
--- a/openssl/src/symm.rs
+++ b/openssl/src/symm.rs
@@ -108,6 +108,18 @@ impl Cipher {
unsafe { Cipher(ffi::EVP_rc4()) }
}
+ /// Requires the `v110` feature and OpenSSL 1.1.0.
+ #[cfg(all(ossl110, feature = "v110"))]
+ pub fn chacha20() -> Cipher {
+ unsafe { Cipher(ffi::EVP_chacha20()) }
+ }
+
+ /// Requires the `v110` feature and OpenSSL 1.1.0.
+ #[cfg(all(ossl110, feature = "v110"))]
+ pub fn chacha20_poly1305() -> Cipher {
+ unsafe { Cipher(ffi::EVP_chacha20_poly1305()) }
+ }
+
pub unsafe fn from_ptr(ptr: *const ffi::EVP_CIPHER) -> Cipher {
Cipher(ptr)
}
@@ -767,4 +779,52 @@ mod tests {
&Vec::from_hex(tag).unwrap()).unwrap();
assert_eq!(pt, out.to_hex());
}
+
+ #[test]
+ #[cfg(all(ossl110, feature = "v110"))]
+ fn test_chacha20() {
+ let key = "0000000000000000000000000000000000000000000000000000000000000000";
+ let iv = "00000000000000000000000000000000";
+ let pt = "000000000000000000000000000000000000000000000000000000000000000000000000000000000\
+ 00000000000000000000000000000000000000000000000";
+ let ct = "76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7da41597c5157488d7\
+ 724e03fb8d84a376a43b8f41518a11cc387b669b2ee6586";
+
+ cipher_test(Cipher::chacha20(), pt, ct, key, iv);
+ }
+
+ #[test]
+ #[cfg(all(ossl110, feature = "v110"))]
+ fn test_chacha20_poly1305() {
+ let key = "808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f";
+ let iv = "070000004041424344454647";
+ let aad = "50515253c0c1c2c3c4c5c6c7";
+ let pt = "4c616469657320616e642047656e746c656d656e206f662074686520636c617373206f66202739393\
+ a204966204920636f756c64206f6666657220796f75206f6e6c79206f6e652074697020666f722074\
+ 6865206675747572652c2073756e73637265656e20776f756c642062652069742e";
+ let ct = "d31a8d34648e60db7b86afbc53ef7ec2a4aded51296e08fea9e2b5a736ee62d63dbea45e8ca967128\
+ 2fafb69da92728b1a71de0a9e060b2905d6a5b67ecd3b3692ddbd7f2d778b8c9803aee328091b58fa\
+ b324e4fad675945585808b4831d7bc3ff4def08e4b7a9de576d26586cec64b6116";
+ let tag = "1ae10b594f09e26a7e902ecbd0600691";
+
+ let mut actual_tag = [0; 16];
+ let out = encrypt_aead(Cipher::chacha20_poly1305(),
+ &Vec::from_hex(key).unwrap(),
+ Some(&Vec::from_hex(iv).unwrap()),
+ &Vec::from_hex(aad).unwrap(),
+ &Vec::from_hex(pt).unwrap(),
+ &mut actual_tag)
+ .unwrap();
+ assert_eq!(ct, out.to_hex());
+ assert_eq!(tag, actual_tag.to_hex());
+
+ let out = decrypt_aead(Cipher::chacha20_poly1305(),
+ &Vec::from_hex(key).unwrap(),
+ Some(&Vec::from_hex(iv).unwrap()),
+ &Vec::from_hex(aad).unwrap(),
+ &Vec::from_hex(ct).unwrap(),
+ &Vec::from_hex(tag).unwrap())
+ .unwrap();
+ assert_eq!(pt, out.to_hex());
+ }
}
diff --git a/openssl/src/x509/mod.rs b/openssl/src/x509/mod.rs
index d90cee22..e75dcf5d 100644
--- a/openssl/src/x509/mod.rs
+++ b/openssl/src/x509/mod.rs
@@ -20,6 +20,7 @@ use error::ErrorStack;
use ffi;
use nid::Nid;
use types::{OpenSslType, OpenSslTypeRef};
+use string::OpensslString;
use stack::{Stack, StackRef, Stackable};
#[cfg(ossl10x)]
@@ -415,6 +416,25 @@ impl X509Ref {
}
}
+ /// Returns the list of OCSP responder URLs specified in the certificate's Authority Information
+ /// Access field.
+ pub fn ocsp_responders(&self) -> Result<Stack<OpensslString>, ErrorStack> {
+ unsafe {
+ cvt_p(ffi::X509_get1_ocsp(self.as_ptr())).map(|p| Stack::from_ptr(p))
+ }
+ }
+
+ /// Checks that this certificate issued `subject`.
+ pub fn issued(&self, subject: &X509Ref) -> Result<(), X509VerifyError> {
+ unsafe {
+ let r = ffi::X509_check_issued(self.as_ptr(), subject.as_ptr());
+ match X509VerifyError::from_raw(r as c_long) {
+ Some(e) => Err(e),
+ None => Ok(()),
+ }
+ }
+ }
+
to_pem!(ffi::PEM_write_bio_X509);
to_der!(ffi::i2d_X509);
}
diff --git a/openssl/src/x509/store.rs b/openssl/src/x509/store.rs
index 01eb0e2f..dd08a49b 100644
--- a/openssl/src/x509/store.rs
+++ b/openssl/src/x509/store.rs
@@ -1,13 +1,33 @@
use ffi;
use std::mem;
-use cvt;
+use {cvt, cvt_p};
use error::ErrorStack;
use types::OpenSslTypeRef;
use x509::X509;
type_!(X509StoreBuilder, X509StoreBuilderRef, ffi::X509_STORE, ffi::X509_STORE_free);
+impl X509StoreBuilder {
+ /// Returns a builder for a certificate store.
+ ///
+ /// The store is initially empty.
+ pub fn new() -> Result<X509StoreBuilder, ErrorStack> {
+ unsafe {
+ ffi::init();
+
+ cvt_p(ffi::X509_STORE_new()).map(X509StoreBuilder)
+ }
+ }
+
+ /// Constructs the `X509Store`.
+ pub fn build(self) -> X509Store {
+ let store = X509Store(self.0);
+ mem::forget(self);
+ store
+ }
+}
+
impl X509StoreBuilderRef {
/// Adds a certificate to the certificate store.
pub fn add_cert(&mut self, cert: X509) -> Result<(), ErrorStack> {
@@ -17,4 +37,17 @@ impl X509StoreBuilderRef {
cvt(ffi::X509_STORE_add_cert(self.as_ptr(), ptr)).map(|_| ())
}
}
+
+ /// Load certificates from their default locations.
+ ///
+ /// These locations are read from the `SSL_CERT_FILE` and `SSL_CERT_DIR`
+ /// environment variables if present, or defaults specified at OpenSSL
+ /// build time otherwise.
+ pub fn set_default_paths(&mut self) -> Result<(), ErrorStack> {
+ unsafe {
+ cvt(ffi::X509_STORE_set_default_paths(self.as_ptr())).map(|_| ())
+ }
+ }
}
+
+type_!(X509Store, X509StoreRef, ffi::X509_STORE, ffi::X509_STORE_free);
diff --git a/openssl/src/x509/tests.rs b/openssl/src/x509/tests.rs
index 0843b19f..01cbf2ec 100644
--- a/openssl/src/x509/tests.rs
+++ b/openssl/src/x509/tests.rs
@@ -1,8 +1,11 @@
use hex::{FromHex, ToHex};
+use ec::{NAMED_CURVE, EcGroup, EcKey};
use hash::MessageDigest;
+use nid::X9_62_PRIME256V1;
use pkey::PKey;
use rsa::Rsa;
+use ssl::{SslMethod, SslContextBuilder};
use x509::{X509, X509Generator};
use x509::extension::Extension::{KeyUsage, ExtKeyUsage, SubjectAltName, OtherNid, OtherStr};
use x509::extension::AltNameOption as SAN;
@@ -132,7 +135,7 @@ fn test_nid_values() {
assert_eq!(email.data().as_slice(), b"[email protected]");
let friendly = subject.entries_by_nid(nid::FRIENDLYNAME).next().unwrap();
- assert_eq!(&*friendly.data().as_utf8().unwrap(), "Example");
+ assert_eq!(&**friendly.data().as_utf8().unwrap(), "Example");
}
#[test]
@@ -186,3 +189,34 @@ fn test_stack_from_pem() {
assert_eq!(certs[1].fingerprint(MessageDigest::sha1()).unwrap().to_hex(),
"c0cbdf7cdd03c9773e5468e1f6d2da7d5cbb1875");
}
+
+#[test]
+fn issued() {
+ let cert = include_bytes!("../../test/cert.pem");
+ let cert = X509::from_pem(cert).unwrap();
+ let ca = include_bytes!("../../test/root-ca.pem");
+ let ca = X509::from_pem(ca).unwrap();
+
+ ca.issued(&cert).unwrap();
+ cert.issued(&cert).err().unwrap();
+}
+
+#[test]
+fn ecdsa_cert() {
+ let mut group = EcGroup::from_curve_name(X9_62_PRIME256V1).unwrap();
+ group.set_asn1_flag(NAMED_CURVE);
+ let key = EcKey::generate(&group).unwrap();
+ let key = PKey::from_ec_key(key).unwrap();
+
+ let cert = X509Generator::new()
+ .set_valid_period(365)
+ .add_name("CN".to_owned(), "TestServer".to_owned())
+ .set_sign_hash(MessageDigest::sha256())
+ .sign(&key)
+ .unwrap();
+
+ let mut ctx = SslContextBuilder::new(SslMethod::tls()).unwrap();
+ ctx.set_certificate(&cert).unwrap();
+ ctx.set_private_key(&key).unwrap();
+ ctx.check_private_key().unwrap();
+}
generated by cgit v1.2.3 (git 2.25.1) at 2026-04-28 06:25:43 +0000