From 9add4e1001ce08d78c17e4a3d994fd805f872d2a Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 31 Aug 2015 16:28:14 +0200 Subject: Add support for set_tmp_dh() and RFC5114 DH parameters for forward secrecy. rust-openssl didn't support forward secrecy at all. This adds support for DHE, by exposing set_tmp_dh() as well as the RFC5114 parameters, which are conveniently exposed since OpenSSL 1.0.2. With OpenSSL >= 1.0.2, and the rfc5114 feature gate, enabling DHE is as simple as (here for 2048-bit MODP group with 256-bit prime order subgroup): use openssl::dh::DH; let dh = DH::get_2048_256().unwrap(); ctx.set_tmp_dh(dh).unwrap(); With OpenSSL < 1.0.2, DH::from_params() can be used to manually specify the DH parameters (here for 2048-bit MODP group with 256-bit prime order subgroup): use openssl::bn::BigNum; use openssl::dh::DH; let p = BigNum::from_hex_str("87A8E61DB4B6663CFFBBD19C651959998CEEF608660DD0F25D2CEED4435E3B00E00DF8F1D61957D4FAF7DF4561B2AA3016C3D91134096FAA3BF4296D830E9A7C209E0C6497517ABD5A8A9D306BCF67ED91F9E6725B4758C022E0B1EF4275BF7B6C5BFC11D45F9088B941F54EB1E59BB8BC39A0BF12307F5C4FDB70C581B23F76B63ACAE1CAA6B7902D52526735488A0EF13C6D9A51BFA4AB3AD8347796524D8EF6A167B5A41825D967E144E5140564251CCACB83E6B486F6B3CA3F7971506026C0B857F689962856DED4010ABD0BE621C3A3960A54E710C375F26375D7014103A4B54330C198AF126116D2276E11715F693877FAD7EF09CADB094AE91E1A1597").unwrap(); let g = BigNum::from_hex_str("3FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA12510DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0ADB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C32F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC41659").unwrap(); let q = BigNum::from_hex_str("8CF83642A709A097B447997640129DA299B1A47D1EB3750BA308B0FE64F5FBD3").unwrap(); let dh = DH::from_params(p, g, q).unwrap(); ctx.set_tmp_dh(dh).unwrap(); --- openssl-sys/src/lib.rs | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'openssl-sys/src/lib.rs') diff --git a/openssl-sys/src/lib.rs b/openssl-sys/src/lib.rs index b3025be1..c2dafb5d 100644 --- a/openssl-sys/src/lib.rs +++ b/openssl-sys/src/lib.rs @@ -20,6 +20,7 @@ pub type BIO_METHOD = c_void; pub type BN_CTX = c_void; pub type COMP_METHOD = c_void; pub type CRYPTO_EX_DATA = c_void; +pub type DH = c_void; pub type ENGINE = c_void; pub type EVP_CIPHER = c_void; pub type EVP_CIPHER_CTX = c_void; @@ -380,6 +381,17 @@ extern "C" { pub fn CRYPTO_memcmp(a: *const c_void, b: *const c_void, len: size_t) -> c_int; + pub fn DH_free(dh: *mut DH); + + #[cfg(feature = "rfc5114")] + pub fn DH_get_1024_160() -> *mut DH; + #[cfg(feature = "rfc5114")] + pub fn DH_get_2048_224() -> *mut DH; + #[cfg(feature = "rfc5114")] + pub fn DH_get_2048_256() -> *mut DH; + + pub fn DH_new_from_params(p: *mut BIGNUM, g: *mut BIGNUM, q: *mut BIGNUM) -> *mut DH; + pub fn ERR_get_error() -> c_ulong; pub fn ERR_lib_error_string(err: c_ulong) -> *const c_char; @@ -664,6 +676,8 @@ extern "C" { pub fn SSL_CTX_set_read_ahead(ctx: *mut SSL_CTX, m: c_long) -> c_long; #[link_name = "SSL_set_tlsext_host_name_shim"] pub fn SSL_set_tlsext_host_name(s: *mut SSL, name: *const c_char) -> c_long; + #[link_name = "SSL_CTX_set_tmp_dh_shim"] + pub fn SSL_CTX_set_tmp_dh(s: *mut SSL, dh: *const DH) -> c_long; #[link_name = "X509_get_extensions_shim"] pub fn X509_get_extensions(x: *mut X509) -> *mut stack_st_X509_EXTENSION; } -- cgit v1.2.3 From 50c5042c705a399ebc178b204a1e6148a26966e1 Mon Sep 17 00:00:00 2001 From: Cody P Schafer Date: Tue, 1 Sep 2015 17:09:19 -0400 Subject: ssl/npn+alpn: adjust protocol selection to fail if no protocols match The current behavior causes a server written using rust-openssl to (if it cannot negotiate a protocol) fallback to the first protocol it has avaliable. This makes it impossible to detect protocol mismatches. This updates our selection to be more similar to how openssl's s_server behaves: non-matching protocols are not supplied with a fallback. Note that some setups may actually want a fallback protocol supplied via ALPN. To support those cases, we should consider adding a generic callback that allows protocol selection to be entirely controlled by the programmer. For the purposes of having a sane default, however, not supplying a default (and mimicing s_server's behavior) is the best choice. --- openssl-sys/src/lib.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'openssl-sys/src/lib.rs') diff --git a/openssl-sys/src/lib.rs b/openssl-sys/src/lib.rs index 9b5fd744..91b090e2 100644 --- a/openssl-sys/src/lib.rs +++ b/openssl-sys/src/lib.rs @@ -167,11 +167,11 @@ macro_rules! import_options { include!("ssl_options.rs"); -#[cfg(feature = "npn")] +#[cfg(any(feature = "npn", feature = "alpn"))] pub const OPENSSL_NPN_UNSUPPORTED: c_int = 0; -#[cfg(feature = "npn")] +#[cfg(any(feature = "npn", feature = "alpn"))] pub const OPENSSL_NPN_NEGOTIATED: c_int = 1; -#[cfg(feature = "npn")] +#[cfg(any(feature = "npn", feature = "alpn"))] pub const OPENSSL_NPN_NO_OVERLAP: c_int = 2; pub const V_ASN1_GENERALIZEDTIME: c_int = 24; -- cgit v1.2.3 From 6666a1818ac1d3e126bf632132f941e2aeb0e351 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 1 Sep 2015 10:04:05 +0200 Subject: Add DH::from_pem() to load DH parameters from a file --- openssl-sys/src/lib.rs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'openssl-sys/src/lib.rs') diff --git a/openssl-sys/src/lib.rs b/openssl-sys/src/lib.rs index 9b5fd744..c2c6157c 100644 --- a/openssl-sys/src/lib.rs +++ b/openssl-sys/src/lib.rs @@ -477,7 +477,8 @@ extern "C" { #[cfg_attr(target_os = "nacl", link_name = "HMAC_Update")] pub fn HMAC_Update_shim(ctx: *mut HMAC_CTX, input: *const u8, len: c_uint) -> c_int; - + pub fn PEM_read_bio_DHparams(bio: *mut BIO, out: *mut *mut DH, callback: Option, + user_data: *mut c_void) -> *mut DH; pub fn PEM_read_bio_X509(bio: *mut BIO, out: *mut *mut X509, callback: Option, user_data: *mut c_void) -> *mut X509; pub fn PEM_read_bio_X509_REQ(bio: *mut BIO, out: *mut *mut X509_REQ, callback: Option, -- cgit v1.2.3 From 28320a65a734b2b38301ef149746a44cb23cd366 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 1 Sep 2015 10:56:33 +0200 Subject: Add SSL::set_ecdh_auto() This sets automatic curve selection and enables ECDH support. Requires LibreSSL or OpenSSL >= 1.0.2, so behind a feature gate. --- openssl-sys/src/lib.rs | 3 +++ 1 file changed, 3 insertions(+) (limited to 'openssl-sys/src/lib.rs') diff --git a/openssl-sys/src/lib.rs b/openssl-sys/src/lib.rs index 3f5f7623..45d03ac8 100644 --- a/openssl-sys/src/lib.rs +++ b/openssl-sys/src/lib.rs @@ -675,6 +675,9 @@ extern "C" { pub fn SSL_CTX_add_extra_chain_cert(ctx: *mut SSL_CTX, x509: *mut X509) -> c_long; #[link_name = "SSL_CTX_set_read_ahead_shim"] pub fn SSL_CTX_set_read_ahead(ctx: *mut SSL_CTX, m: c_long) -> c_long; + #[cfg(feature = "ecdh_auto")] + #[link_name = "SSL_CTX_set_ecdh_auto_shim"] + pub fn SSL_CTX_set_ecdh_auto(ssl: *mut SSL_CTX, onoff: c_int) -> c_int; #[link_name = "SSL_set_tlsext_host_name_shim"] pub fn SSL_set_tlsext_host_name(s: *mut SSL, name: *const c_char) -> c_long; #[link_name = "SSL_CTX_set_tmp_dh_shim"] -- cgit v1.2.3 From 6c810e7f9ce21a8a518aa5ce71372bb96c2efada Mon Sep 17 00:00:00 2001 From: Manish Goregaokar Date: Mon, 5 Oct 2015 21:43:49 +0530 Subject: Set threadid_func on linux/osx (fixes #281) --- openssl-sys/src/lib.rs | 2 ++ 1 file changed, 2 insertions(+) (limited to 'openssl-sys/src/lib.rs') diff --git a/openssl-sys/src/lib.rs b/openssl-sys/src/lib.rs index 45d03ac8..e5dfdc82 100644 --- a/openssl-sys/src/lib.rs +++ b/openssl-sys/src/lib.rs @@ -270,6 +270,7 @@ pub fn init() { GUARDS = mem::transmute(guards); CRYPTO_set_locking_callback(locking_function); + unsafe{ rust_openssl_set_id_callback(); } }) } } @@ -290,6 +291,7 @@ pub unsafe fn SSL_CTX_clear_options(ssl: *mut SSL_CTX, op: u64) -> u64 { extern "C" { fn rust_openssl_ssl_ctx_options_rust_to_c(rustval: u64) -> c_long; fn rust_openssl_ssl_ctx_options_c_to_rust(cval: c_long) -> u64; + fn rust_openssl_set_id_callback(); pub fn ASN1_INTEGER_set(dest: *mut ASN1_INTEGER, value: c_long) -> c_int; pub fn ASN1_STRING_type_new(ty: c_int) -> *mut ASN1_STRING; -- cgit v1.2.3 From 0ca71a98fff158d35f5a80b10917bd93f48581b0 Mon Sep 17 00:00:00 2001 From: Steven Fackler Date: Mon, 5 Oct 2015 22:05:58 +0100 Subject: Clean up init stuff --- openssl-sys/src/lib.rs | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'openssl-sys/src/lib.rs') diff --git a/openssl-sys/src/lib.rs b/openssl-sys/src/lib.rs index e5dfdc82..d40d299d 100644 --- a/openssl-sys/src/lib.rs +++ b/openssl-sys/src/lib.rs @@ -252,10 +252,10 @@ extern fn locking_function(mode: c_int, n: c_int, _file: *const c_char, } pub fn init() { - static mut INIT: Once = ONCE_INIT; + static INIT: Once = ONCE_INIT; - unsafe { - INIT.call_once(|| { + INIT.call_once(|| { + unsafe { SSL_library_init(); SSL_load_error_strings(); @@ -270,9 +270,9 @@ pub fn init() { GUARDS = mem::transmute(guards); CRYPTO_set_locking_callback(locking_function); - unsafe{ rust_openssl_set_id_callback(); } - }) - } + rust_openssl_set_id_callback(); + } + }) } pub unsafe fn SSL_CTX_set_options(ssl: *mut SSL_CTX, op: u64) -> u64 { -- cgit v1.2.3 From 677ed6ad1b7a84b0ae96e722bd0a084c67bcff40 Mon Sep 17 00:00:00 2001 From: Steven Fackler Date: Mon, 5 Oct 2015 22:34:32 +0100 Subject: Release v0.6.6 --- openssl-sys/src/lib.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'openssl-sys/src/lib.rs') diff --git a/openssl-sys/src/lib.rs b/openssl-sys/src/lib.rs index d40d299d..3bc9e59a 100644 --- a/openssl-sys/src/lib.rs +++ b/openssl-sys/src/lib.rs @@ -1,6 +1,6 @@ #![allow(non_camel_case_types, non_upper_case_globals, non_snake_case)] #![allow(dead_code)] -#![doc(html_root_url="https://sfackler.github.io/rust-openssl/doc/v0.6.5")] +#![doc(html_root_url="https://sfackler.github.io/rust-openssl/doc/v0.6.6")] extern crate libc; -- cgit v1.2.3