Skip to content

Commit f428a50

Browse files
esegece-comesegece-com
authored
Revert "openssl 3"
This reverts commit 6239e3a.
1 parent 6239e3a commit f428a50

File tree

3 files changed

+350
-513
lines changed

3 files changed

+350
-513
lines changed

‎IdSSLOpenSSL.pas‎

Lines changed: 62 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,7 @@ interface
234234
IdYarn;
235235

236236
type
237-
TIdSSLVersion = (sslvSSLv2, sslvSSLv23, sslvSSLv3, sslvTLSv1,sslvTLSv1_1,sslvTLSv1_2, sslvTLSv1_3);
237+
TIdSSLVersion = (sslvSSLv2, sslvSSLv23, sslvSSLv3, sslvTLSv1,sslvTLSv1_1,sslvTLSv1_2);
238238
TIdSSLVersions = set of TIdSSLVersion;
239239
TIdSSLMode = (sslmUnassigned, sslmClient, sslmServer, sslmBoth);
240240
TIdSSLVerifyMode = (sslvrfPeer, sslvrfFailIfNoPeerCert, sslvrfClientOnce);
@@ -243,8 +243,8 @@ interface
243243
TIdSSLAction = (sslRead, sslWrite);
244244

245245
const
246-
DEF_SSLVERSION = sslvTLSv1_3;
247-
DEF_SSLVERSIONS = [sslvTLSv1_3];
246+
DEF_SSLVERSION = sslvTLSv1;
247+
DEF_SSLVERSIONS = [sslvTLSv1];
248248
P12_FILETYPE = 3;
249249
MAX_SSL_PASSWORD_LENGTH = 128;
250250

@@ -901,12 +901,10 @@ function calls will reset that value and we can't know what a programmer will
901901
LockInfoCB.Enter;
902902
try
903903
IdSSLSocket := TIdSSLSocket(SSL_get_app_data(sslSocket));
904-
if Assigned(IdSSLSocket) then begin
905-
if Supports(IdSSLSocket.fParent, IIdSSLOpenSSLCallbackHelper, IInterface(LHelper)) then begin
906-
StatusStr := IndyFormat(RSOSSLStatusString, [String(SSL_state_string_long(sslSocket))]);
907-
LHelper.StatusInfo(sslSocket, where, ret, StatusStr);
908-
LHelper := nil;
909-
end;
904+
if Supports(IdSSLSocket.fParent, IIdSSLOpenSSLCallbackHelper, IInterface(LHelper)) then begin
905+
StatusStr := IndyFormat(RSOSSLStatusString, [String(SSL_state_string_long(sslSocket))]);
906+
LHelper.StatusInfo(sslSocket, where, ret, StatusStr);
907+
LHelper := nil;
910908
end;
911909
finally
912910
LockInfoCB.Leave;
@@ -948,7 +946,7 @@ function VerifyCallback(Ok: TIdC_INT; ctx: PX509_STORE_CTX): TIdC_INT; cdecl;
948946
try
949947
VerifiedOK := True;
950948
try
951-
hSSL := X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx);
949+
hSSL := X509_STORE_CTX_get_app_data(ctx);
952950
if hSSL = nil then begin
953951
Result := Ok;
954952
Exit;
@@ -957,23 +955,21 @@ function VerifyCallback(Ok: TIdC_INT; ctx: PX509_STORE_CTX): TIdC_INT; cdecl;
957955
Certificate := TIdX509.Create(hcert, False); // the certificate is owned by the store
958956
try
959957
IdSSLSocket := TIdSSLSocket(SSL_get_app_data(hSSL));
960-
if Assigned(IdSSLSocket) then begin
961-
Error := X509_STORE_CTX_get_error(ctx);
962-
Depth := X509_STORE_CTX_get_error_depth(ctx);
963-
if not ((Ok > 0) and (IdSSLSocket.fSSLContext.VerifyDepth >= Depth)) then begin
964-
Ok := 0;
965-
{if Error = X509_V_OK then begin
966-
Error := X509_V_ERR_CERT_CHAIN_TOO_LONG;
967-
end;}
968-
end;
969-
LOk := False;
970-
if Ok = 1 then begin
971-
LOk := True;
972-
end;
973-
if Supports(IdSSLSocket.fParent, IIdSSLOpenSSLCallbackHelper, IInterface(LHelper)) then begin
974-
VerifiedOK := LHelper.VerifyPeer(Certificate, LOk, Depth, Error);
975-
LHelper := nil;
976-
end;
958+
Error := X509_STORE_CTX_get_error(ctx);
959+
Depth := X509_STORE_CTX_get_error_depth(ctx);
960+
if not ((Ok > 0) and (IdSSLSocket.fSSLContext.VerifyDepth >= Depth)) then begin
961+
Ok := 0;
962+
{if Error = X509_V_OK then begin
963+
Error := X509_V_ERR_CERT_CHAIN_TOO_LONG;
964+
end;}
965+
end;
966+
LOk := False;
967+
if Ok = 1 then begin
968+
LOk := True;
969+
end;
970+
if Supports(IdSSLSocket.fParent, IIdSSLOpenSSLCallbackHelper, IInterface(LHelper)) then begin
971+
VerifiedOK := LHelper.VerifyPeer(Certificate, LOk, Depth, Error);
972+
LHelper := nil;
977973
end;
978974
finally
979975
FreeAndNil(Certificate);
@@ -2364,11 +2360,33 @@ function LoadOpenSSLLibrary: Boolean;
23642360
// has to be done before anything that uses memory
23652361
IdSslCryptoMallocInit;
23662362
{$ENDIF}
2363+
// required eg to encrypt a private key when writing
2364+
OpenSSL_add_all_ciphers;
2365+
OpenSSL_add_all_digests;
2366+
InitializeRandom;
2367+
// IdSslRandScreen;
2368+
SSL_load_error_strings;
2369+
// Successful loading if true
2370+
Result := SSLeay_add_ssl_algorithms > 0;
2371+
if not Result then begin
2372+
Exit;
2373+
end;
23672374
// Create locking structures, we need them for callback routines
23682375
Assert(LockInfoCB = nil);
23692376
LockInfoCB := TIdCriticalSection.Create;
23702377
LockPassCB := TIdCriticalSection.Create;
23712378
LockVerifyCB := TIdCriticalSection.Create;
2379+
// Handle internal OpenSSL locking
2380+
CallbackLockList := TIdCriticalSectionThreadList.Create;
2381+
PrepareOpenSSLLocking;
2382+
CRYPTO_set_locking_callback(@SslLockingCallback);
2383+
{$IFNDEF WIN32_OR_WIN64}
2384+
if Assigned(CRYPTO_THREADID_set_callback) then begin
2385+
CRYPTO_THREADID_set_callback(@_threadid_func);
2386+
end else begin
2387+
CRYPTO_set_id_callback(@_GetThreadID);
2388+
end;
2389+
{$ENDIF}
23722390
SSLIsLoaded.Value := True;
23732391
Result := True;
23742392
finally
@@ -2442,7 +2460,7 @@ procedure TIdSSLOptions.SetMethod(const AValue: TIdSSLVersion);
24422460
begin
24432461
fMethod := AValue;
24442462
if AValue = sslvSSLv23 then begin
2445-
fSSLVersions := [sslvSSLv2,sslvSSLv3,sslvTLSv1,sslvTLSv1_1,sslvTLSv1_2,sslvTLSv1_3];
2463+
fSSLVersions := [sslvSSLv2,sslvSSLv3,sslvTLSv1,sslvTLSv1_1,sslvTLSv1_2];
24462464
end else begin
24472465
fSSLVersions := [AValue];
24482466
end;
@@ -2466,15 +2484,12 @@ procedure TIdSSLOptions.SetSSLVersions(const AValue: TIdSSLVersions);
24662484
else if fSSLVersions = [sslvTLSv1_2 ] then begin
24672485
fMethod := sslvTLSv1_2;
24682486
end
2469-
else if fSSLVersions = [sslvTLSv1_3] then begin
2470-
fMethod := sslvTLSv1_3;
2471-
end
24722487
else begin
24732488
fMethod := sslvSSLv23;
24742489
if sslvSSLv23 in fSSLVersions then begin
24752490
Exclude(fSSLVersions, sslvSSLv23);
24762491
if fSSLVersions = [] then begin
2477-
fSSLVersions := [sslvSSLv2,sslvSSLv3,sslvTLSv1,sslvTLSv1_1,sslvTLSv1_2,sslvTLSv1_3];
2492+
fSSLVersions := [sslvSSLv2,sslvSSLv3,sslvTLSv1,sslvTLSv1_1,sslvTLSv1_2];
24782493
end;
24792494
end;
24802495
end;
@@ -3284,24 +3299,7 @@ procedure TIdSSLContext.InitContext(CtxMode: TIdSSLCtxMode);
32843299
SSL_CTX_clear_options(fContext, SSL_OP_NO_TLSv1_2);
32853300
end;
32863301
end;
3287-
if IsOpenSSL_TLSv1_3_Available then begin
3288-
if not(sslvTLSv1_3 in SSLVersions) then begin
3289-
SSL_CTX_set_options(fContext, SSL_OP_NO_TLSv1_3);
3290-
end
3291-
else if (fMethod = sslvSSLv23) then begin
3292-
SSL_CTX_clear_options(fContext, SSL_OP_NO_TLSv1_3);
3293-
end;
3294-
end;
32953302

3296-
if sslvTLSv1_3 in SSLVersions then
3297-
SSL_CTX_set_min_proto_version(fContext, TLS1_2_VERSION)
3298-
else if sslvTLSv1_2 in SSLVersions then
3299-
SSL_CTX_set_min_proto_version(fContext, TLS1_2_VERSION)
3300-
else if sslvTLSv1_1 in SSLVersions then
3301-
SSL_CTX_set_min_proto_version(fContext, TLS1_1_VERSION)
3302-
else
3303-
SSL_CTX_set_min_proto_version(fContext, TLS1_VERSION);
3304-
SSL_CTX_set_max_proto_version(fContext, TLS1_3_VERSION);
33053303
SSL_CTX_set_mode(fContext, SSL_MODE_AUTO_RETRY);
33063304
// assign a password lookup routine
33073305
// if PasswordRoutineOn then begin
@@ -3464,10 +3462,22 @@ function TIdSSLContext.SetSSLMethod: PSSL_METHOD;
34643462
end;
34653463
end;
34663464
sslvSSLv23:
3467-
if Assigned(TLS_method) then
3468-
Result := TLS_method()
3465+
case fMode of
3466+
sslmServer : begin
3467+
if Assigned(SSLv23_server_method) then begin
3468+
Result := SSLv23_server_method();
3469+
end;
3470+
end;
3471+
sslmClient : begin
3472+
if Assigned(SSLv23_client_method) then begin
3473+
Result := SSLv23_client_method();
3474+
end;
3475+
end;
34693476
else
3470-
Result := SelectTLS1Method(fMode);
3477+
if Assigned(SSLv23_method) then begin
3478+
Result := SSLv23_method();
3479+
end;
3480+
end;
34713481
sslvSSLv3:
34723482
case fMode of
34733483
sslmServer : begin
@@ -3545,11 +3555,6 @@ function TIdSSLContext.SetSSLMethod: PSSL_METHOD;
35453555
Result := SelectTLS1Method(fMode);
35463556
end;
35473557
end;
3548-
sslvTLSv1_3:
3549-
if Assigned(TLS_method) then
3550-
Result := TLS_method()
3551-
else
3552-
Result := SelectTLS1Method(fMode);
35533558
end;
35543559
if Result = nil then begin
35553560
raise EIdOSSLGetMethodError.Create(RSSSLGetMethodError);

0 commit comments

Comments
 (0)