version.c

Go to the documentation of this file.

/*
 *   This program is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation; either version 2 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program; if not, write to the Free Software
 *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 */
 
/**
 * $Id: 224ebf663247f7b1e48fa7672eadfd1eb5f443f2 $
 *
 * @file tls/version.c
 * @brief Check OpenSSL library/header consistency, and process version information.
 *
 * @copyright 2022 Arran Cudbard-Bell <a.cudbardb@freeradius.org>
 */
#define LOG_PREFIX "tls"
 
#include "version.h"
 
#ifdef WITH_TLS
#include <freeradius-devel/server/log.h>
 
static long ssl_built = OPENSSL_VERSION_NUMBER;
 
/** Check built and linked versions of OpenSSL match
 *
 * OpenSSL version number consists of:
 * MNNFFPPS: major minor fix patch status
 *
 * Where status >= 0 && < 10 means beta, and status 10 means release.
 *
 *      https://wiki.openssl.org/index.php/Versioning
 *
 * Startup check for whether the linked version of OpenSSL matches the
 * version the server was built against.
 *
 * @return
 *      - 0 if ok.
 *      - -1 if not ok.
 */
int fr_openssl_version_consistent(void)
{
        unsigned long ssl_linked;
 
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
        ssl_linked = OpenSSL_version_num();
#else
        ssl_linked = (unsigned long)SSLeay();
#endif
 
        /*
         *      Major and minor versions mismatch, that's bad.
         *
         *      We still allow mismatches between patch versions
         *      as they should be ABI compatible.
         *
         *      This should work for >= 1.1.0 including 3.0.0
         */
        if ((ssl_linked & 0xfff00000) != (ssl_built & 0xfff00000)) {
                ERROR("libssl version mismatch.  built: %lx linked: %lx",
                      (unsigned long) ssl_built,
                      (unsigned long) ssl_linked);
                return -1;
        }
 
        return 0;
}
 
/** Convert a version number to a text string
 *
 * @note Not thread safe.
 *
 * @param v version to convert.
 * @return pointer to a static buffer containing the version string.
 */
char const *fr_openssl_version_str_from_num(uint32_t v)
{
        /* 2 (%s) + 1 (.) + 2 (%i) + 1 (.) + 2 (%i) + 1 (c) + 8 (%s) + \0 */
        static char buffer[18];
        char *p = buffer, *end = buffer + sizeof(buffer);
 
        /*
         *      If OpenSSL major version is less than three
         *      use the old version number layout.
         */
        if (((v & 0xf0000000) >> 28) < 3) {
                p += snprintf(p, end - p, "%u.%u.%u",
                              (0xf0000000 & v) >> 28,
                              (0x0ff00000 & v) >> 20,
                              (0x000ff000 & v) >> 12);
 
                if ((0x00000ff0 & v) >> 4) {
                        *p++ =  (char) (0x60 + ((0x00000ff0 & v) >> 4));
                }
 
                *p++ = ' ';
 
                /*
                 *      Development (0)
                 */
                if ((0x0000000f & v) == 0) {
                        strlcpy(p, "dev", end - p);
                /*
                 *      Beta (1-14)
                 */
                } else if ((0x0000000f & v) <= 14) {
                        snprintf(p, end - p, "beta %u", 0x0000000f & v);
                } else {
                        strlcpy(p, "release", end - p);
                }
 
                return buffer;
        }
 
        /*
         *      If OpenSSL major version is >= 3 us the
         *      new version number layout
         *
         *      OPENSSL_VERSION_NUMBER is a combination of the major, minor
         *      and patch version into a single integer 0xMNN00PP0L, where:
         *
         *      M is the number from OPENSSL_VERSION_MAJOR, in hexadecimal notation.
         *      NN is the number from OPENSSL_VERSION_MINOR, in hexadecimal notation.
         *      PP is the number from OPENSSL_VERSION_PATCH, in hexadecimal notation.
         */
        snprintf(buffer, sizeof(buffer), "%u.%u.%u",
                 (0xf0000000 & v) >> 28,
                 (0x0ff00000 & v) >> 20,
                 (0x00000ff0 & v) >> 4);
 
        return buffer;
}
 
/** Convert two openssl version numbers into a range string
 *
 * @param[in] low version to convert.
 * @param[in] high version to convert.
 * @return pointer to a static buffer containing the version range string.
 */
char const *fr_openssl_version_range(uint32_t low, uint32_t high)
{
        /* 18 (version) + 3 ( - ) + 18 (version) */
        static _Thread_local char buffer[40];
        char *p = buffer;
 
        p += strlcpy(p, fr_openssl_version_str_from_num(low), sizeof(buffer));
        p += strlcpy(p, " - ", sizeof(buffer) - (p - buffer));
        strlcpy(p, fr_openssl_version_str_from_num(high), sizeof(buffer) - (p - buffer));
 
        return buffer;
}
 
#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
/** Return the linked SSL version number as a string
 *
 * @return pointer to a static buffer containing the version string.
 */
char const *fr_openssl_version_basic(void)
{
        unsigned long ssl_linked;
 
        ssl_linked = OpenSSL_version_num();
        return fr_openssl_version_str_from_num((uint32_t)ssl_linked);
}
 
/** Print the current linked version of Openssl
 *
 * Print the currently linked version of the OpenSSL library.
 *
 * @return pointer to a static buffer containing libssl version information.
 */
char const *fr_openssl_version_expanded(void)
{
        static _Thread_local char buffer[256];
 
        unsigned long v = OpenSSL_version_num();
 
        snprintf(buffer, sizeof(buffer), "%s 0x%.8lx (%s)",
                 OpenSSL_version(OPENSSL_VERSION),              /* Not all builds include a useful version number */
                 v,
                 fr_openssl_version_str_from_num(v));
 
        return buffer;
}
#  else
/** Return the linked SSL version number as a string
 *
 * @return pointer to a static buffer containing the version string.
 */
char const *fr_openssl_version_basic(void)
{
        long ssl_linked;
 
        ssl_linked = SSLeay();
        return fr_openssl_version_str_from_num((uint32_t)ssl_linked);
}
 
/** Print the current linked version of Openssl
 *
 * Print the currently linked version of the OpenSSL library.
 *
 * @note Not thread safe.
 *
 * @return pointer to a static buffer containing libssl version information.
 */
char const *fr_openssl_version_expanded(void)
{
        static _Thread_local char buffer[256];
        long ssl_linked = SSLeay();
 
        snprintf(buffer, sizeof(buffer), "%s 0x%.8x (%s)",
                 SSLeay_version(SSLEAY_VERSION),                /* Not all builds include a useful version number */
                 ssl_linked,
                 fr_openssl_version_str_from_num(v));
 
        return buffer;
}
#  endif
 
#  ifdef ENABLE_OPENSSL_VERSION_CHECK
typedef struct {
        uint64_t        high;           //!< The last version number this defect affected.
        uint64_t        low;            //!< The first version this defect affected.
 
        char const      *id;            //!< CVE (or other ID)
        char const      *name;          //!< As known in the media...
        char const      *comment;       //!< Where to get more information.
} fr_openssl_defect_t;
 
#  undef VM
#  undef Vm
#  define VM(_a,_b,_c) (((((_a) << 24) | ((_b) << 16) | ((_c) << 8)) << 4) | 0x0f)
#  define Vm(_a,_b,_c,_d) (((((_a) << 24) | ((_b) << 16) | ((_c) << 8) | ((_d) - 'a' + 1)) << 4) | 0x0f)
 
/* Record critical defects in libssl here, new versions of OpenSSL to older versions of OpenSSL.  */
static fr_openssl_defect_t fr_openssl_defects[] =
{
        {
                .low            = Vm(1,1,0,'a'),                /* 1.1.0a */
                .high           = Vm(1,1,0,'a'),                /* 1.1.0a */
                .id             = "CVE-2016-6309",
                .name           = "OCSP status request extension",
                .comment        = "For more information see https://www.openssl.org/news/secadv/20160926.txt"
        },
        {
                .low            = VM(1,1,0),                    /* 1.1.0  */
                .high           = VM(1,1,0),                    /* 1.1.0  */
                .id             = "CVE-2016-6304",
                .name           = "OCSP status request extension",
                .comment        = "For more information see https://www.openssl.org/news/secadv/20160922.txt"
        }
};
 
/** Check for vulnerable versions of libssl
 *
 * @param acknowledged The highest CVE number a user has confirmed is not present in the system's
 *      libssl.
 * @return 0 if the CVE specified by the user matches the most recent CVE we have, else -1.
 */
int fr_openssl_version_check(char const *acknowledged)
{
        bool bad = false;
        size_t i;
        unsigned long ssl_linked;
 
 
        /*
         *      Didn't get passed anything, that's an error.
         */
        if (!acknowledged || !*acknowledged) {
                ERROR("Refusing to start until 'allow_vulnerable_openssl' is given a value");
                return -1;
        }
 
        if (strcmp(acknowledged, "yes") == 0) return 0;
 
        /* Check for bad versions */
 
#    if OPENSSL_VERSION_NUMBER >= 0x10101000L
        ssl_linked = OpenSSL_version_num();
#    else
        ssl_linked = (unsigned long)SSLeay();
#    endif
 
        for (i = 0; i < (NUM_ELEMENTS(fr_openssl_defects)); i++) {
                fr_openssl_defect_t *defect = &fr_openssl_defects[i];
 
                if ((ssl_linked >= defect->low) && (ssl_linked <= defect->high)) {
                        /*
                         *      If the CVE is acknowledged, allow it.
                         */
                        if (!bad && (strcmp(acknowledged, defect->id) == 0)) return 0;
 
                        ERROR("Refusing to start with libssl version %s (in range %s)",
                              fr_openssl_version_expanded(), fr_openssl_version_range(defect->low, defect->high));
                        ERROR("Security advisory %s (%s)", defect->id, defect->name);
                        ERROR("%s", defect->comment);
 
                        /*
                         *      Only warn about the first one...
                         */
                        if (!bad) {
                                INFO("Once you have verified libssl has been correctly patched, "
                                     "set security.allow_vulnerable_openssl = '%s'", defect->id);
                                bad = true;
                        }
                }
        }
 
        if (bad) return -1;
 
        return 0;
}
#  endif
#else
int fr_openssl_version_consistent(void) {
        return 0;
}
 
char const *fr_openssl_version_basic(void)
{
        return "not linked";
}
 
char const *fr_openssl_version_expanded(void)
{
        return "not linked";
}
#endif /* ifdef WITH_TLS */