1 --- a/src/openvpn/ssl_polarssl.h
2 +++ b/src/openvpn/ssl_polarssl.h
4 #include <polarssl/pkcs11.h>
7 +#include <polarssl/compat-1.2.h>
9 typedef struct _buffer_entry buffer_entry;
11 struct _buffer_entry {
12 --- a/src/openvpn/ssl_polarssl.c
13 +++ b/src/openvpn/ssl_polarssl.c
16 #include "ssl_common.h"
18 -#include <polarssl/sha2.h>
19 +#include <polarssl/sha256.h>
20 #include <polarssl/havege.h>
22 #include "ssl_verify_polarssl.h"
23 @@ -209,12 +209,12 @@ tls_ctx_load_dh_params (struct tls_root_
25 if (!strcmp (dh_file, INLINE_FILE_TAG) && dh_file_inline)
27 - if (0 != x509parse_dhm(ctx->dhm_ctx, dh_file_inline, strlen(dh_file_inline)))
28 + if (0 != dhm_parse_dhm(ctx->dhm_ctx, dh_file_inline, strlen(dh_file_inline)))
29 msg (M_FATAL, "Cannot read inline DH parameters");
33 - if (0 != x509parse_dhmfile(ctx->dhm_ctx, dh_file))
34 + if (0 != dhm_parse_dhmfile(ctx->dhm_ctx, dh_file))
35 msg (M_FATAL, "Cannot read DH parameters from file %s", dh_file);
38 @@ -249,13 +249,13 @@ tls_ctx_load_cert_file (struct tls_root_
40 if (!strcmp (cert_file, INLINE_FILE_TAG) && cert_file_inline)
42 - if (0 != x509parse_crt(ctx->crt_chain, cert_file_inline,
43 + if (0 != x509_crt_parse(ctx->crt_chain, cert_file_inline,
44 strlen(cert_file_inline)))
45 msg (M_FATAL, "Cannot load inline certificate file");
49 - if (0 != x509parse_crtfile(ctx->crt_chain, cert_file))
50 + if (0 != x509_crt_parse_file(ctx->crt_chain, cert_file))
51 msg (M_FATAL, "Cannot load certificate file %s", cert_file);
54 @@ -476,13 +476,13 @@ void tls_ctx_load_ca (struct tls_root_ct
56 if (ca_file && !strcmp (ca_file, INLINE_FILE_TAG) && ca_file_inline)
58 - if (0 != x509parse_crt(ctx->ca_chain, ca_file_inline, strlen(ca_file_inline)))
59 + if (0 != x509_crt_parse(ctx->ca_chain, ca_file_inline, strlen(ca_file_inline)))
60 msg (M_FATAL, "Cannot load inline CA certificates");
64 /* Load CA file for verifying peer supplied certificate */
65 - if (0 != x509parse_crtfile(ctx->ca_chain, ca_file))
66 + if (0 != x509_crt_parse_file(ctx->ca_chain, ca_file))
67 msg (M_FATAL, "Cannot load CA certificate file %s", ca_file);
70 @@ -496,13 +496,13 @@ tls_ctx_load_extra_certs (struct tls_roo
72 if (!strcmp (extra_certs_file, INLINE_FILE_TAG) && extra_certs_file_inline)
74 - if (0 != x509parse_crt(ctx->crt_chain, extra_certs_file_inline,
75 + if (0 != x509_crt_parse(ctx->crt_chain, extra_certs_file_inline,
76 strlen(extra_certs_file_inline)))
77 msg (M_FATAL, "Cannot load inline extra-certs file");
81 - if (0 != x509parse_crtfile(ctx->crt_chain, extra_certs_file))
82 + if (0 != x509_crt_parse_file(ctx->crt_chain, extra_certs_file))
83 msg (M_FATAL, "Cannot load extra-certs file: %s", extra_certs_file);
86 @@ -684,7 +684,7 @@ void key_state_ssl_init(struct key_state
90 - ssl_set_own_cert( ks_ssl->ctx, ssl_ctx->crt_chain, ssl_ctx->priv_key );
91 + ssl_set_own_cert_rsa( ks_ssl->ctx, ssl_ctx->crt_chain, ssl_ctx->priv_key );
93 /* Initialise SSL verification */
95 @@ -1026,7 +1026,7 @@ print_details (struct key_state_ssl * ks
96 cert = ssl_get_peer_cert(ks_ssl->ctx);
99 - openvpn_snprintf (s2, sizeof (s2), ", " counter_format " bit RSA", (counter_type) cert->rsa.len * 8);
100 + openvpn_snprintf (s2, sizeof (s2), ", " counter_format " bit RSA", (counter_type) pk_rsa(cert->pk)->len * 8);
103 msg (D_HANDSHAKE, "%s%s", s1, s2);
104 --- a/src/openvpn/crypto_polarssl.c
105 +++ b/src/openvpn/crypto_polarssl.c
106 @@ -466,7 +466,12 @@ int cipher_ctx_mode (const cipher_contex
108 int cipher_ctx_reset (cipher_context_t *ctx, uint8_t *iv_buf)
110 - return 0 == cipher_reset(ctx, iv_buf);
111 + int retval = cipher_reset(ctx);
114 + cipher_set_iv(ctx, iv_buf, ctx->cipher_info->iv_size);
116 + return 0 == retval;
119 int cipher_ctx_update (cipher_context_t *ctx, uint8_t *dst, int *dst_len,
120 --- a/src/openvpn/ssl_verify_polarssl.h
121 +++ b/src/openvpn/ssl_verify_polarssl.h
125 #include <polarssl/x509.h>
126 +#include <polarssl/compat-1.2.h>
128 #ifndef __OPENVPN_X509_CERT_T_DECLARED
129 #define __OPENVPN_X509_CERT_T_DECLARED
130 --- a/src/openvpn/ssl_verify_polarssl.c
131 +++ b/src/openvpn/ssl_verify_polarssl.c
133 #include "ssl_verify.h"
134 #include <polarssl/error.h>
135 #include <polarssl/bignum.h>
136 +#include <polarssl/oid.h>
137 #include <polarssl/sha1.h>
139 #define MAX_SUBJECT_LENGTH 256
140 @@ -102,7 +103,7 @@ x509_get_username (char *cn, int cn_len,
141 /* Find common name */
142 while( name != NULL )
144 - if( memcmp( name->oid.p, OID_CN, OID_SIZE(OID_CN) ) == 0)
145 + if( memcmp( name->oid.p, OID_AT_CN, OID_SIZE(OID_AT_CN) ) == 0)
149 @@ -224,60 +225,18 @@ x509_setenv (struct env_set *es, int cer
150 while( name != NULL )
152 char name_expand[64+8];
153 + const char *shortname;
155 - if( name->oid.len == 2 && memcmp( name->oid.p, OID_X520, 2 ) == 0 )
156 + if( 0 == oid_get_attr_short_name(&name->oid, &shortname) )
158 - switch( name->oid.p[2] )
160 - case X520_COMMON_NAME:
161 - openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_CN",
162 - cert_depth); break;
165 - openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_C",
166 - cert_depth); break;
168 - case X520_LOCALITY:
169 - openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_L",
170 - cert_depth); break;
173 - openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_ST",
174 - cert_depth); break;
176 - case X520_ORGANIZATION:
177 - openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_O",
178 - cert_depth); break;
180 - case X520_ORG_UNIT:
181 - openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_OU",
182 - cert_depth); break;
185 - openvpn_snprintf (name_expand, sizeof(name_expand),
186 - "X509_%d_0x%02X", cert_depth, name->oid.p[2]);
189 + openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_%s",
190 + cert_depth, shortname);
194 + openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_\?\?",
197 - else if( name->oid.len == 8 && memcmp( name->oid.p, OID_PKCS9, 8 ) == 0 )
199 - switch( name->oid.p[8] )
202 - openvpn_snprintf (name_expand, sizeof(name_expand),
203 - "X509_%d_emailAddress", cert_depth); break;
206 - openvpn_snprintf (name_expand, sizeof(name_expand),
207 - "X509_%d_0x%02X", cert_depth, name->oid.p[8]);
213 - openvpn_snprintf (name_expand, sizeof(name_expand), "X509_%d_\?\?",
217 for( i = 0; i < name->val.len; i++ )
221 @@ -809,13 +809,13 @@ if test "${with_crypto_library}" = "pola
222 #include <polarssl/version.h>
225 -#if POLARSSL_VERSION_NUMBER < 0x01020A00 || POLARSSL_VERSION_NUMBER >= 0x01030000
226 +#if POLARSSL_VERSION_NUMBER < 0x01030000
227 #error invalid version
231 [AC_MSG_RESULT([ok])],
232 - [AC_MSG_ERROR([PolarSSL 1.2.x required and must be 1.2.10 or later])]
233 + [AC_MSG_ERROR([PolarSSL 1.3.x required])]
236 polarssl_with_pkcs11="no"