3
* Copyright 2004--2008, Google Inc.
5
* Redistribution and use in source and binary forms, with or without
6
* modification, are permitted provided that the following conditions are met:
8
* 1. Redistributions of source code must retain the above copyright notice,
9
* this list of conditions and the following disclaimer.
10
* 2. Redistributions in binary form must reproduce the above copyright notice,
11
* this list of conditions and the following disclaimer in the documentation
12
* and/or other materials provided with the distribution.
13
* 3. The name of the author may not be used to endorse or promote products
14
* derived from this software without specific prior written permission.
16
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
17
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
18
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
19
* EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
20
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
21
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
22
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
23
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
24
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
25
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30
#endif // HAVE_CONFIG_H
32
#if HAVE_OPENSSL_SSL_H
34
#include "talk/base/opensslstreamadapter.h"
36
#include <openssl/bio.h>
37
#include <openssl/crypto.h>
38
#include <openssl/err.h>
39
#include <openssl/rand.h>
40
#include <openssl/ssl.h>
41
#include <openssl/x509v3.h>
45
#include "talk/base/common.h"
46
#include "talk/base/logging.h"
47
#include "talk/base/stream.h"
48
#include "talk/base/openssladapter.h"
49
#include "talk/base/openssldigest.h"
50
#include "talk/base/opensslidentity.h"
51
#include "talk/base/stringutils.h"
52
#include "talk/base/thread.h"
56
#if (OPENSSL_VERSION_NUMBER >= 0x10001000L)
57
#define HAVE_DTLS_SRTP
60
#if (OPENSSL_VERSION_NUMBER >= 0x10000000L)
65
// SRTP cipher suite table
66
struct SrtpCipherMapEntry {
67
const char* external_name;
68
const char* internal_name;
71
// This isn't elegant, but it's better than an external reference
72
static SrtpCipherMapEntry SrtpCipherMap[] = {
73
{"AES_CM_128_HMAC_SHA1_80", "SRTP_AES128_CM_SHA1_80"},
74
{"AES_CM_128_HMAC_SHA1_32", "SRTP_AES128_CM_SHA1_32"},
79
//////////////////////////////////////////////////////////////////////
81
//////////////////////////////////////////////////////////////////////
83
static int stream_write(BIO* h, const char* buf, int num);
84
static int stream_read(BIO* h, char* buf, int size);
85
static int stream_puts(BIO* h, const char* str);
86
static long stream_ctrl(BIO* h, int cmd, long arg1, void* arg2);
87
static int stream_new(BIO* h);
88
static int stream_free(BIO* data);
90
static BIO_METHOD methods_stream = {
103
static BIO_METHOD* BIO_s_stream() { return(&methods_stream); }
105
static BIO* BIO_new_stream(StreamInterface* stream) {
106
BIO* ret = BIO_new(BIO_s_stream());
113
// bio methods return 1 (or at least non-zero) on success and 0 on failure.
115
static int stream_new(BIO* b) {
118
b->num = 0; // 1 means end-of-stream
123
static int stream_free(BIO* b) {
129
static int stream_read(BIO* b, char* out, int outl) {
132
StreamInterface* stream = static_cast<StreamInterface*>(b->ptr);
133
BIO_clear_retry_flags(b);
136
StreamResult result = stream->Read(out, outl, &read, &error);
137
if (result == SR_SUCCESS) {
139
} else if (result == SR_EOS) {
141
} else if (result == SR_BLOCK) {
142
BIO_set_retry_read(b);
147
static int stream_write(BIO* b, const char* in, int inl) {
150
StreamInterface* stream = static_cast<StreamInterface*>(b->ptr);
151
BIO_clear_retry_flags(b);
154
StreamResult result = stream->Write(in, inl, &written, &error);
155
if (result == SR_SUCCESS) {
157
} else if (result == SR_BLOCK) {
158
BIO_set_retry_write(b);
163
static int stream_puts(BIO* b, const char* str) {
164
return stream_write(b, str, strlen(str));
167
static long stream_ctrl(BIO* b, int cmd, long num, void* ptr) {
176
case BIO_CTRL_WPENDING:
177
case BIO_CTRL_PENDING:
186
/////////////////////////////////////////////////////////////////////////////
187
// OpenSSLStreamAdapter
188
/////////////////////////////////////////////////////////////////////////////
190
OpenSSLStreamAdapter::OpenSSLStreamAdapter(StreamInterface* stream)
191
: SSLStreamAdapter(stream),
194
ssl_read_needs_write_(false), ssl_write_needs_read_(false),
195
ssl_(NULL), ssl_ctx_(NULL),
196
custom_verification_succeeded_(false),
197
ssl_mode_(SSL_MODE_TLS) {
200
OpenSSLStreamAdapter::~OpenSSLStreamAdapter() {
204
void OpenSSLStreamAdapter::SetIdentity(SSLIdentity* identity) {
205
ASSERT(identity_.get() == NULL);
206
identity_.reset(static_cast<OpenSSLIdentity*>(identity));
209
void OpenSSLStreamAdapter::SetServerRole(SSLRole role) {
213
void OpenSSLStreamAdapter::SetPeerCertificate(SSLCertificate* cert) {
214
ASSERT(peer_certificate_.get() == NULL);
215
ASSERT(peer_certificate_digest_algorithm_.empty());
216
ASSERT(ssl_server_name_.empty());
217
peer_certificate_.reset(static_cast<OpenSSLCertificate*>(cert));
220
bool OpenSSLStreamAdapter::SetPeerCertificateDigest(const std::string
225
ASSERT(peer_certificate_.get() == NULL);
226
ASSERT(peer_certificate_digest_algorithm_.size() == 0);
227
ASSERT(ssl_server_name_.empty());
230
if (!OpenSSLDigest::GetDigestSize(digest_alg, &expected_len)) {
231
LOG(LS_WARNING) << "Unknown digest algorithm: " << digest_alg;
234
if (expected_len != digest_len)
237
peer_certificate_digest_value_.SetData(digest_val, digest_len);
238
peer_certificate_digest_algorithm_ = digest_alg;
243
// Key Extractor interface
244
bool OpenSSLStreamAdapter::ExportKeyingMaterial(const std::string& label,
245
const uint8* context,
250
#ifdef HAVE_DTLS_SRTP
253
i = SSL_export_keying_material(ssl_, result, result_len,
254
label.c_str(), label.length(),
255
const_cast<uint8 *>(context),
256
context_len, use_context);
267
bool OpenSSLStreamAdapter::SetDtlsSrtpCiphers(
268
const std::vector<std::string>& ciphers) {
269
std::string internal_ciphers;
271
if (state_ != SSL_NONE)
274
#ifdef HAVE_DTLS_SRTP
275
for (std::vector<std::string>::const_iterator cipher = ciphers.begin();
276
cipher != ciphers.end(); ++cipher) {
278
for (SrtpCipherMapEntry *entry = SrtpCipherMap; entry->internal_name;
280
if (*cipher == entry->external_name) {
282
if (!internal_ciphers.empty())
283
internal_ciphers += ":";
284
internal_ciphers += entry->internal_name;
290
LOG(LS_ERROR) << "Could not find cipher: " << *cipher;
295
if (internal_ciphers.empty())
298
srtp_ciphers_ = internal_ciphers;
305
bool OpenSSLStreamAdapter::GetDtlsSrtpCipher(std::string* cipher) {
306
#ifdef HAVE_DTLS_SRTP
307
ASSERT(state_ == SSL_CONNECTED);
308
if (state_ != SSL_CONNECTED)
311
SRTP_PROTECTION_PROFILE *srtp_profile =
312
SSL_get_selected_srtp_profile(ssl_);
317
for (SrtpCipherMapEntry *entry = SrtpCipherMap;
318
entry->internal_name; ++entry) {
319
if (!strcmp(entry->internal_name, srtp_profile->name)) {
320
*cipher = entry->external_name;
325
ASSERT(false); // This should never happen
333
int OpenSSLStreamAdapter::StartSSLWithServer(const char* server_name) {
334
ASSERT(server_name != NULL && server_name[0] != '\0');
335
ssl_server_name_ = server_name;
339
int OpenSSLStreamAdapter::StartSSLWithPeer() {
340
ASSERT(ssl_server_name_.empty());
341
// It is permitted to specify peer_certificate_ only later.
345
void OpenSSLStreamAdapter::SetMode(SSLMode mode) {
346
ASSERT(state_ == SSL_NONE);
351
// StreamInterface Implementation
354
StreamResult OpenSSLStreamAdapter::Write(const void* data, size_t data_len,
355
size_t* written, int* error) {
356
LOG(LS_INFO) << "OpenSSLStreamAdapter::Write(" << data_len << ")";
360
// pass-through in clear text
361
return StreamAdapterInterface::Write(data, data_len, written, error);
374
*error = ssl_error_code_;
378
// OpenSSL will return an error if we try to write zero bytes
385
ssl_write_needs_read_ = false;
387
int code = SSL_write(ssl_, data, data_len);
388
int ssl_error = SSL_get_error(ssl_, code);
391
LOG(LS_INFO) << " -- success";
392
ASSERT(0 < code && static_cast<unsigned>(code) <= data_len);
396
case SSL_ERROR_WANT_READ:
397
LOG(LS_INFO) << " -- error want read";
398
ssl_write_needs_read_ = true;
400
case SSL_ERROR_WANT_WRITE:
401
LOG(LS_INFO) << " -- error want write";
404
case SSL_ERROR_ZERO_RETURN:
406
Error("SSL_write", (ssl_error ? ssl_error : -1), false);
408
*error = ssl_error_code_;
414
StreamResult OpenSSLStreamAdapter::Read(void* data, size_t data_len,
415
size_t* read, int* error) {
416
LOG(LS_INFO) << "OpenSSLStreamAdapter::Read(" << data_len << ")";
419
// pass-through in clear text
420
return StreamAdapterInterface::Read(data, data_len, read, error);
435
*error = ssl_error_code_;
439
// Don't trust OpenSSL with zero byte reads
446
ssl_read_needs_write_ = false;
448
int code = SSL_read(ssl_, data, data_len);
449
int ssl_error = SSL_get_error(ssl_, code);
452
LOG(LS_INFO) << " -- success";
453
ASSERT(0 < code && static_cast<unsigned>(code) <= data_len);
457
if (ssl_mode_ == SSL_MODE_DTLS) {
458
// Enforce atomic reads -- this is a short read
459
unsigned int pending = SSL_pending(ssl_);
462
LOG(LS_INFO) << " -- short DTLS read. flushing";
465
*error = SSE_MSG_TRUNC;
470
case SSL_ERROR_WANT_READ:
471
LOG(LS_INFO) << " -- error want read";
473
case SSL_ERROR_WANT_WRITE:
474
LOG(LS_INFO) << " -- error want write";
475
ssl_read_needs_write_ = true;
477
case SSL_ERROR_ZERO_RETURN:
478
LOG(LS_INFO) << " -- remote side closed";
482
LOG(LS_INFO) << " -- error " << code;
483
Error("SSL_read", (ssl_error ? ssl_error : -1), false);
485
*error = ssl_error_code_;
491
void OpenSSLStreamAdapter::FlushInput(unsigned int left) {
492
unsigned char buf[2048];
495
// This should always succeed
496
int toread = (sizeof(buf) < left) ? sizeof(buf) : left;
497
int code = SSL_read(ssl_, buf, toread);
499
int ssl_error = SSL_get_error(ssl_, code);
500
ASSERT(ssl_error == SSL_ERROR_NONE);
502
if (ssl_error != SSL_ERROR_NONE) {
503
LOG(LS_INFO) << " -- error " << code;
504
Error("SSL_read", (ssl_error ? ssl_error : -1), false);
507
LOG(LS_INFO) << " -- flushed " << code << " bytes";
512
void OpenSSLStreamAdapter::Close() {
514
ASSERT(state_ == SSL_CLOSED || state_ == SSL_ERROR);
515
StreamAdapterInterface::Close();
518
StreamState OpenSSLStreamAdapter::GetState() const {
531
void OpenSSLStreamAdapter::OnEvent(StreamInterface* stream, int events,
533
int events_to_signal = 0;
534
int signal_error = 0;
535
ASSERT(stream == this->stream());
536
if ((events & SE_OPEN)) {
537
LOG(LS_INFO) << "OpenSSLStreamAdapter::OnEvent SE_OPEN";
538
if (state_ != SSL_WAIT) {
539
ASSERT(state_ == SSL_NONE);
540
events_to_signal |= SE_OPEN;
542
state_ = SSL_CONNECTING;
543
if (int err = BeginSSL()) {
544
Error("BeginSSL", err, true);
549
if ((events & (SE_READ|SE_WRITE))) {
550
LOG(LS_INFO) << "OpenSSLStreamAdapter::OnEvent"
551
<< ((events & SE_READ) ? " SE_READ" : "")
552
<< ((events & SE_WRITE) ? " SE_WRITE" : "");
553
if (state_ == SSL_NONE) {
554
events_to_signal |= events & (SE_READ|SE_WRITE);
555
} else if (state_ == SSL_CONNECTING) {
556
if (int err = ContinueSSL()) {
557
Error("ContinueSSL", err, true);
560
} else if (state_ == SSL_CONNECTED) {
561
if (((events & SE_READ) && ssl_write_needs_read_) ||
562
(events & SE_WRITE)) {
563
LOG(LS_INFO) << " -- onStreamWriteable";
564
events_to_signal |= SE_WRITE;
566
if (((events & SE_WRITE) && ssl_read_needs_write_) ||
567
(events & SE_READ)) {
568
LOG(LS_INFO) << " -- onStreamReadable";
569
events_to_signal |= SE_READ;
573
if ((events & SE_CLOSE)) {
574
LOG(LS_INFO) << "OpenSSLStreamAdapter::OnEvent(SE_CLOSE, " << err << ")";
576
events_to_signal |= SE_CLOSE;
577
// SE_CLOSE is the only event that uses the final parameter to OnEvent().
578
ASSERT(signal_error == 0);
581
if (events_to_signal)
582
StreamAdapterInterface::OnEvent(stream, events_to_signal, signal_error);
585
int OpenSSLStreamAdapter::StartSSL() {
586
ASSERT(state_ == SSL_NONE);
588
if (StreamAdapterInterface::GetState() != SS_OPEN) {
593
state_ = SSL_CONNECTING;
594
if (int err = BeginSSL()) {
595
Error("BeginSSL", err, false);
602
int OpenSSLStreamAdapter::BeginSSL() {
603
ASSERT(state_ == SSL_CONNECTING);
604
// The underlying stream has open. If we are in peer-to-peer mode
605
// then a peer certificate must have been specified by now.
606
ASSERT(!ssl_server_name_.empty() ||
607
peer_certificate_.get() != NULL ||
608
!peer_certificate_digest_algorithm_.empty());
609
LOG(LS_INFO) << "BeginSSL: "
610
<< (!ssl_server_name_.empty() ? ssl_server_name_ :
615
// First set up the context
616
ASSERT(ssl_ctx_ == NULL);
617
ssl_ctx_ = SetupSSLContext();
621
bio = BIO_new_stream(static_cast<StreamInterface*>(stream()));
625
ssl_ = SSL_new(ssl_ctx_);
631
SSL_set_app_data(ssl_, this);
633
SSL_set_bio(ssl_, bio, bio); // the SSL object owns the bio now.
635
SSL_set_mode(ssl_, SSL_MODE_ENABLE_PARTIAL_WRITE |
636
SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
639
return ContinueSSL();
642
int OpenSSLStreamAdapter::ContinueSSL() {
643
LOG(LS_INFO) << "ContinueSSL";
644
ASSERT(state_ == SSL_CONNECTING);
646
// Clear the DTLS timer
647
Thread::Current()->Clear(this, MSG_TIMEOUT);
649
int code = (role_ == SSL_CLIENT) ? SSL_connect(ssl_) : SSL_accept(ssl_);
651
switch (ssl_error = SSL_get_error(ssl_, code)) {
653
LOG(LS_INFO) << " -- success";
655
if (!SSLPostConnectionCheck(ssl_, ssl_server_name_.c_str(),
656
peer_certificate_.get() != NULL
657
? peer_certificate_->x509() : NULL,
658
peer_certificate_digest_algorithm_)) {
659
LOG(LS_ERROR) << "TLS post connection check failed";
663
state_ = SSL_CONNECTED;
664
StreamAdapterInterface::OnEvent(stream(), SE_OPEN|SE_READ|SE_WRITE, 0);
667
case SSL_ERROR_WANT_READ: {
668
LOG(LS_INFO) << " -- error want read";
670
struct timeval timeout;
671
if (DTLSv1_get_timeout(ssl_, &timeout)) {
672
int delay = timeout.tv_sec * 1000 + timeout.tv_usec/1000;
674
Thread::Current()->PostDelayed(delay, this, MSG_TIMEOUT, 0);
680
case SSL_ERROR_WANT_WRITE:
681
LOG(LS_INFO) << " -- error want write";
684
case SSL_ERROR_ZERO_RETURN:
686
LOG(LS_INFO) << " -- error " << code;
687
return (ssl_error != 0) ? ssl_error : -1;
693
void OpenSSLStreamAdapter::Error(const char* context, int err, bool signal) {
694
LOG(LS_WARNING) << "OpenSSLStreamAdapter::Error("
695
<< context << ", " << err << ")";
697
ssl_error_code_ = err;
700
StreamAdapterInterface::OnEvent(stream(), SE_CLOSE, err);
703
void OpenSSLStreamAdapter::Cleanup() {
704
LOG(LS_INFO) << "Cleanup";
706
if (state_ != SSL_ERROR) {
716
SSL_CTX_free(ssl_ctx_);
720
peer_certificate_.reset();
722
// Clear the DTLS timer
723
Thread::Current()->Clear(this, MSG_TIMEOUT);
727
void OpenSSLStreamAdapter::OnMessage(Message* msg) {
728
// Process our own messages and then pass others to the superclass
729
if (MSG_TIMEOUT == msg->message_id) {
730
LOG(LS_INFO) << "DTLS timeout expired";
732
DTLSv1_handle_timeout(ssl_);
736
StreamInterface::OnMessage(msg);
740
SSL_CTX* OpenSSLStreamAdapter::SetupSSLContext() {
743
if (role_ == SSL_CLIENT) {
745
ctx = SSL_CTX_new(ssl_mode_ == SSL_MODE_DTLS ?
746
DTLSv1_client_method() : TLSv1_client_method());
748
ctx = SSL_CTX_new(TLSv1_client_method());
752
ctx = SSL_CTX_new(ssl_mode_ == SSL_MODE_DTLS ?
753
DTLSv1_server_method() : TLSv1_server_method());
755
ctx = SSL_CTX_new(TLSv1_server_method());
761
if (identity_.get() && !identity_->ConfigureIdentity(ctx)) {
766
if (peer_certificate_.get() == NULL) { // traditional mode
767
// Add the root cert to the SSL context
768
if (!OpenSSLAdapter::ConfigureTrustedRootCertificates(ctx)) {
774
if (peer_certificate_.get() != NULL && role_ == SSL_SERVER)
775
// we must specify which client cert to ask for
776
SSL_CTX_add_client_CA(ctx, peer_certificate_->x509());
779
SSL_CTX_set_info_callback(ctx, OpenSSLAdapter::SSLInfoCallback);
782
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER |SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
784
SSL_CTX_set_verify_depth(ctx, 4);
785
SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
787
#ifdef HAVE_DTLS_SRTP
788
if (!srtp_ciphers_.empty()) {
789
if (SSL_CTX_set_tlsext_use_srtp(ctx, srtp_ciphers_.c_str())) {
799
int OpenSSLStreamAdapter::SSLVerifyCallback(int ok, X509_STORE_CTX* store) {
803
X509* cert = X509_STORE_CTX_get_current_cert(store);
804
int depth = X509_STORE_CTX_get_error_depth(store);
805
int err = X509_STORE_CTX_get_error(store);
807
LOG(LS_INFO) << "Error with certificate at depth: " << depth;
808
X509_NAME_oneline(X509_get_issuer_name(cert), data, sizeof(data));
809
LOG(LS_INFO) << " issuer = " << data;
810
X509_NAME_oneline(X509_get_subject_name(cert), data, sizeof(data));
811
LOG(LS_INFO) << " subject = " << data;
812
LOG(LS_INFO) << " err = " << err
813
<< ":" << X509_verify_cert_error_string(err);
817
// Get our SSL structure from the store
818
SSL* ssl = reinterpret_cast<SSL*>(X509_STORE_CTX_get_ex_data(
820
SSL_get_ex_data_X509_STORE_CTX_idx()));
822
OpenSSLStreamAdapter* stream =
823
reinterpret_cast<OpenSSLStreamAdapter*>(SSL_get_app_data(ssl));
825
// In peer-to-peer mode, no root cert / certificate authority was
826
// specified, so the libraries knows of no certificate to accept,
827
// and therefore it will necessarily call here on the first cert it
829
if (!ok && stream->peer_certificate_.get() != NULL) {
830
X509* cert = X509_STORE_CTX_get_current_cert(store);
831
int err = X509_STORE_CTX_get_error(store);
832
// peer-to-peer mode: allow the certificate to be self-signed,
833
// assuming it matches the cert that was specified.
834
if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT &&
835
X509_cmp(cert, stream->peer_certificate_->x509()) == 0) {
836
LOG(LS_INFO) << "Accepted self-signed peer certificate authority";
839
} else if (!ok && !stream->peer_certificate_digest_algorithm_.empty()) {
840
X509* cert = X509_STORE_CTX_get_current_cert(store);
841
int err = X509_STORE_CTX_get_error(store);
843
// peer-to-peer mode: allow the certificate to be self-signed,
844
// assuming it matches the digest that was specified.
845
if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) {
846
unsigned char digest[EVP_MAX_MD_SIZE];
847
std::size_t digest_length;
849
if (OpenSSLCertificate::
851
stream->peer_certificate_digest_algorithm_,
852
digest, sizeof(digest),
854
Buffer computed_digest(digest, digest_length);
855
if (computed_digest == stream->peer_certificate_digest_value_) {
857
"Accepted self-signed peer certificate authority";
862
} else if (!ok && OpenSSLAdapter::custom_verify_callback_) {
863
// this applies only in traditional mode
865
reinterpret_cast<void*>(X509_STORE_CTX_get_current_cert(store));
866
if (OpenSSLAdapter::custom_verify_callback_(cert)) {
867
stream->custom_verification_succeeded_ = true;
868
LOG(LS_INFO) << "validated certificate using custom callback";
873
if (!ok && stream->ignore_bad_cert()) {
874
LOG(LS_WARNING) << "Ignoring cert error while verifying cert chain";
881
// This code is taken from the "Network Security with OpenSSL"
882
// sample in chapter 5
883
bool OpenSSLStreamAdapter::SSLPostConnectionCheck(SSL* ssl,
884
const char* server_name,
885
const X509* peer_cert,
888
ASSERT(server_name != NULL);
890
if (server_name[0] != '\0') { // traditional mode
891
ok = OpenSSLAdapter::VerifyServerName(ssl, server_name, ignore_bad_cert());
894
ok = (SSL_get_verify_result(ssl) == X509_V_OK ||
895
custom_verification_succeeded_);
897
} else { // peer-to-peer mode
898
ASSERT((peer_cert != NULL) || (!peer_digest.empty()));
899
// no server name validation
903
if (!ok && ignore_bad_cert()) {
904
LOG(LS_ERROR) << "SSL_get_verify_result(ssl) = "
905
<< SSL_get_verify_result(ssl);
906
LOG(LS_INFO) << "Other TLS post connection checks failed.";
913
bool OpenSSLStreamAdapter::HaveDtls() {
921
bool OpenSSLStreamAdapter::HaveDtlsSrtp() {
922
#ifdef HAVE_DTLS_SRTP
929
bool OpenSSLStreamAdapter::HaveExporter() {
930
#ifdef HAVE_DTLS_SRTP
937
} // namespace talk_base
939
#endif // HAVE_OPENSSL_SSL_H
added
removed
protocols/jabber/googletalk/libjingle/talk/base/opensslstreamadapter.cc
