libratbox/src/openssl.c

   1 /*
   2  *  libratbox: a library used by ircd-ratbox and other things
   3  *  openssl.c: openssl related code
   4  *
   5  *  Copyright (C) 2007-2008 ircd-ratbox development team
   6  *  Copyright (C) 2007-2008 Aaron Sethman <androsyn@ratbox.org>
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  21  *  USA
  22  *
  23  *  $Id: commio.c 24808 2008-01-02 08:17:05Z androsyn $
  24  */
  25
  26 #include <libratbox_config.h>
  27 #include <ratbox_lib.h>
  28
  29 #ifdef HAVE_OPENSSL
  30
  31 #include <commio-int.h>
  32 #include <commio-ssl.h>
  33 #include <openssl/ssl.h>
  34 #include <openssl/dh.h>
  35 #include <openssl/err.h>
  36 #include <openssl/rand.h>
  37
  38 static SSL_CTX *ssl_server_ctx;
  39 static SSL_CTX *ssl_client_ctx;
  40 static int libratbox_index = -1;
  41
  42 static unsigned long
  43 get_last_err(void)
  44 {
  45         unsigned long t_err, err = 0;
  46         err = ERR_get_error();
  47         if(err == 0)
  48                 return 0;
  49
  50         while((t_err = ERR_get_error()) > 0)
  51                 err = t_err;
  52
  53         return err;
  54 }
  55
  56 void
  57 rb_ssl_shutdown(rb_fde_t *F)
  58 {
  59         int i;
  60         if(F == NULL || F->ssl == NULL)
  61                 return;
  62         SSL_set_shutdown((SSL *) F->ssl, SSL_RECEIVED_SHUTDOWN);
  63
  64         for(i = 0; i < 4; i++)
  65         {
  66                 if(SSL_shutdown((SSL *) F->ssl))
  67                         break;
  68         }
  69         get_last_err();
  70         SSL_free((SSL *) F->ssl);
  71 }
  72
  73 unsigned int
  74 rb_ssl_handshake_count(rb_fde_t *F)
  75 {
  76         return F->handshake_count;
  77 }
  78
  79 void
  80 rb_ssl_clear_handshake_count(rb_fde_t *F)
  81 {
  82         F->handshake_count = 0;
  83 }
  84
  85 static void
  86 rb_ssl_timeout(rb_fde_t *F, void *notused)
  87 {
  88         lrb_assert(F->accept != NULL);
  89         F->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);
  90 }
  91
  92
  93 static void
  94 rb_ssl_info_callback(SSL * ssl, int where, int ret)
  95 {
  96         if(where & SSL_CB_HANDSHAKE_START)
  97         {
  98                 rb_fde_t *F = SSL_get_ex_data(ssl, libratbox_index);
  99                 if(F == NULL)
 100                         return;
 101                 F->handshake_count++;
 102         }
 103 }
 104
 105 static void
 106 rb_setup_ssl_cb(rb_fde_t *F)
 107 {
 108         SSL_set_ex_data(F->ssl, libratbox_index, (char *)F);
 109         SSL_set_info_callback((SSL *) F->ssl, (void (*)(const SSL *,int,int))rb_ssl_info_callback);
 110 }
 111
 112 static void
 113 rb_ssl_tryaccept(rb_fde_t *F, void *data)
 114 {
 115         int ssl_err;
 116         lrb_assert(F->accept != NULL);
 117         int flags;
 118         struct acceptdata *ad;
 119
 120         if(!SSL_is_init_finished((SSL *) F->ssl))
 121         {
 122                 if((ssl_err = SSL_accept((SSL *) F->ssl)) <= 0)
 123                 {
 124                         switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 125                         {
 126                         case SSL_ERROR_WANT_READ:
 127                         case SSL_ERROR_WANT_WRITE:
 128                                 if(ssl_err == SSL_ERROR_WANT_WRITE)
 129                                         flags = RB_SELECT_WRITE;
 130                                 else
 131                                         flags = RB_SELECT_READ;
 132                                 F->ssl_errno = get_last_err();
 133                                 rb_setselect(F, flags, rb_ssl_tryaccept, NULL);
 134                                 break;
 135                         case SSL_ERROR_SYSCALL:
 136                                 F->accept->callback(F, RB_ERROR, NULL, 0, F->accept->data);
 137                                 break;
 138                         default:
 139                                 F->ssl_errno = get_last_err();
 140                                 F->accept->callback(F, RB_ERROR_SSL, NULL, 0, F->accept->data);
 141                                 break;
 142                         }
 143                         return;
 144                 }
 145         }
 146         rb_settimeout(F, 0, NULL, NULL);
 147         rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE, NULL, NULL);
 148
 149         ad = F->accept;
 150         F->accept = NULL;
 151         ad->callback(F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
 152         rb_free(ad);
 153
 154 }
 155
 156
 157 static void
 158 rb_ssl_accept_common(rb_fde_t *new_F)
 159 {
 160         int ssl_err;
 161         if((ssl_err = SSL_accept((SSL *) new_F->ssl)) <= 0)
 162         {
 163                 switch (ssl_err = SSL_get_error((SSL *) new_F->ssl, ssl_err))
 164                 {
 165                 case SSL_ERROR_SYSCALL:
 166                         if(rb_ignore_errno(errno))
 167                 case SSL_ERROR_WANT_READ:
 168                 case SSL_ERROR_WANT_WRITE:
 169                                 {
 170                                         new_F->ssl_errno = get_last_err();
 171                                         rb_setselect(new_F, RB_SELECT_READ | RB_SELECT_WRITE,
 172                                                      rb_ssl_tryaccept, NULL);
 173                                         return;
 174                                 }
 175                 default:
 176                         new_F->ssl_errno = get_last_err();
 177                         new_F->accept->callback(new_F, RB_ERROR_SSL, NULL, 0, new_F->accept->data);
 178                         return;
 179                 }
 180         }
 181         else
 182         {
 183                 rb_ssl_tryaccept(new_F, NULL);
 184         }
 185 }
 186
 187 void
 188 rb_ssl_start_accepted(rb_fde_t *new_F, ACCB * cb, void *data, int timeout)
 189 {
 190         new_F->type |= RB_FD_SSL;
 191         new_F->ssl = SSL_new(ssl_server_ctx);
 192         new_F->accept = rb_malloc(sizeof(struct acceptdata));
 193
 194         new_F->accept->callback = cb;
 195         new_F->accept->data = data;
 196         rb_settimeout(new_F, timeout, rb_ssl_timeout, NULL);
 197
 198         new_F->accept->addrlen = 0;
 199         SSL_set_fd((SSL *) new_F->ssl, rb_get_fd(new_F));
 200         rb_setup_ssl_cb(new_F);
 201         rb_ssl_accept_common(new_F);
 202 }
 203
 204
 205
 206
 207 void
 208 rb_ssl_accept_setup(rb_fde_t *F, rb_fde_t *new_F, struct sockaddr *st, int addrlen)
 209 {
 210         new_F->type |= RB_FD_SSL;
 211         new_F->ssl = SSL_new(ssl_server_ctx);
 212         new_F->accept = rb_malloc(sizeof(struct acceptdata));
 213
 214         new_F->accept->callback = F->accept->callback;
 215         new_F->accept->data = F->accept->data;
 216         rb_settimeout(new_F, 10, rb_ssl_timeout, NULL);
 217         memcpy(&new_F->accept->S, st, addrlen);
 218         new_F->accept->addrlen = addrlen;
 219
 220         SSL_set_fd((SSL *) new_F->ssl, rb_get_fd(new_F));
 221         rb_setup_ssl_cb(new_F);
 222         rb_ssl_accept_common(new_F);
 223 }
 224
 225 static ssize_t
 226 rb_ssl_read_or_write(int r_or_w, rb_fde_t *F, void *rbuf, const void *wbuf, size_t count)
 227 {
 228         ssize_t ret;
 229         unsigned long err;
 230         SSL *ssl = F->ssl;
 231
 232         if(r_or_w == 0)
 233                 ret = (ssize_t) SSL_read(ssl, rbuf, (int)count);
 234         else
 235                 ret = (ssize_t) SSL_write(ssl, wbuf, (int)count);
 236
 237         if(ret < 0)
 238         {
 239                 switch (SSL_get_error(ssl, ret))
 240                 {
 241                 case SSL_ERROR_WANT_READ:
 242                         errno = EAGAIN;
 243                         return RB_RW_SSL_NEED_READ;
 244                 case SSL_ERROR_WANT_WRITE:
 245                         errno = EAGAIN;
 246                         return RB_RW_SSL_NEED_WRITE;
 247                 case SSL_ERROR_ZERO_RETURN:
 248                         return 0;
 249                 case SSL_ERROR_SYSCALL:
 250                         err = get_last_err();
 251                         if(err == 0)
 252                         {
 253                                 F->ssl_errno = 0;
 254                                 return RB_RW_IO_ERROR;
 255                         }
 256                         break;
 257                 default:
 258                         err = get_last_err();
 259                         break;
 260                 }
 261                 F->ssl_errno = err;
 262                 if(err > 0)
 263                 {
 264                         errno = EIO;    /* not great but... */
 265                         return RB_RW_SSL_ERROR;
 266                 }
 267                 return RB_RW_IO_ERROR;
 268         }
 269         return ret;
 270 }
 271
 272 ssize_t
 273 rb_ssl_read(rb_fde_t *F, void *buf, size_t count)
 274 {
 275         return rb_ssl_read_or_write(0, F, buf, NULL, count);
 276 }
 277
 278 ssize_t
 279 rb_ssl_write(rb_fde_t *F, const void *buf, size_t count)
 280 {
 281         return rb_ssl_read_or_write(1, F, NULL, buf, count);
 282 }
 283
 284 static int
 285 verify_accept_all_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
 286 {
 287         return 1;
 288 }
 289
 290 static const char *
 291 get_ssl_error(unsigned long err)
 292 {
 293         static char buf[512];
 294
 295         ERR_error_string_n(err, buf, sizeof buf);
 296         return buf;
 297 }
 298
 299 int
 300 rb_init_ssl(void)
 301 {
 302         int ret = 1;
 303         char libratbox_data[] = "libratbox data";
 304         SSL_load_error_strings();
 305         SSL_library_init();
 306         libratbox_index = SSL_get_ex_new_index(0, libratbox_data, NULL, NULL, NULL);
 307         ssl_server_ctx = SSL_CTX_new(SSLv23_server_method());
 308         if(ssl_server_ctx == NULL)
 309         {
 310                 rb_lib_log("rb_init_openssl: Unable to initialize OpenSSL server context: %s",
 311                            get_ssl_error(ERR_get_error()));
 312                 ret = 0;
 313         }
 314         /* Disable SSLv2, make the client use our settings */
 315         SSL_CTX_set_options(ssl_server_ctx, SSL_OP_NO_SSLv2 | SSL_OP_CIPHER_SERVER_PREFERENCE);
 316         SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_accept_all_cb);
 317
 318         /* Set ECDHE on OpenSSL 1.00+ */
 319         if (OPENSSL_VERSION_NUMBER >= 0x10000000) {
 320                 SSL_CTX_set_tmp_ecdh(ssl_server_ctx, EC_KEY_new_by_curve_name(NID_secp384r1));
 321         }
 322
 323         ssl_client_ctx = SSL_CTX_new(TLSv1_client_method());
 324
 325         if(ssl_client_ctx == NULL)
 326         {
 327                 rb_lib_log("rb_init_openssl: Unable to initialize OpenSSL client context: %s",
 328                            get_ssl_error(ERR_get_error()));
 329                 ret = 0;
 330         }
 331         return ret;
 332 }
 333
 334
 335 int
 336 rb_setup_ssl_server(const char *cert, const char *keyfile, const char *dhfile)
 337 {
 338         DH *dh;
 339         unsigned long err;
 340         if(cert == NULL)
 341         {
 342                 rb_lib_log("rb_setup_ssl_server: No certificate file");
 343                 return 0;
 344         }
 345         if(!SSL_CTX_use_certificate_chain_file(ssl_server_ctx, cert) || !SSL_CTX_use_certificate_chain_file(ssl_client_ctx, cert))
 346         {
 347                 err = ERR_get_error();
 348                 rb_lib_log("rb_setup_ssl_server: Error loading certificate file [%s]: %s", cert,
 349                            get_ssl_error(err));
 350                 return 0;
 351         }
 352
 353         if(keyfile == NULL)
 354         {
 355                 rb_lib_log("rb_setup_ssl_server: No key file");
 356                 return 0;
 357         }
 358
 359
 360         if(!SSL_CTX_use_PrivateKey_file(ssl_server_ctx, keyfile, SSL_FILETYPE_PEM) || !SSL_CTX_use_PrivateKey_file(ssl_client_ctx, keyfile, SSL_FILETYPE_PEM))
 361         {
 362                 err = ERR_get_error();
 363                 rb_lib_log("rb_setup_ssl_server: Error loading keyfile [%s]: %s", keyfile,
 364                            get_ssl_error(err));
 365                 return 0;
 366         }
 367
 368         if(dhfile != NULL)
 369         {
 370                 /* DH parameters aren't necessary, but they are nice..if they didn't pass one..that is their problem */
 371                 BIO *bio = BIO_new_file(dhfile, "r");
 372                 if(bio != NULL)
 373                 {
 374                         dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
 375                         if(dh == NULL)
 376                         {
 377                                 err = ERR_get_error();
 378                                 rb_lib_log
 379                                         ("rb_setup_ssl_server: Error loading DH params file [%s]: %s",
 380                                          dhfile, get_ssl_error(err));
 381                                 BIO_free(bio);
 382                                 return 0;
 383                         }
 384                         BIO_free(bio);
 385                         SSL_CTX_set_tmp_dh(ssl_server_ctx, dh);
 386                 }
 387                 else
 388                 {
 389                         err = ERR_get_error();
 390                         rb_lib_log("rb_setup_ssl_server: Error loading DH params file [%s]: %s",
 391                                    dhfile, get_ssl_error(err));
 392                 }
 393         }
 394         return 1;
 395 }
 396
 397 int
 398 rb_ssl_listen(rb_fde_t *F, int backlog, int defer_accept)
 399 {
 400         int result;
 401
 402         result = rb_listen(F, backlog, defer_accept);
 403         F->type = RB_FD_SOCKET | RB_FD_LISTEN | RB_FD_SSL;
 404
 405         return result;
 406 }
 407
 408 struct ssl_connect
 409 {
 410         CNCB *callback;
 411         void *data;
 412         int timeout;
 413 };
 414
 415 static void
 416 rb_ssl_connect_realcb(rb_fde_t *F, int status, struct ssl_connect *sconn)
 417 {
 418         F->connect->callback = sconn->callback;
 419         F->connect->data = sconn->data;
 420         rb_free(sconn);
 421         rb_connect_callback(F, status);
 422 }
 423
 424 static void
 425 rb_ssl_tryconn_timeout_cb(rb_fde_t *F, void *data)
 426 {
 427         rb_ssl_connect_realcb(F, RB_ERR_TIMEOUT, data);
 428 }
 429
 430 static void
 431 rb_ssl_tryconn_cb(rb_fde_t *F, void *data)
 432 {
 433         struct ssl_connect *sconn = data;
 434         int ssl_err;
 435         if(!SSL_is_init_finished((SSL *) F->ssl))
 436         {
 437                 if((ssl_err = SSL_connect((SSL *) F->ssl)) <= 0)
 438                 {
 439                         switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 440                         {
 441                         case SSL_ERROR_SYSCALL:
 442                                 if(rb_ignore_errno(errno))
 443                         case SSL_ERROR_WANT_READ:
 444                         case SSL_ERROR_WANT_WRITE:
 445                                         {
 446                                                 F->ssl_errno = get_last_err();
 447                                                 rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE,
 448                                                              rb_ssl_tryconn_cb, sconn);
 449                                                 return;
 450                                         }
 451                         default:
 452                                 F->ssl_errno = get_last_err();
 453                                 rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
 454                                 return;
 455                         }
 456                 }
 457                 else
 458                 {
 459                         rb_ssl_connect_realcb(F, RB_OK, sconn);
 460                 }
 461         }
 462 }
 463
 464 static void
 465 rb_ssl_tryconn(rb_fde_t *F, int status, void *data)
 466 {
 467         struct ssl_connect *sconn = data;
 468         int ssl_err;
 469         if(status != RB_OK)
 470         {
 471                 rb_ssl_connect_realcb(F, status, sconn);
 472                 return;
 473         }
 474
 475         F->type |= RB_FD_SSL;
 476         F->ssl = SSL_new(ssl_client_ctx);
 477         SSL_set_fd((SSL *) F->ssl, F->fd);
 478         rb_setup_ssl_cb(F);
 479         rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
 480         if((ssl_err = SSL_connect((SSL *) F->ssl)) <= 0)
 481         {
 482                 switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 483                 {
 484                 case SSL_ERROR_SYSCALL:
 485                         if(rb_ignore_errno(errno))
 486                 case SSL_ERROR_WANT_READ:
 487                 case SSL_ERROR_WANT_WRITE:
 488                                 {
 489                                         F->ssl_errno = get_last_err();
 490                                         rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE,
 491                                                      rb_ssl_tryconn_cb, sconn);
 492                                         return;
 493                                 }
 494                 default:
 495                         F->ssl_errno = get_last_err();
 496                         rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
 497                         return;
 498                 }
 499         }
 500         else
 501         {
 502                 rb_ssl_connect_realcb(F, RB_OK, sconn);
 503         }
 504 }
 505
 506 void
 507 rb_connect_tcp_ssl(rb_fde_t *F, struct sockaddr *dest,
 508                    struct sockaddr *clocal, int socklen, CNCB * callback, void *data, int timeout)
 509 {
 510         struct ssl_connect *sconn;
 511         if(F == NULL)
 512                 return;
 513
 514         sconn = rb_malloc(sizeof(struct ssl_connect));
 515         sconn->data = data;
 516         sconn->callback = callback;
 517         sconn->timeout = timeout;
 518         rb_connect_tcp(F, dest, clocal, socklen, rb_ssl_tryconn, sconn, timeout);
 519
 520 }
 521
 522 void
 523 rb_ssl_start_connected(rb_fde_t *F, CNCB * callback, void *data, int timeout)
 524 {
 525         struct ssl_connect *sconn;
 526         int ssl_err;
 527         if(F == NULL)
 528                 return;
 529
 530         sconn = rb_malloc(sizeof(struct ssl_connect));
 531         sconn->data = data;
 532         sconn->callback = callback;
 533         sconn->timeout = timeout;
 534         F->connect = rb_malloc(sizeof(struct conndata));
 535         F->connect->callback = callback;
 536         F->connect->data = data;
 537         F->type |= RB_FD_SSL;
 538         F->ssl = SSL_new(ssl_client_ctx);
 539
 540         SSL_set_fd((SSL *) F->ssl, F->fd);
 541         rb_setup_ssl_cb(F);
 542         rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
 543         if((ssl_err = SSL_connect((SSL *) F->ssl)) <= 0)
 544         {
 545                 switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 546                 {
 547                 case SSL_ERROR_SYSCALL:
 548                         if(rb_ignore_errno(errno))
 549                 case SSL_ERROR_WANT_READ:
 550                 case SSL_ERROR_WANT_WRITE:
 551                                 {
 552                                         F->ssl_errno = get_last_err();
 553                                         rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE,
 554                                                      rb_ssl_tryconn_cb, sconn);
 555                                         return;
 556                                 }
 557                 default:
 558                         F->ssl_errno = get_last_err();
 559                         rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
 560                         return;
 561                 }
 562         }
 563         else
 564         {
 565                 rb_ssl_connect_realcb(F, RB_OK, sconn);
 566         }
 567 }
 568
 569 int
 570 rb_init_prng(const char *path, prng_seed_t seed_type)
 571 {
 572         if(seed_type == RB_PRNG_DEFAULT)
 573         {
 574 #ifdef _WIN32
 575                 RAND_screen();
 576 #endif
 577                 return RAND_status();
 578         }
 579         if(path == NULL)
 580                 return RAND_status();
 581
 582         switch (seed_type)
 583         {
 584         case RB_PRNG_EGD:
 585                 if(RAND_egd(path) == -1)
 586                         return -1;
 587                 break;
 588         case RB_PRNG_FILE:
 589                 if(RAND_load_file(path, -1) == -1)
 590                         return -1;
 591                 break;
 592 #ifdef _WIN32
 593         case RB_PRNGWIN32:
 594                 RAND_screen();
 595                 break;
 596 #endif
 597         default:
 598                 return -1;
 599         }
 600
 601         return RAND_status();
 602 }
 603
 604 int
 605 rb_get_random(void *buf, size_t length)
 606 {
 607         int ret;
 608
 609         if((ret = RAND_bytes(buf, length)) == 0)
 610         {
 611                 /* remove the error from the queue */
 612                 ERR_get_error();
 613         }
 614         return ret;
 615 }
 616
 617 int
 618 rb_get_pseudo_random(void *buf, size_t length)
 619 {
 620         int ret;
 621         ret = RAND_pseudo_bytes(buf, length);
 622         if(ret < 0)
 623                 return 0;
 624         return 1;
 625 }
 626
 627 const char *
 628 rb_get_ssl_strerror(rb_fde_t *F)
 629 {
 630         return get_ssl_error(F->ssl_errno);
 631 }
 632
 633 int
 634 rb_get_ssl_certfp(rb_fde_t *F, uint8_t certfp[RB_SSL_CERTFP_LEN])
 635 {
 636         X509 *cert;
 637         int res;
 638
 639         if (F->ssl == NULL)
 640                 return 0;
 641
 642         cert = SSL_get_peer_certificate((SSL *) F->ssl);
 643         if(cert != NULL)
 644         {
 645                 res = SSL_get_verify_result((SSL *) F->ssl);
 646                 if(res == X509_V_OK ||
 647                                 res == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN ||
 648                                 res == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE ||
 649                                 res == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
 650                 {
 651                         memcpy(certfp, cert->sha1_hash, RB_SSL_CERTFP_LEN);
 652                         X509_free(cert);
 653                         return 1;
 654                 }
 655                 X509_free(cert);
 656         }
 657
 658         return 0;
 659 }
 660
 661 int
 662 rb_supports_ssl(void)
 663 {
 664         return 1;
 665 }
 666
 667 void
 668 rb_get_ssl_info(char *buf, size_t len)
 669 {
 670         rb_snprintf(buf, len, "Using SSL: %s compiled: 0x%lx, library 0x%lx",
 671                     SSLeay_version(SSLEAY_VERSION),
 672                     (long)OPENSSL_VERSION_NUMBER, SSLeay());
 673 }
 674
 675
 676 #endif /* HAVE_OPESSL */