libratbox/src/openssl.c

   1 /*
   2  *  libratbox: a library used by ircd-ratbox and other things
   3  *  openssl.c: openssl related code
   4  *
   5  *  Copyright (C) 2007-2008 ircd-ratbox development team
   6  *  Copyright (C) 2007-2008 Aaron Sethman <androsyn@ratbox.org>
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
  21  *  USA
  22  *
  23  *  $Id: commio.c 24808 2008-01-02 08:17:05Z androsyn $
  24  */
  25
  26 #include <libratbox_config.h>
  27 #include <ratbox_lib.h>
  28
  29 #ifdef HAVE_OPENSSL
  30
  31 #include <commio-int.h>
  32 #include <commio-ssl.h>
  33 #include <openssl/ssl.h>
  34 #include <openssl/dh.h>
  35 #include <openssl/err.h>
  36 #include <openssl/rand.h>
  37
  38 static SSL_CTX *ssl_server_ctx;
  39 static SSL_CTX *ssl_client_ctx;
  40 static int libratbox_index = -1;
  41
  42 static unsigned long
  43 get_last_err(void)
  44 {
  45         unsigned long t_err, err = 0;
  46         err = ERR_get_error();
  47         if(err == 0)
  48                 return 0;
  49
  50         while((t_err = ERR_get_error()) > 0)
  51                 err = t_err;
  52
  53         return err;
  54 }
  55
  56 void
  57 rb_ssl_shutdown(rb_fde_t *F)
  58 {
  59         int i;
  60         if(F == NULL || F->ssl == NULL)
  61                 return;
  62         SSL_set_shutdown((SSL *) F->ssl, SSL_RECEIVED_SHUTDOWN);
  63
  64         for(i = 0; i < 4; i++)
  65         {
  66                 if(SSL_shutdown((SSL *) F->ssl))
  67                         break;
  68         }
  69         get_last_err();
  70         SSL_free((SSL *) F->ssl);
  71 }
  72
  73 unsigned int
  74 rb_ssl_handshake_count(rb_fde_t *F)
  75 {
  76         return F->handshake_count;
  77 }
  78
  79 void
  80 rb_ssl_clear_handshake_count(rb_fde_t *F)
  81 {
  82         F->handshake_count = 0;
  83 }
  84
  85 static void
  86 rb_ssl_timeout(rb_fde_t *F, void *notused)
  87 {
  88         lrb_assert(F->accept != NULL);
  89         F->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);
  90 }
  91
  92
  93 static void
  94 rb_ssl_info_callback(SSL * ssl, int where, int ret)
  95 {
  96         if(where & SSL_CB_HANDSHAKE_START)
  97         {
  98                 rb_fde_t *F = SSL_get_ex_data(ssl, libratbox_index);
  99                 if(F == NULL)
 100                         return;
 101                 F->handshake_count++;
 102         }
 103 }
 104
 105 static void
 106 rb_setup_ssl_cb(rb_fde_t *F)
 107 {
 108         SSL_set_ex_data(F->ssl, libratbox_index, (char *)F);
 109         SSL_set_info_callback((SSL *) F->ssl, (void (*)(const SSL *,int,int))rb_ssl_info_callback);
 110 }
 111
 112 static void
 113 rb_ssl_tryaccept(rb_fde_t *F, void *data)
 114 {
 115         int ssl_err;
 116         lrb_assert(F->accept != NULL);
 117         int flags;
 118         struct acceptdata *ad;
 119
 120         if(!SSL_is_init_finished((SSL *) F->ssl))
 121         {
 122                 if((ssl_err = SSL_accept((SSL *) F->ssl)) <= 0)
 123                 {
 124                         switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 125                         {
 126                         case SSL_ERROR_WANT_READ:
 127                         case SSL_ERROR_WANT_WRITE:
 128                                 if(ssl_err == SSL_ERROR_WANT_WRITE)
 129                                         flags = RB_SELECT_WRITE;
 130                                 else
 131                                         flags = RB_SELECT_READ;
 132                                 F->ssl_errno = get_last_err();
 133                                 rb_setselect(F, flags, rb_ssl_tryaccept, NULL);
 134                                 break;
 135                         case SSL_ERROR_SYSCALL:
 136                                 F->accept->callback(F, RB_ERROR, NULL, 0, F->accept->data);
 137                                 break;
 138                         default:
 139                                 F->ssl_errno = get_last_err();
 140                                 F->accept->callback(F, RB_ERROR_SSL, NULL, 0, F->accept->data);
 141                                 break;
 142                         }
 143                         return;
 144                 }
 145         }
 146         rb_settimeout(F, 0, NULL, NULL);
 147         rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE, NULL, NULL);
 148
 149         ad = F->accept;
 150         F->accept = NULL;
 151         ad->callback(F, RB_OK, (struct sockaddr *)&ad->S, ad->addrlen, ad->data);
 152         rb_free(ad);
 153
 154 }
 155
 156
 157 static void
 158 rb_ssl_accept_common(rb_fde_t *new_F)
 159 {
 160         int ssl_err;
 161         if((ssl_err = SSL_accept((SSL *) new_F->ssl)) <= 0)
 162         {
 163                 switch (ssl_err = SSL_get_error((SSL *) new_F->ssl, ssl_err))
 164                 {
 165                 case SSL_ERROR_SYSCALL:
 166                         if(rb_ignore_errno(errno))
 167                 case SSL_ERROR_WANT_READ:
 168                 case SSL_ERROR_WANT_WRITE:
 169                                 {
 170                                         new_F->ssl_errno = get_last_err();
 171                                         rb_setselect(new_F, RB_SELECT_READ | RB_SELECT_WRITE,
 172                                                      rb_ssl_tryaccept, NULL);
 173                                         return;
 174                                 }
 175                 default:
 176                         new_F->ssl_errno = get_last_err();
 177                         new_F->accept->callback(new_F, RB_ERROR_SSL, NULL, 0, new_F->accept->data);
 178                         return;
 179                 }
 180         }
 181         else
 182         {
 183                 rb_ssl_tryaccept(new_F, NULL);
 184         }
 185 }
 186
 187 void
 188 rb_ssl_start_accepted(rb_fde_t *new_F, ACCB * cb, void *data, int timeout)
 189 {
 190         new_F->type |= RB_FD_SSL;
 191         new_F->ssl = SSL_new(ssl_server_ctx);
 192         new_F->accept = rb_malloc(sizeof(struct acceptdata));
 193
 194         new_F->accept->callback = cb;
 195         new_F->accept->data = data;
 196         rb_settimeout(new_F, timeout, rb_ssl_timeout, NULL);
 197
 198         new_F->accept->addrlen = 0;
 199         SSL_set_fd((SSL *) new_F->ssl, rb_get_fd(new_F));
 200         rb_setup_ssl_cb(new_F);
 201         rb_ssl_accept_common(new_F);
 202 }
 203
 204
 205
 206
 207 void
 208 rb_ssl_accept_setup(rb_fde_t *F, rb_fde_t *new_F, struct sockaddr *st, int addrlen)
 209 {
 210         new_F->type |= RB_FD_SSL;
 211         new_F->ssl = SSL_new(ssl_server_ctx);
 212         new_F->accept = rb_malloc(sizeof(struct acceptdata));
 213
 214         new_F->accept->callback = F->accept->callback;
 215         new_F->accept->data = F->accept->data;
 216         rb_settimeout(new_F, 10, rb_ssl_timeout, NULL);
 217         memcpy(&new_F->accept->S, st, addrlen);
 218         new_F->accept->addrlen = addrlen;
 219
 220         SSL_set_fd((SSL *) new_F->ssl, rb_get_fd(new_F));
 221         rb_setup_ssl_cb(new_F);
 222         rb_ssl_accept_common(new_F);
 223 }
 224
 225 static ssize_t
 226 rb_ssl_read_or_write(int r_or_w, rb_fde_t *F, void *rbuf, const void *wbuf, size_t count)
 227 {
 228         ssize_t ret;
 229         unsigned long err;
 230         SSL *ssl = F->ssl;
 231
 232         if(r_or_w == 0)
 233                 ret = (ssize_t) SSL_read(ssl, rbuf, (int)count);
 234         else
 235                 ret = (ssize_t) SSL_write(ssl, wbuf, (int)count);
 236
 237         if(ret < 0)
 238         {
 239                 switch (SSL_get_error(ssl, ret))
 240                 {
 241                 case SSL_ERROR_WANT_READ:
 242                         errno = EAGAIN;
 243                         return RB_RW_SSL_NEED_READ;
 244                 case SSL_ERROR_WANT_WRITE:
 245                         errno = EAGAIN;
 246                         return RB_RW_SSL_NEED_WRITE;
 247                 case SSL_ERROR_ZERO_RETURN:
 248                         return 0;
 249                 case SSL_ERROR_SYSCALL:
 250                         err = get_last_err();
 251                         if(err == 0)
 252                         {
 253                                 F->ssl_errno = 0;
 254                                 return RB_RW_IO_ERROR;
 255                         }
 256                         break;
 257                 default:
 258                         err = get_last_err();
 259                         break;
 260                 }
 261                 F->ssl_errno = err;
 262                 if(err > 0)
 263                 {
 264                         errno = EIO;    /* not great but... */
 265                         return RB_RW_SSL_ERROR;
 266                 }
 267                 return RB_RW_IO_ERROR;
 268         }
 269         return ret;
 270 }
 271
 272 ssize_t
 273 rb_ssl_read(rb_fde_t *F, void *buf, size_t count)
 274 {
 275         return rb_ssl_read_or_write(0, F, buf, NULL, count);
 276 }
 277
 278 ssize_t
 279 rb_ssl_write(rb_fde_t *F, const void *buf, size_t count)
 280 {
 281         return rb_ssl_read_or_write(1, F, NULL, buf, count);
 282 }
 283
 284 static int
 285 verify_accept_all_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
 286 {
 287         return 1;
 288 }
 289
 290 static const char *
 291 get_ssl_error(unsigned long err)
 292 {
 293         static char buf[512];
 294
 295         ERR_error_string_n(err, buf, sizeof buf);
 296         return buf;
 297 }
 298
 299 int
 300 rb_init_ssl(void)
 301 {
 302         int ret = 1;
 303         char libratbox_data[] = "libratbox data";
 304         SSL_load_error_strings();
 305         SSL_library_init();
 306         libratbox_index = SSL_get_ex_new_index(0, libratbox_data, NULL, NULL, NULL);
 307         ssl_server_ctx = SSL_CTX_new(SSLv23_server_method());
 308         if(ssl_server_ctx == NULL)
 309         {
 310                 rb_lib_log("rb_init_openssl: Unable to initialize OpenSSL server context: %s",
 311                            get_ssl_error(ERR_get_error()));
 312                 ret = 0;
 313         }
 314         /* Disable SSLv2, make the client use our settings */
 315         SSL_CTX_set_options(ssl_server_ctx, SSL_OP_NO_SSLv2 | SSL_OP_CIPHER_SERVER_PREFERENCE);
 316         SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_accept_all_cb);
 317
 318         /* Set ECDHE on OpenSSL 1.00+, but make sure it's actually available because redhat are dicks
 319            and bastardise their OpenSSL for stupid reasons... */
 320         #if (OPENSSL_VERSION_NUMBER >= 0x10000000) && defined(NID_secp384r1)
 321                 SSL_CTX_set_tmp_ecdh(ssl_server_ctx, EC_KEY_new_by_curve_name(NID_secp384r1));
 322         #endif
 323
 324         ssl_client_ctx = SSL_CTX_new(TLSv1_client_method());
 325
 326         if(ssl_client_ctx == NULL)
 327         {
 328                 rb_lib_log("rb_init_openssl: Unable to initialize OpenSSL client context: %s",
 329                            get_ssl_error(ERR_get_error()));
 330                 ret = 0;
 331         }
 332         return ret;
 333 }
 334
 335
 336 int
 337 rb_setup_ssl_server(const char *cert, const char *keyfile, const char *dhfile)
 338 {
 339         DH *dh;
 340         unsigned long err;
 341         if(cert == NULL)
 342         {
 343                 rb_lib_log("rb_setup_ssl_server: No certificate file");
 344                 return 0;
 345         }
 346         if(!SSL_CTX_use_certificate_chain_file(ssl_server_ctx, cert) || !SSL_CTX_use_certificate_chain_file(ssl_client_ctx, cert))
 347         {
 348                 err = ERR_get_error();
 349                 rb_lib_log("rb_setup_ssl_server: Error loading certificate file [%s]: %s", cert,
 350                            get_ssl_error(err));
 351                 return 0;
 352         }
 353
 354         if(keyfile == NULL)
 355         {
 356                 rb_lib_log("rb_setup_ssl_server: No key file");
 357                 return 0;
 358         }
 359
 360
 361         if(!SSL_CTX_use_PrivateKey_file(ssl_server_ctx, keyfile, SSL_FILETYPE_PEM) || !SSL_CTX_use_PrivateKey_file(ssl_client_ctx, keyfile, SSL_FILETYPE_PEM))
 362         {
 363                 err = ERR_get_error();
 364                 rb_lib_log("rb_setup_ssl_server: Error loading keyfile [%s]: %s", keyfile,
 365                            get_ssl_error(err));
 366                 return 0;
 367         }
 368
 369         if(dhfile != NULL)
 370         {
 371                 /* DH parameters aren't necessary, but they are nice..if they didn't pass one..that is their problem */
 372                 BIO *bio = BIO_new_file(dhfile, "r");
 373                 if(bio != NULL)
 374                 {
 375                         dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
 376                         if(dh == NULL)
 377                         {
 378                                 err = ERR_get_error();
 379                                 rb_lib_log
 380                                         ("rb_setup_ssl_server: Error loading DH params file [%s]: %s",
 381                                          dhfile, get_ssl_error(err));
 382                                 BIO_free(bio);
 383                                 return 0;
 384                         }
 385                         BIO_free(bio);
 386                         SSL_CTX_set_tmp_dh(ssl_server_ctx, dh);
 387                 }
 388                 else
 389                 {
 390                         err = ERR_get_error();
 391                         rb_lib_log("rb_setup_ssl_server: Error loading DH params file [%s]: %s",
 392                                    dhfile, get_ssl_error(err));
 393                 }
 394         }
 395         return 1;
 396 }
 397
 398 int
 399 rb_ssl_listen(rb_fde_t *F, int backlog, int defer_accept)
 400 {
 401         int result;
 402
 403         result = rb_listen(F, backlog, defer_accept);
 404         F->type = RB_FD_SOCKET | RB_FD_LISTEN | RB_FD_SSL;
 405
 406         return result;
 407 }
 408
 409 struct ssl_connect
 410 {
 411         CNCB *callback;
 412         void *data;
 413         int timeout;
 414 };
 415
 416 static void
 417 rb_ssl_connect_realcb(rb_fde_t *F, int status, struct ssl_connect *sconn)
 418 {
 419         F->connect->callback = sconn->callback;
 420         F->connect->data = sconn->data;
 421         rb_free(sconn);
 422         rb_connect_callback(F, status);
 423 }
 424
 425 static void
 426 rb_ssl_tryconn_timeout_cb(rb_fde_t *F, void *data)
 427 {
 428         rb_ssl_connect_realcb(F, RB_ERR_TIMEOUT, data);
 429 }
 430
 431 static void
 432 rb_ssl_tryconn_cb(rb_fde_t *F, void *data)
 433 {
 434         struct ssl_connect *sconn = data;
 435         int ssl_err;
 436         if(!SSL_is_init_finished((SSL *) F->ssl))
 437         {
 438                 if((ssl_err = SSL_connect((SSL *) F->ssl)) <= 0)
 439                 {
 440                         switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 441                         {
 442                         case SSL_ERROR_SYSCALL:
 443                                 if(rb_ignore_errno(errno))
 444                         case SSL_ERROR_WANT_READ:
 445                         case SSL_ERROR_WANT_WRITE:
 446                                         {
 447                                                 F->ssl_errno = get_last_err();
 448                                                 rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE,
 449                                                              rb_ssl_tryconn_cb, sconn);
 450                                                 return;
 451                                         }
 452                         default:
 453                                 F->ssl_errno = get_last_err();
 454                                 rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
 455                                 return;
 456                         }
 457                 }
 458                 else
 459                 {
 460                         rb_ssl_connect_realcb(F, RB_OK, sconn);
 461                 }
 462         }
 463 }
 464
 465 static void
 466 rb_ssl_tryconn(rb_fde_t *F, int status, void *data)
 467 {
 468         struct ssl_connect *sconn = data;
 469         int ssl_err;
 470         if(status != RB_OK)
 471         {
 472                 rb_ssl_connect_realcb(F, status, sconn);
 473                 return;
 474         }
 475
 476         F->type |= RB_FD_SSL;
 477         F->ssl = SSL_new(ssl_client_ctx);
 478         SSL_set_fd((SSL *) F->ssl, F->fd);
 479         rb_setup_ssl_cb(F);
 480         rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
 481         if((ssl_err = SSL_connect((SSL *) F->ssl)) <= 0)
 482         {
 483                 switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 484                 {
 485                 case SSL_ERROR_SYSCALL:
 486                         if(rb_ignore_errno(errno))
 487                 case SSL_ERROR_WANT_READ:
 488                 case SSL_ERROR_WANT_WRITE:
 489                                 {
 490                                         F->ssl_errno = get_last_err();
 491                                         rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE,
 492                                                      rb_ssl_tryconn_cb, sconn);
 493                                         return;
 494                                 }
 495                 default:
 496                         F->ssl_errno = get_last_err();
 497                         rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
 498                         return;
 499                 }
 500         }
 501         else
 502         {
 503                 rb_ssl_connect_realcb(F, RB_OK, sconn);
 504         }
 505 }
 506
 507 void
 508 rb_connect_tcp_ssl(rb_fde_t *F, struct sockaddr *dest,
 509                    struct sockaddr *clocal, int socklen, CNCB * callback, void *data, int timeout)
 510 {
 511         struct ssl_connect *sconn;
 512         if(F == NULL)
 513                 return;
 514
 515         sconn = rb_malloc(sizeof(struct ssl_connect));
 516         sconn->data = data;
 517         sconn->callback = callback;
 518         sconn->timeout = timeout;
 519         rb_connect_tcp(F, dest, clocal, socklen, rb_ssl_tryconn, sconn, timeout);
 520
 521 }
 522
 523 void
 524 rb_ssl_start_connected(rb_fde_t *F, CNCB * callback, void *data, int timeout)
 525 {
 526         struct ssl_connect *sconn;
 527         int ssl_err;
 528         if(F == NULL)
 529                 return;
 530
 531         sconn = rb_malloc(sizeof(struct ssl_connect));
 532         sconn->data = data;
 533         sconn->callback = callback;
 534         sconn->timeout = timeout;
 535         F->connect = rb_malloc(sizeof(struct conndata));
 536         F->connect->callback = callback;
 537         F->connect->data = data;
 538         F->type |= RB_FD_SSL;
 539         F->ssl = SSL_new(ssl_client_ctx);
 540
 541         SSL_set_fd((SSL *) F->ssl, F->fd);
 542         rb_setup_ssl_cb(F);
 543         rb_settimeout(F, sconn->timeout, rb_ssl_tryconn_timeout_cb, sconn);
 544         if((ssl_err = SSL_connect((SSL *) F->ssl)) <= 0)
 545         {
 546                 switch (ssl_err = SSL_get_error((SSL *) F->ssl, ssl_err))
 547                 {
 548                 case SSL_ERROR_SYSCALL:
 549                         if(rb_ignore_errno(errno))
 550                 case SSL_ERROR_WANT_READ:
 551                 case SSL_ERROR_WANT_WRITE:
 552                                 {
 553                                         F->ssl_errno = get_last_err();
 554                                         rb_setselect(F, RB_SELECT_READ | RB_SELECT_WRITE,
 555                                                      rb_ssl_tryconn_cb, sconn);
 556                                         return;
 557                                 }
 558                 default:
 559                         F->ssl_errno = get_last_err();
 560                         rb_ssl_connect_realcb(F, RB_ERROR_SSL, sconn);
 561                         return;
 562                 }
 563         }
 564         else
 565         {
 566                 rb_ssl_connect_realcb(F, RB_OK, sconn);
 567         }
 568 }
 569
 570 int
 571 rb_init_prng(const char *path, prng_seed_t seed_type)
 572 {
 573         if(seed_type == RB_PRNG_DEFAULT)
 574         {
 575 #ifdef _WIN32
 576                 RAND_screen();
 577 #endif
 578                 return RAND_status();
 579         }
 580         if(path == NULL)
 581                 return RAND_status();
 582
 583         switch (seed_type)
 584         {
 585         case RB_PRNG_EGD:
 586                 if(RAND_egd(path) == -1)
 587                         return -1;
 588                 break;
 589         case RB_PRNG_FILE:
 590                 if(RAND_load_file(path, -1) == -1)
 591                         return -1;
 592                 break;
 593 #ifdef _WIN32
 594         case RB_PRNGWIN32:
 595                 RAND_screen();
 596                 break;
 597 #endif
 598         default:
 599                 return -1;
 600         }
 601
 602         return RAND_status();
 603 }
 604
 605 int
 606 rb_get_random(void *buf, size_t length)
 607 {
 608         int ret;
 609
 610         if((ret = RAND_bytes(buf, length)) == 0)
 611         {
 612                 /* remove the error from the queue */
 613                 ERR_get_error();
 614         }
 615         return ret;
 616 }
 617
 618 int
 619 rb_get_pseudo_random(void *buf, size_t length)
 620 {
 621         int ret;
 622         ret = RAND_pseudo_bytes(buf, length);
 623         if(ret < 0)
 624                 return 0;
 625         return 1;
 626 }
 627
 628 const char *
 629 rb_get_ssl_strerror(rb_fde_t *F)
 630 {
 631         return get_ssl_error(F->ssl_errno);
 632 }
 633
 634 int
 635 rb_get_ssl_certfp(rb_fde_t *F, uint8_t certfp[RB_SSL_CERTFP_LEN])
 636 {
 637         X509 *cert;
 638         int res;
 639
 640         if (F->ssl == NULL)
 641                 return 0;
 642
 643         cert = SSL_get_peer_certificate((SSL *) F->ssl);
 644         if(cert != NULL)
 645         {
 646                 res = SSL_get_verify_result((SSL *) F->ssl);
 647                 if(res == X509_V_OK ||
 648                                 res == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN ||
 649                                 res == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE ||
 650                                 res == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
 651                 {
 652                         memcpy(certfp, cert->sha1_hash, RB_SSL_CERTFP_LEN);
 653                         X509_free(cert);
 654                         return 1;
 655                 }
 656                 X509_free(cert);
 657         }
 658
 659         return 0;
 660 }
 661
 662 int
 663 rb_supports_ssl(void)
 664 {
 665         return 1;
 666 }
 667
 668 void
 669 rb_get_ssl_info(char *buf, size_t len)
 670 {
 671         rb_snprintf(buf, len, "Using SSL: %s compiled: 0x%lx, library 0x%lx",
 672                     SSLeay_version(SSLEAY_VERSION),
 673                     (long)OPENSSL_VERSION_NUMBER, SSLeay());
 674 }
 675
 676
 677 #endif /* HAVE_OPESSL */