OpenSSL is included in source tree, so there is only one version. To be sure, I also installed same openssl version via apt-get, same result. There is something very fishy in this lines:

Qt Code: 
  1. OpenSSLAdapter::SSLPostConnectionCheck(SSL* ssl, const char* host) {
  2.   if (!host)
  3.     return false;
  4.  
  5.   // Checking the return from SSL_get_peer_certificate here is not strictly
  6.   // necessary.  With our setup, it is not possible for it to return
  7.   // NULL.  However, it is good form to check the return.
  8.   X509* certificate = SSL_get_peer_certificate(ssl);
  9.   if (!certificate)
  10.     return false;
  11.  
  12. #ifdef _DEBUG
  13.   {
  14.     LOG(LS_INFO) << "Certificate from server:";
  15.     BIO* mem = BIO_new(BIO_s_mem());
  16.     X509_print_ex(mem, certificate, XN_FLAG_SEP_CPLUS_SPC, X509_FLAG_NO_HEADER);
  17.     BIO_write(mem, "\0", 1);
  18.     char* buffer;
  19.     BIO_get_mem_data(mem, &buffer);
  20.     LOG(LS_INFO) << buffer;
  21.     BIO_free(mem);
  22.  
  23.     char* cipher_description =
  24.       SSL_CIPHER_description(SSL_get_current_cipher(ssl), NULL, 128);
  25.     LOG(LS_INFO) << "Cipher: " << cipher_description;
  26.     OPENSSL_free(cipher_description);
  27.   }
  28. #endif
  29.  
  30.   bool ok = false;
  31.   int extension_count = X509_get_ext_count(certificate);
  32.   for (int i = 0; i < extension_count; ++i) {
  33.     X509_EXTENSION* extension = X509_get_ext(certificate, i);
  34.     int extension_nid = OBJ_obj2nid(X509_EXTENSION_get_object(extension));
  35.  
  36.     if (extension_nid == NID_subject_alt_name) {
  37.       X509V3_EXT_METHOD* meth = X509V3_EXT_get(extension);
  38.       if (!meth)
  39.         break;
  40.  
  41.       void* ext_str = NULL;
  42.       if (meth->it) {
  43.         ext_str = ASN1_item_d2i(NULL, &(extension->value->data), extension->value->length,
  44.                                 ASN1_ITEM_ptr(meth->it));
  45.       } else {
  46.         ext_str = meth->d2i(NULL, &(extension->value->data), extension->value->length);
  47.       }
  48.  
  49.       STACK_OF(CONF_VALUE)* value = meth->i2v(meth, ext_str, NULL);
  50.       for (int j = 0; j < sk_CONF_VALUE_num(value); ++j) {
  51.         CONF_VALUE* nval = sk_CONF_VALUE_value(value, j);
  52.         if (!strcmp(nval->name, "DNS") && !strcmp(nval->value, host)) {
  53.           ok = true;
  54.           break;
  55.         }
  56.       }
  57.     }
  58.     if (ok)
  59.       break;
  60.   }
  61.  
  62.   char data[256];
  63.   X509_name_st* subject;
  64.   if (!ok
  65.       && (subject = X509_get_subject_name(certificate))
  66.       && (X509_NAME_get_text_by_NID(subject, NID_commonName,
  67.                                     data, sizeof(data)) > 0)) {
  68.     data[sizeof(data)-1] = 0;
  69.     if (_stricmp(data, host) == 0)
  70.       ok = true;
  71.   }
  72.  
  73.   X509_free(certificate);
  74.  
  75.   if (!ok && ignore_bad_cert()) {
  76.     LOG(LS_WARNING) << "TLS certificate check FAILED.  "
  77.       << "Allowing connection anyway.";
  78.     ok = true;
  79.   }
  80.  
  81.   if (ok) 
  82.     ok = (SSL_get_verify_result(ssl) == X509_V_OK);
  83.  
  84.   if (!ok && ignore_bad_cert()) {
  85.     LOG(LS_INFO) << "Other TLS post connection checks failed.";
  86.     ok = true;
  87.   }
  88.  
  89.   return ok;
  90. }
  91.  
  92. #if _DEBUG
  93.  
  94. // We only use this for tracing and so it is only needed in debug mode
  95.  
  96. void
  97. OpenSSLAdapter::SSLInfoCallback(const SSL* s, int where, int ret) {
  98.   const char* str = "undefined";
  99.   int w = where & ~SSL_ST_MASK;
  100.   if (w & SSL_ST_CONNECT) {
  101.     str = "SSL_connect";
  102.   } else if (w & SSL_ST_ACCEPT) {
  103.     str = "SSL_accept";
  104.   }
  105.   if (where & SSL_CB_LOOP) {
  106.     LOG(LS_INFO) <<  str << ":" << SSL_state_string_long(s);
  107.   } else if (where & SSL_CB_ALERT) {
  108.     str = (where & SSL_CB_READ) ? "read" : "write";
  109.     LOG(LS_INFO) <<  "SSL3 alert " << str
  110.       << ":" << SSL_alert_type_string_long(ret)
  111.       << ":" << SSL_alert_desc_string_long(ret);
  112.   } else if (where & SSL_CB_EXIT) {
  113.     if (ret == 0) {
  114.       LOG(LS_INFO) << str << ":failed in " << SSL_state_string_long(s);
  115.     } else if (ret < 0) {
  116.       LOG(LS_INFO) << str << ":error in " << SSL_state_string_long(s);
  117.     }
  118.   }
  119. }
  120.  
  121. #endif  // _DEBUG
  122.  
  123. int
  124. OpenSSLAdapter::SSLVerifyCallback(int ok, X509_STORE_CTX* store) {
  125. #if _DEBUG
  126.   if (!ok) {
  127.     char data[256];
  128.     X509* cert = X509_STORE_CTX_get_current_cert(store);
  129.     int depth = X509_STORE_CTX_get_error_depth(store);
  130.     int err = X509_STORE_CTX_get_error(store);
  131.  
  132.     LOG(LS_INFO) << "Error with certificate at depth: " << depth;
  133.     X509_NAME_oneline(X509_get_issuer_name(cert), data, sizeof(data));
  134.     LOG(LS_INFO) << "  issuer  = " << data;
  135.     X509_NAME_oneline(X509_get_subject_name(cert), data, sizeof(data));
  136.     LOG(LS_INFO) << "  subject = " << data;
  137.     LOG(LS_INFO) << "  err     = " << err
  138.       << ":" << X509_verify_cert_error_string(err);
  139.   }
  140. #endif
  141.  
  142.   // Get our stream pointer from the store
  143.   SSL* ssl = reinterpret_cast<SSL*>(
  144.                 X509_STORE_CTX_get_ex_data(store,
  145.                   SSL_get_ex_data_X509_STORE_CTX_idx()));
  146.  
  147.   OpenSSLAdapter* stream =
  148.     reinterpret_cast<OpenSSLAdapter*>(SSL_get_app_data(ssl));
  149.  
  150.   if (!ok && stream->ignore_bad_cert()) {
  151.     LOG(LS_WARNING) << "Ignoring cert error while verifying cert chain";
  152.     ok = 1;
  153.   }
  154.  
  155.   return ok;
  156. }
  157.  
  158. SSL_CTX*
  159. OpenSSLAdapter::SetupSSLContext() {
  160.   SSL_CTX* ctx = SSL_CTX_new(TLSv1_client_method());
  161.   if (ctx == NULL) 
  162.       return NULL;
  163.  
  164.   // Add the root cert to the SSL context
  165.   unsigned char* cert_buffer
  166.     = EquifaxSecureGlobalEBusinessCA1_certificate;
  167.   size_t cert_buffer_len = sizeof(EquifaxSecureGlobalEBusinessCA1_certificate);
  168.   X509* cert = d2i_X509(NULL, &cert_buffer, cert_buffer_len);
  169.   if (cert == NULL) {
  170.     SSL_CTX_free(ctx);
  171.     return NULL;
  172.   }
  173.   if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ctx), cert)) {
  174.     X509_free(cert);
  175.     SSL_CTX_free(ctx);
  176.     return NULL;
  177.   }
  178.  
  179. #ifdef _DEBUG
  180.   SSL_CTX_set_info_callback(ctx, SSLInfoCallback);
  181. #endif
  182.  
  183.   SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, SSLVerifyCallback);
  184.   SSL_CTX_set_verify_depth(ctx, 4);
  185.   SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
  186.  
  187.   return ctx;
  188. }
  189.  
  190. } // namespace cricket
To copy to clipboard, switch view to plain text mode