提交: 9ade514641b46ed744acb24265eff6616954113d - ffftp (git)

FFFTPのソースコードです。

Commit MetaInfo

• 修訂: 9ade514641b46ed744acb24265eff6616954113d (tree)
• 時間: 2011-11-15 23:47:39
• 作者: s_kawamoto <s_kawamoto@user...>
• Commiter: s_kawamoto

Log Message

Add support for SSL root CA certificates (please put "ssl.pem" manually).
Fix bugs of opening wrong files when they contain no extensions.
Modify documents.

Change Summary

• modified: FFFTP_Eng_Release/FFFTP.exe
• modified: Release/FFFTP.exe
• modified: Resource/FFFTP.rc
• modified: Resource/resource.h
• modified: Resource_eng/FFFTP-eng.rc
• modified: Resource_eng/resource.h
• modified: common.h
• modified: doc/eng/FFFTP.txt
• modified: doc/eng/history.txt
• modified: doc/jpn/FFFTP.txt
• modified: doc/jpn/history.txt
• modified: main.c
• modified: misc.c
• modified: registry.c
• modified: socketwrapper.c
• modified: socketwrapper.h

差異

Binary files a/FFFTP_Eng_Release/FFFTP.exe and b/FFFTP_Eng_Release/FFFTP.exe differ

Binary files a/Release/FFFTP.exe and b/Release/FFFTP.exe differ

--- a/Resource/FFFTP.rc
+++ b/Resource/FFFTP.rc
@@ -1369,7 +1369,7 @@ END
 
 savecrypt_dlg DIALOG  0, 0, 146, 50
 STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION
-CAPTION "パスワードの保存"
+CAPTION "暗号化の状態の保存"
 FONT 9, "ＭＳ Ｐゴシック"
 BEGIN
     LTEXT           "現在の暗号化の状態を保存しますか？",-1,7,7,132,17
@@ -1377,6 +1377,16 @@ BEGIN
     PUSHBUTTON      "いいえ",IDCANCEL,78,29,50,14
 END
 
+updatesslroot_dlg DIALOG  0, 0, 211, 64
+STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_POPUP | WS_CAPTION
+CAPTION "SSLルート証明書を更新"
+FONT 9, "ＭＳ Ｐゴシック"
+BEGIN
+    LTEXT           "SSLルート証明書の変更が検出されました。手動で証明書を更新していない場合、マルウェアなどにより改竄された可能性があります。\r\n変更された証明書を使用しますか。",-1,7,7,196,36
+    DEFPUSHBUTTON   "いいえ",IDCANCEL,112,42,50,14
+    PUSHBUTTON      "はい",IDOK,48,42,50,14
+END
+
 
 /////////////////////////////////////////////////////////////////////////////
 //
@@ -2016,6 +2026,14 @@ BEGIN
         TOPMARGIN, 7
         BOTTOMMARGIN, 43
     END
+
+    updatesslroot_dlg, DIALOG
+    BEGIN
+        LEFTMARGIN, 7
+        RIGHTMARGIN, 139
+        TOPMARGIN, 7
+        BOTTOMMARGIN, 43
+    END
 END
 #endif    // APSTUDIO_INVOKED
 

--- a/Resource/resource.h
+++ b/Resource/resource.h
@@ -111,6 +111,7 @@
 #define hset_crypt_dlg                  189
 #define hset_adv3_dlg                   190
 #define savecrypt_dlg                   191
+#define updatesslroot_dlg               192
 #define TRANS_TIME_BAR                  1002
 #define TRANS_TEXT                      1003
 #define TRANS_REMOTE                    1003
@@ -616,7 +617,7 @@
 // 
 #ifdef APSTUDIO_INVOKED
 #ifndef APSTUDIO_READONLY_SYMBOLS
-#define _APS_NEXT_RESOURCE_VALUE        192
+#define _APS_NEXT_RESOURCE_VALUE        193
 #define _APS_NEXT_COMMAND_VALUE         40176
 #define _APS_NEXT_CONTROL_VALUE         1208
 #define _APS_NEXT_SYMED_VALUE           101

--- a/Resource_eng/FFFTP-eng.rc
+++ b/Resource_eng/FFFTP-eng.rc
@@ -1395,7 +1395,7 @@ END
 
 savecrypt_dlg DIALOG  0, 0, 146, 50
 STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION
-CAPTION "パスワードの保存"
+CAPTION "Save Encryption Status"
 FONT 9, "MS Sans Serif"
 BEGIN
     LTEXT           "Save current encryption status?",-1,7,7,132,17
@@ -1403,6 +1403,16 @@ BEGIN
     PUSHBUTTON      "No",IDCANCEL,78,29,50,14
 END
 
+updatesslroot_dlg DIALOG  0, 0, 211, 64
+STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_POPUP | WS_CAPTION
+CAPTION "Update SSL Root certificate"
+FONT 9, "MS Sans Serif"
+BEGIN
+    LTEXT           "Modified SSL Root certificate was detected.If you did not update it manually, it might be tampered with by malwares.\r\nUse the modified certificate?",-1,7,7,196,36
+    DEFPUSHBUTTON   "No",IDCANCEL,112,42,50,14
+    PUSHBUTTON      "Yes",IDOK,48,42,50,14
+END
+
 
 /////////////////////////////////////////////////////////////////////////////
 //
@@ -2039,6 +2049,14 @@ BEGIN
         TOPMARGIN, 7
         BOTTOMMARGIN, 43
     END
+
+    updatesslroot_dlg, DIALOG
+    BEGIN
+        LEFTMARGIN, 7
+        RIGHTMARGIN, 139
+        TOPMARGIN, 7
+        BOTTOMMARGIN, 43
+    END
 END
 #endif    // APSTUDIO_INVOKED
 

--- a/Resource_eng/resource.h
+++ b/Resource_eng/resource.h
@@ -111,6 +111,7 @@
 #define hset_crypt_dlg                  189
 #define hset_adv3_dlg                   190
 #define savecrypt_dlg                   191
+#define updatesslroot_dlg               192
 #define TRANS_TIME_BAR                  1002
 #define TRANS_TEXT                      1003
 #define TRANS_REMOTE                    1003
@@ -616,7 +617,7 @@
 // 
 #ifdef APSTUDIO_INVOKED
 #ifndef APSTUDIO_READONLY_SYMBOLS
-#define _APS_NEXT_RESOURCE_VALUE        192
+#define _APS_NEXT_RESOURCE_VALUE        193
 #define _APS_NEXT_COMMAND_VALUE         40176
 #define _APS_NEXT_CONTROL_VALUE         1208
 #define _APS_NEXT_SYMED_VALUE           101

--- a/common.h
+++ b/common.h
@@ -1250,6 +1250,7 @@ int AskAutoExit(void);
 // 暗号化通信対応
 BOOL __stdcall SSLTimeoutCallback(BOOL* pbAborted);
 BOOL __stdcall SSLConfirmCallback(BOOL* pbAborted, BOOL bVerified, LPCSTR Certificate, LPCSTR CommonName);
+BOOL LoadSSLRootCAFile();
 
 /*===== filelist.c =====*/
 

--- a/doc/eng/FFFTP.txt
+++ b/doc/eng/FFFTP.txt
@@ -53,6 +53,9 @@ Changes in Ver.1.99
    This may allow to transfer files successfully as with 1.97b or earlier,
    but sometimes may cause some errors.
 
+-- Changed to verify SSL/TLS certificates with root CAs in FTPS connections.
+   Please modify "ssl.pem" in PEM format if you want to update root CA list.
+
 
 Outline
 -------

--- a/doc/eng/history.txt
+++ b/doc/eng/history.txt
@@ -21,6 +21,9 @@ Changes in Ver.1.99
 
 -- Changed to detect encoding of strings in INI file automatically.
 
+-- Changed to verify SSL/TLS certificates with root CAs in FTPS connections.
+   Please modify "ssl.pem" in PEM format if you want to update root CA list.
+
 Changes in Ver.1.98c
 --------------------
 

--- a/doc/jpn/FFFTP.txt
+++ b/doc/jpn/FFFTP.txt
@@ -55,6 +55,10 @@ Ver 1.99
 　追加しました。これにより1.97b以前で転送可能だったが1.98で転送不能に
 　なるという症状が改善されますが、不具合が発生する可能性があります。
 
+・FTPSで接続した時にSSL/TLSのルート証明書を用いてホストの証明書を検証
+　するように変更しました。ルート証明書を更新するには同梱の"ssl.pem"
+　ファイルをPEM形式に従って書き換えてください。
+
 
 Ver 1.96d以前へ戻す場合
 -----------------------

--- a/doc/jpn/history.txt
+++ b/doc/jpn/history.txt
@@ -27,6 +27,10 @@ FFFTP
 　追加しました。これにより1.97b以前で転送可能だったが1.98で転送不能に
 　なるという症状が改善されますが、不具合が発生する可能性があります。
 
+・FTPSで接続した時にSSL/TLSのルート証明書を用いてホストの証明書を検証
+　するように変更しました。ルート証明書を更新するには同梱の"ssl.pem"
+　ファイルをPEM形式に従って書き換えてください。
+
 ■Ver 1.98c
 
 ・日本語ドメイン名のホストへの接続時にアドレスをPunycodeへ変換してから

--- a/main.c
+++ b/main.c
@@ -130,6 +130,9 @@ static int SuppressRefresh = 0;
 
 static DWORD dwCookie;
 
+// 暗号化通信対応
+static char SSLRootCAFilePath[FMAX_PATH+1];
+
 
 /*===== グローバルなワーク =====*/
 
@@ -223,6 +226,7 @@ int FolderAttr = NO;
 int FolderAttrNum = 777;
 // 暗号化通信対応
 BYTE CertificateCacheHash[MAX_CERT_CACHE_HASH][20];
+BYTE SSLRootCAFileHash[20];
 
 
 
@@ -472,6 +476,9 @@ static int InitApp(LPSTR lpszCmdLine, int cmdShow)
 			// 暗号化通信対応
 			SetSSLTimeoutCallback(TimeOut * 1000, SSLTimeoutCallback);
 			SetSSLConfirmCallback(SSLConfirmCallback);
+			GetModuleFileName(NULL, SSLRootCAFilePath, FMAX_PATH);
+			strcpy(GetFileName(SSLRootCAFilePath), "ssl.pem");
+			LoadSSLRootCAFile();
 
 			LoadJre();
 			if(NoRasControl == NO)
@@ -2950,3 +2957,35 @@ BOOL __stdcall SSLConfirmCallback(BOOL* pbAborted, BOOL bVerified, LPCSTR Certif
 	return bResult;
 }
 
+BOOL LoadSSLRootCAFile()
+{
+	BOOL bResult;
+	HANDLE hFile;
+	DWORD Size;
+	BYTE* pBuffer;
+	uint32 Hash[5];
+	bResult = FALSE;
+	if((hFile = CreateFile(SSLRootCAFilePath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
+	{
+		Size = GetFileSize(hFile, NULL);
+		if(pBuffer = (BYTE*)malloc(Size))
+		{
+			if(ReadFile(hFile, pBuffer, Size, &Size, NULL))
+			{
+				sha_memory((char*)pBuffer, (uint32)Size, (uint32*)&Hash);
+				// 同梱する"ssl.pem"に合わせてSHA1ハッシュ値を変更すること
+				if(memcmp(&Hash, &SSLRootCAFileHash, 20) == 0 || memcmp(&Hash, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 20) == 0
+					|| DialogBox(GetFtpInst(), MAKEINTRESOURCE(updatesslroot_dlg), GetMainHwnd(), ExeEscDialogProc) == YES)
+				{
+					memcpy(&SSLRootCAFileHash, &Hash, 20);
+					if(SetSSLRootCertificate(pBuffer, Size))
+						bResult = TRUE;
+				}
+			}
+			free(pBuffer);
+		}
+		CloseHandle(hFile);
+	}
+	return bResult;
+}
+

--- a/misc.c
+++ b/misc.c
@@ -1733,6 +1733,7 @@ char *MakeNumString(LONGLONG Num, char *Buf, BOOL Comma)
 // 現在UNC対応の予定は無い
 char* MakeDistinguishableFileName(char* Out, char* In)
 {
+	char* Fname;
 	char Tmp[FMAX_PATH+1];
 	char Tmp2[FMAX_PATH+3];
 	HANDLE hFind;
@@ -1741,6 +1742,7 @@ char* MakeDistinguishableFileName(char* Out, char* In)
 		strcpy(Out, In);
 	else
 	{
+		Fname = GetFileName(In);
 		strcpy(Tmp, In);
 		strcpy(Tmp2, Tmp);
 		strcat(Tmp2, ".*");
@@ -1748,12 +1750,12 @@ char* MakeDistinguishableFileName(char* Out, char* In)
 		{
 			do
 			{
-				if(strchr(Find.cFileName, '.'))
+				if(strcmp(Find.cFileName, Fname) != 0)
 					break;
 			}
 			while(FindNextFile(hFind, &Find));
 			FindClose(hFind);
-			if(strchr(Find.cFileName, '.'))
+			if(strcmp(Find.cFileName, Fname) != 0)
 			{
 				strcat(Tmp, " ");
 				strcpy(Tmp2, Tmp);

--- a/registry.c
+++ b/registry.c
@@ -86,6 +86,9 @@ static int ReadMultiStringFromReg(void *Handle, char *Name, char *Str, DWORD Siz
 static int WriteMultiStringToReg(void *Handle, char *Name, char *Str);
 static int ReadBinaryFromReg(void *Handle, char *Name, void *Bin, DWORD Size);
 static int WriteBinaryToReg(void *Handle, char *Name, void *Bin, int Len);
+// 暗号化通信対応
+static int StrCatOut(char *Src, int Len, char *Dst);
+static int StrReadIn(char *Src, int Max, char *Dst);
 
 int CheckPasswordValidity( char* Password, int length, const char* HashStr );
 void CreatePasswordHash( char* Password, int length, char* HashStr );
@@ -189,6 +192,7 @@ extern int FolderAttrNum;
 
 // 暗号化通信対応
 extern BYTE CertificateCacheHash[MAX_CERT_CACHE_HASH][20];
+extern BYTE SSLRootCAFileHash[20];
 
 /*----- マスタパスワードの設定 ----------------------------------------------
 *
@@ -295,6 +299,7 @@ void SaveRegistory(void)
 	// 暗号化通信対応
 //	char Str[FMAX_PATH+1];
 	char Str[PRIVATE_KEY_LEN*4+1];
+	char Buf[FMAX_PATH+1];
 	int i;
 	int n;
 	HOSTDATA DefaultHost;
@@ -589,6 +594,10 @@ void SaveRegistory(void)
 
 				// 暗号化通信対応
 				WriteBinaryToReg(hKey4, "CertCacheHash", &CertificateCacheHash, sizeof(CertificateCacheHash));
+				strcpy(Buf, "");
+				StrCatOut((char*)&SSLRootCAFileHash, sizeof(SSLRootCAFileHash), Buf);
+				EncodePassword(Buf, Str);
+				WriteStringToReg(hKey4, "RootCertHash", Str);
 			}
 			CloseSubKey(hKey4);
 		}
@@ -619,6 +628,7 @@ int LoadRegistory(void)
 	// 暗号化通信対応
 //	char Str[256];	/* ASCII_EXT_LENより大きい事 */
 	char Str[PRIVATE_KEY_LEN*4+1];
+	char Buf[FMAX_PATH+1];
 	char *Pos;
 	char *Pos2;
 	HOSTDATA Host;
@@ -944,6 +954,9 @@ int LoadRegistory(void)
 
 			// 暗号化通信対応
 			ReadBinaryFromReg(hKey4, "CertCacheHash", &CertificateCacheHash, sizeof(CertificateCacheHash));
+			ReadStringFromReg(hKey4, "RootCertHash", Str, PRIVATE_KEY_LEN*4+1);
+			DecodePassword(Str, Buf);
+			StrReadIn(Buf, sizeof(SSLRootCAFileHash), (char*)&SSLRootCAFileHash);
 
 			CloseSubKey(hKey4);
 		}
@@ -1796,8 +1809,9 @@ typedef struct regdatatbl {
 
 static BOOL WriteOutRegToFile(REGDATATBL *Pos);
 static int ReadInReg(char *Name, REGDATATBL **Handle);
-static int StrCatOut(char *Src, int Len, char *Dst);
-static int StrReadIn(char *Src, int Max, char *Dst);
+// 暗号化通信対応
+//static int StrCatOut(char *Src, int Len, char *Dst);
+//static int StrReadIn(char *Src, int Max, char *Dst);
 static char *ScanValue(void *Handle, char *Name);
 
 

--- a/socketwrapper.c
+++ b/socketwrapper.c
@@ -36,7 +36,7 @@ typedef X509* (__cdecl* _SSL_get_peer_certificate)(const SSL*);
 typedef long (__cdecl* _SSL_get_verify_result)(const SSL*);
 typedef SSL_SESSION* (__cdecl* _SSL_get_session)(SSL*);
 typedef int (__cdecl* _SSL_set_session)(SSL*, SSL_SESSION*);
-typedef int (__cdecl* _SSL_CTX_use_certificate)(SSL_CTX*, X509*);
+typedef X509_STORE* (__cdecl* _SSL_CTX_get_cert_store)(const SSL_CTX*);
 typedef BIO_METHOD* (__cdecl* _BIO_s_mem)();
 typedef BIO* (__cdecl* _BIO_new)(BIO_METHOD*);
 typedef int (__cdecl* _BIO_free)(BIO*);
@@ -47,6 +47,7 @@ typedef int (__cdecl* _X509_print_ex)(BIO*, X509*, unsigned long, unsigned long)
 typedef X509_NAME* (__cdecl* _X509_get_subject_name)(X509*);
 typedef int (__cdecl* _X509_NAME_print_ex)(BIO*, X509_NAME*, int, unsigned long);
 typedef X509* (__cdecl* _PEM_read_bio_X509)(BIO*, X509**, pem_password_cb*, void*);
+typedef int (__cdecl* _X509_STORE_add_cert)(X509_STORE*, X509*);
 
 _SSL_load_error_strings p_SSL_load_error_strings;
 _SSL_library_init p_SSL_library_init;
@@ -68,7 +69,7 @@ _SSL_get_peer_certificate p_SSL_get_peer_certificate;
 _SSL_get_verify_result p_SSL_get_verify_result;
 _SSL_get_session p_SSL_get_session;
 _SSL_set_session p_SSL_set_session;
-_SSL_CTX_use_certificate p_SSL_CTX_use_certificate;
+_SSL_CTX_get_cert_store p_SSL_CTX_get_cert_store;
 _BIO_s_mem p_BIO_s_mem;
 _BIO_new p_BIO_new;
 _BIO_free p_BIO_free;
@@ -79,6 +80,7 @@ _X509_print_ex p_X509_print_ex;
 _X509_get_subject_name p_X509_get_subject_name;
 _X509_NAME_print_ex p_X509_NAME_print_ex;
 _PEM_read_bio_X509 p_PEM_read_bio_X509;
+_X509_STORE_add_cert p_X509_STORE_add_cert;
 
 #define MAX_SSL_SOCKET 16
 
@@ -141,7 +143,7 @@ BOOL LoadOpenSSL()
 		|| !(p_SSL_get_verify_result = (_SSL_get_verify_result)GetProcAddress(g_hOpenSSL, "SSL_get_verify_result"))
 		|| !(p_SSL_get_session = (_SSL_get_session)GetProcAddress(g_hOpenSSL, "SSL_get_session"))
 		|| !(p_SSL_set_session = (_SSL_set_session)GetProcAddress(g_hOpenSSL, "SSL_set_session"))
-		|| !(p_SSL_CTX_use_certificate = (_SSL_CTX_use_certificate)GetProcAddress(g_hOpenSSL, "SSL_CTX_use_certificate")))
+		|| !(p_SSL_CTX_get_cert_store = (_SSL_CTX_get_cert_store)GetProcAddress(g_hOpenSSL, "SSL_CTX_get_cert_store")))
 	{
 		if(g_hOpenSSL)
 			FreeLibrary(g_hOpenSSL);
@@ -159,7 +161,8 @@ BOOL LoadOpenSSL()
 		|| !(p_X509_print_ex = (_X509_print_ex)GetProcAddress(g_hOpenSSLCommon, "X509_print_ex"))
 		|| !(p_X509_get_subject_name = (_X509_get_subject_name)GetProcAddress(g_hOpenSSLCommon, "X509_get_subject_name"))
 		|| !(p_X509_NAME_print_ex = (_X509_NAME_print_ex)GetProcAddress(g_hOpenSSLCommon, "X509_NAME_print_ex"))
-		|| !(p_PEM_read_bio_X509 = (_PEM_read_bio_X509)GetProcAddress(g_hOpenSSLCommon, "PEM_read_bio_X509")))
+		|| !(p_PEM_read_bio_X509 = (_PEM_read_bio_X509)GetProcAddress(g_hOpenSSLCommon, "PEM_read_bio_X509"))
+		|| !(p_X509_STORE_add_cert = (_X509_STORE_add_cert)GetProcAddress(g_hOpenSSLCommon, "X509_STORE_add_cert")))
 	{
 		if(g_hOpenSSL)
 			FreeLibrary(g_hOpenSSL);
@@ -283,7 +286,7 @@ BOOL ConfirmSSLCertificate(SSL* pSSL, BOOL* pbAborted)
 		}
 		p_X509_free(pX509);
 	}
-	if(p_SSL_get_verify_result(pSSL) == X509_V_OK)
+	if(pX509 && p_SSL_get_verify_result(pSSL) == X509_V_OK)
 		bVerified = TRUE;
 	pCN = pSubject;
 	while(pCN)
@@ -326,9 +329,14 @@ void SetSSLConfirmCallback(LPSSLCONFIRMCALLBACK pCallback)
 }
 
 // SSLルート証明書を設定
-BOOL SetSSLRootCertificate(void* pData, DWORD Length)
+// PEM形式のみ指定可能
+BOOL SetSSLRootCertificate(const void* pData, DWORD Length)
 {
 	BOOL r;
+	X509_STORE* pStore;
+	BYTE* p;
+	BYTE* pBegin;
+	BYTE* pEnd;
 	BIO* pBIO;
 	X509* pX509;
 	if(!g_bOpenSSLLoaded)
@@ -339,15 +347,45 @@ BOOL SetSSLRootCertificate(void* pData, DWORD Length)
 		g_pOpenSSLCTX = p_SSL_CTX_new(p_SSLv23_method());
 	if(g_pOpenSSLCTX)
 	{
-		if(pBIO = p_BIO_new_mem_buf(pData, Length))
+		if(pStore = p_SSL_CTX_get_cert_store(g_pOpenSSLCTX))
 		{
-			if(pX509 = p_PEM_read_bio_X509(pBIO, NULL, NULL, NULL))
+			p = (BYTE*)pData;
+			pBegin = NULL;
+			pEnd = NULL;
+			while(Length > 0)
 			{
-				if(p_SSL_CTX_use_certificate(g_pOpenSSLCTX, pX509) == 1)
-					r = TRUE;
-				p_X509_free(pX509);
+				if(!pBegin)
+				{
+					if(Length < 27)
+						break;
+					if(memcmp(p, "-----BEGIN CERTIFICATE-----", 27) == 0)
+						pBegin = p;
+				}
+				else if(!pEnd)
+				{
+					if(Length < 25)
+						break;
+					if(memcmp(p, "-----END CERTIFICATE-----", 25) == 0)
+						pEnd = p + 25;
+				}
+				if(pBegin && pEnd)
+				{
+					if(pBIO = p_BIO_new_mem_buf(pBegin, (int)((size_t)pEnd - (size_t)pBegin)))
+					{
+						if(pX509 = p_PEM_read_bio_X509(pBIO, NULL, NULL, NULL))
+						{
+							if(p_X509_STORE_add_cert(pStore, pX509) == 1)
+								r = TRUE;
+							p_X509_free(pX509);
+						}
+						p_BIO_free(pBIO);
+					}
+					pBegin = NULL;
+					pEnd = NULL;
+				}
+				p++;
+				Length--;
 			}
-			p_BIO_free(pBIO);
 		}
 	}
 	LeaveCriticalSection(&g_OpenSSLLock);

--- a/socketwrapper.h
+++ b/socketwrapper.h
@@ -18,7 +18,7 @@ void FreeOpenSSL();
 BOOL IsOpenSSLLoaded();
 void SetSSLTimeoutCallback(DWORD Timeout, LPSSLTIMEOUTCALLBACK pCallback);
 void SetSSLConfirmCallback(LPSSLCONFIRMCALLBACK pCallback);
-BOOL SetSSLRootCertificate(void* pData, DWORD Length);
+BOOL SetSSLRootCertificate(const void* pData, DWORD Length);
 BOOL IsHostNameMatched(LPCSTR HostName, LPCSTR CommonName);
 BOOL AttachSSL(SOCKET s, SOCKET parent, BOOL* pbAborted);
 BOOL DetachSSL(SOCKET s);