X-Git-Url: https://git.openssl.org/?a=blobdiff_plain;f=ssl%2Fssl_cert.c;h=05a444745059980ec67abe3c33ecd7aa3fefdfbc;hb=df6da24bda457b724ba3e894e6c329a9b93d536f;hp=38e7b822e5e4c94b720db1b70fc4acefff3b661a;hpb=16f8d4ebf0fd4847fa83d9c61f4150273cb4f533;p=openssl.git diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c index 38e7b822e5..05a4447450 100644 --- a/ssl/ssl_cert.c +++ b/ssl/ssl_cert.c @@ -123,7 +123,7 @@ # include #endif -#include "o_dir.h" +#include "internal/o_dir.h" #include #include #include @@ -165,34 +165,17 @@ int SSL_get_ex_data_X509_STORE_CTX_idx(void) return ssl_x509_store_ctx_idx; } -void ssl_cert_set_default_md(CERT *cert) -{ - /* Set digest values to defaults */ -#ifndef OPENSSL_NO_DSA - cert->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1(); -#endif -#ifndef OPENSSL_NO_RSA - cert->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1(); - cert->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1(); -#endif -#ifndef OPENSSL_NO_EC - cert->pkeys[SSL_PKEY_ECC].digest = EVP_sha1(); -#endif -} - CERT *ssl_cert_new(void) { - CERT *ret = OPENSSL_malloc(sizeof(*ret)); + CERT *ret = OPENSSL_zalloc(sizeof(*ret)); if (ret == NULL) { SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE); return (NULL); } - memset(ret, 0, sizeof(*ret)); ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]); ret->references = 1; - ssl_cert_set_default_md(ret); ret->sec_cb = ssl_security_default_callback; ret->sec_level = OPENSSL_TLS_SECURITY_LEVEL; ret->sec_ex = NULL; @@ -201,7 +184,7 @@ CERT *ssl_cert_new(void) CERT *ssl_cert_dup(CERT *cert) { - CERT *ret = OPENSSL_malloc(sizeof(*ret)); + CERT *ret = OPENSSL_zalloc(sizeof(*ret)); int i; if (ret == NULL) { @@ -209,14 +192,7 @@ CERT *ssl_cert_dup(CERT *cert) return (NULL); } - memset(ret, 0, sizeof(*ret)); - ret->key = &ret->pkeys[cert->key - cert->pkeys]; - ret->valid = cert->valid; - ret->mask_k = cert->mask_k; - ret->mask_a = cert->mask_a; - ret->export_mask_k = cert->export_mask_k; - ret->export_mask_a = cert->export_mask_a; #ifndef OPENSSL_NO_RSA if (cert->rsa_tmp != NULL) { @@ -271,7 +247,7 @@ CERT *ssl_cert_dup(CERT *cert) CERT_PKEY *rpk = ret->pkeys + i; if (cpk->x509 != NULL) { rpk->x509 = cpk->x509; - CRYPTO_add(&rpk->x509->references, 1, CRYPTO_LOCK_X509); + X509_up_ref(rpk->x509); } if (cpk->privatekey != NULL) { @@ -286,8 +262,6 @@ CERT *ssl_cert_dup(CERT *cert) goto err; } } - rpk->valid_flags = 0; -#ifndef OPENSSL_NO_TLSEXT if (cert->pkeys[i].serverinfo != NULL) { /* Just copy everything. */ ret->pkeys[i].serverinfo = @@ -302,20 +276,10 @@ CERT *ssl_cert_dup(CERT *cert) cert->pkeys[i].serverinfo, cert->pkeys[i].serverinfo_length); } -#endif } ret->references = 1; - /* - * Set digests to defaults. NB: we don't copy existing values as they - * will be set during handshake. - */ - ssl_cert_set_default_md(ret); - /* Peer sigalgs set to NULL as we get these from handshake too */ - ret->peer_sigalgs = NULL; - ret->peer_sigalgslen = 0; - /* Configured sigalgs however we copy across */ - + /* Configured sigalgs copied across */ if (cert->conf_sigalgs) { ret->conf_sigalgs = OPENSSL_malloc(cert->conf_sigalgslen); if (!ret->conf_sigalgs) @@ -361,18 +325,20 @@ CERT *ssl_cert_dup(CERT *cert) ret->chain_store = cert->chain_store; } - ret->ciphers_raw = NULL; - ret->sec_cb = cert->sec_cb; ret->sec_level = cert->sec_level; ret->sec_ex = cert->sec_ex; -#ifndef OPENSSL_NO_TLSEXT if (!custom_exts_copy(&ret->cli_ext, &cert->cli_ext)) goto err; if (!custom_exts_copy(&ret->srv_ext, &cert->srv_ext)) goto err; -#endif + + if (cert->psk_identity_hint) { + ret->psk_identity_hint = BUF_strdup(cert->psk_identity_hint); + if (ret->psk_identity_hint == NULL) + goto err; + } return (ret); @@ -397,13 +363,9 @@ void ssl_cert_clear_certs(CERT *c) cpk->privatekey = NULL; sk_X509_pop_free(cpk->chain, X509_free); cpk->chain = NULL; -#ifndef OPENSSL_NO_TLSEXT OPENSSL_free(cpk->serverinfo); cpk->serverinfo = NULL; cpk->serverinfo_length = 0; -#endif - /* Clear all flags apart from explicit sign */ - cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN; } } @@ -438,20 +400,17 @@ void ssl_cert_free(CERT *c) #endif ssl_cert_clear_certs(c); - OPENSSL_free(c->peer_sigalgs); OPENSSL_free(c->conf_sigalgs); OPENSSL_free(c->client_sigalgs); OPENSSL_free(c->shared_sigalgs); OPENSSL_free(c->ctypes); X509_STORE_free(c->verify_store); X509_STORE_free(c->chain_store); - OPENSSL_free(c->ciphers_raw); -#ifndef OPENSSL_NO_TLSEXT custom_exts_free(&c->cli_ext); custom_exts_free(&c->srv_ext); +#ifndef OPENSSL_NO_PSK + OPENSSL_free(c->psk_identity_hint); #endif - OPENSSL_clear_free(c->pms, c->pmslen); - c->pms = NULL; OPENSSL_free(c); } @@ -510,7 +469,7 @@ int ssl_cert_add1_chain_cert(SSL *s, SSL_CTX *ctx, X509 *x) { if (!ssl_cert_add0_chain_cert(s, ctx, x)) return 0; - CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509); + X509_up_ref(x); return 1; } @@ -566,76 +525,6 @@ void ssl_cert_set_cert_cb(CERT *c, int (*cb) (SSL *ssl, void *arg), void *arg) c->cert_cb_arg = arg; } -SESS_CERT *ssl_sess_cert_new(void) -{ - SESS_CERT *ret; - - ret = OPENSSL_malloc(sizeof(*ret)); - if (ret == NULL) { - SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE); - return NULL; - } - - memset(ret, 0, sizeof(*ret)); - ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]); - ret->references = 1; - - return ret; -} - -void ssl_sess_cert_free(SESS_CERT *sc) -{ - int i; - - if (sc == NULL) - return; - - i = CRYPTO_add(&sc->references, -1, CRYPTO_LOCK_SSL_SESS_CERT); -#ifdef REF_PRINT - REF_PRINT("SESS_CERT", sc); -#endif - if (i > 0) - return; -#ifdef REF_CHECK - if (i < 0) { - fprintf(stderr, "ssl_sess_cert_free, bad reference count\n"); - abort(); /* ok */ - } -#endif - - /* i == 0 */ - sk_X509_pop_free(sc->cert_chain, X509_free); - for (i = 0; i < SSL_PKEY_NUM; i++) { - X509_free(sc->peer_pkeys[i].x509); -#if 0 - /* - * We don't have the peer's private key. This line is just - * here as a reminder that we're still using a not-quite-appropriate - * data structure. - */ - EVP_PKEY_free(sc->peer_pkeys[i].privatekey); -#endif - } - -#ifndef OPENSSL_NO_RSA - RSA_free(sc->peer_rsa_tmp); -#endif -#ifndef OPENSSL_NO_DH - DH_free(sc->peer_dh_tmp); -#endif -#ifndef OPENSSL_NO_EC - EC_KEY_free(sc->peer_ecdh_tmp); -#endif - - OPENSSL_free(sc); -} - -int ssl_set_peer_cert_type(SESS_CERT *sc, int type) -{ - sc->peer_cert_type = type; - return (1); -} - int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk) { X509 *x; @@ -1148,8 +1037,7 @@ int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags) if (sk_X509_num(chain) > 0) { /* See if last cert is self signed */ x = sk_X509_value(chain, sk_X509_num(chain) - 1); - X509_check_purpose(x, -1, 0); - if (x->ex_flags & EXFLAG_SS) { + if (X509_get_extension_flags(x) & EXFLAG_SS) { x = sk_X509_pop(chain); X509_free(x); }