Support retries in certificate callback

[openssl.git] / ssl / bio_ssl.c

diff --git a/ssl/bio_ssl.c b/ssl/bio_ssl.c
index 420deb7fc966b656651766aa984d5f3eaf369cc7..e9552caee2aa997cb882f0a82376a7527f9a7c15 100644 (file)
--- a/ssl/bio_ssl.c
+++ b/ssl/bio_ssl.c
@@ -348,7 +348,11 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
                break;
        case BIO_C_SET_SSL:
                if (ssl != NULL)
+                       {
                        ssl_free(b);
+                       if (!ssl_new(b))
+                               return 0;
+                       }
                b->shutdown=(int)num;
                ssl=(SSL *)ptr;
                ((BIO_SSL *)b->ptr)->ssl=ssl;
@@ -398,17 +402,19 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
                        }
                break;
        case BIO_CTRL_POP:
-               /* ugly bit of a hack */
-               if (ssl->rbio != ssl->wbio) /* we are in trouble :-( */
-                       {
-                       BIO_free_all(ssl->wbio);
-                       }
-               if (b->next_bio != NULL)
+               /* Only detach if we are the BIO explicitly being popped */
+               if (b == ptr)
                        {
-                       CRYPTO_add(&b->next_bio->references,1,CRYPTO_LOCK_BIO);
+                       /* Shouldn't happen in practice because the
+                        * rbio and wbio are the same when pushed.
+                        */
+                       if (ssl->rbio != ssl->wbio)
+                               BIO_free_all(ssl->wbio);
+                       if (b->next_bio != NULL)
+                               CRYPTO_add(&b->next_bio->references,-1,CRYPTO_LOCK_BIO);
+                       ssl->wbio=NULL;
+                       ssl->rbio=NULL;
                        }
-               ssl->wbio=NULL;
-               ssl->rbio=NULL;
                break;
        case BIO_C_DO_STATE_MACHINE:
                BIO_clear_retry_flags(b);
@@ -532,6 +538,7 @@ err:
 
 BIO *BIO_new_ssl_connect(SSL_CTX *ctx)
        {
+#ifndef OPENSSL_NO_SOCK
        BIO *ret=NULL,*con=NULL,*ssl=NULL;
 
        if ((con=BIO_new(BIO_s_connect())) == NULL)
@@ -543,7 +550,7 @@ BIO *BIO_new_ssl_connect(SSL_CTX *ctx)
        return(ret);
 err:
        if (con != NULL) BIO_free(con);
-       if (ret != NULL) BIO_free(ret);
+#endif
        return(NULL);
        }